CEO Executive Assistant
Published October 22, 2026.
An emergency contact record is only useful if it is current, complete, and reachable by the person who needs it at the moment of an emergency. Many executive offices have a list. Fewer can say when each entry was last verified, whether the named person still wants to be contacted, or whether the record is stored somewhere that can be reached when the primary systems are down.
This article describes a local audit method for emergency contact data freshness. It measures the recency and completeness of the records, the results of a controlled reachability test, and the access controls around the data. It does not test the company’s emergency response, and it does not replace HR, security, or legal review.
Research question and unit
The primary question is: for a defined set of key-person emergency contact records, what share were verified within the company’s stated review interval, what share had all required fields, and what share passed a controlled reachability check?
The unit is one contact record for one key person and one authorized contact. A key person may have multiple contacts; each is a separate record. A household or family group is one record only if the company’s policy treats it that way. Pick a definition and apply it consistently.
The study is descriptive. It can show stale or incomplete data and a process gap. It cannot prove that an emergency plan will work, and it should not be used to judge an individual’s preparedness.
Why freshness matters
Emergency contact data changes more often than most administrative records. People move, change phone numbers, change relationships, and change their preferences about who should be contacted. A record that was accurate at onboarding may be wrong two years later. In an emergency, the cost of a wrong number is measured in minutes.
OSHA’s emergency action plan requirements describe the need for emergency procedures and employee communication, including the designation of persons to assist in an evacuation. OSHA emergency action plans. That standard is not a template for executive contact data, but it illustrates why the record must be usable under pressure.
The record also contains sensitive personal information. It should be collected, stored, and shared with the same care as other private data. The FTC’s guidance on protecting personal information is a useful baseline. FTC: privacy and security.
Define the required fields
Build the field list before reviewing any record. A practical minimum includes:
- Key person: name, role, and employee identifier.
- Contact: name, relationship, primary phone, secondary phone, email, and preferred channel.
- Authorization: the key person’s confirmation that this contact may be reached, and the scope of information that may be shared.
- Verification date: the last date the key person confirmed the record.
- Review due date: the next scheduled verification, based on the company’s interval.
- Record owner: the person or team responsible for maintaining the record.
- Access scope: who can see the record and under what circumstances.
- Storage location: the primary system and the offline backup.
- Notes: any special instruction, such as “do not call during business hours” or “contact the spouse first.”
Do not collect medical details unless a specific, approved process requires them. A contact record does not need a diagnosis to be useful.
Measurement rules
Calculate freshness as the share of records verified within the stated interval. If the policy says annually, a record verified eleven months ago is current; a record verified thirteen months ago is overdue. Report the interval and the count, not just a percentage.
Calculate completeness as the share of required fields with a usable value. A phone number with a disconnected area code is present but not usable. A contact name without a relationship is incomplete for the purpose of deciding whom to call first.
Calculate reachability as the share of records that passed a controlled test. The test should be designed with the key person’s consent and should not create alarm. A simple “please confirm this number is still the best way to reach you” message is usually enough. Do not call a contact and announce an emergency as a test.
Cohort and exclusions
Select a fixed period and include every key-person record that was active at the start of the period. Exclude a record only for a documented reason: the person left the company, the record is subject to a legal hold that prevents review, or the record cannot be accessed under policy. Report the count.
If the executive office maintains records for board members or external advisers, stratify them separately. Their privacy expectations and review cadence may differ from employees’.
Data sources and provenance
Use the HR system, the executive office’s contact file, the identity provider, and the offline backup. Record the source for each field and the date it was last updated. If two systems disagree, state which one is authoritative and how the conflict will be resolved.
Do not export the full record to a general spreadsheet. Use a restricted workspace and a record identifier. The audit file should contain the status and the evidence reference, not the phone numbers or personal details.
Quality assessment
Test for duplicate records, contacts who are no longer authorized, phone numbers with the wrong country code, email addresses that bounce, and records that were verified by someone other than the key person. Sample three records and trace each field to the source. Classify discrepancies as missing, stale, conflicting, unreachable, or unauthorized.
Check the offline backup. An emergency contact list that exists only in a cloud system may be unavailable when the network is down. Confirm that the backup is current, stored securely, and accessible to the people who need it.
Privacy and access
Emergency contact data should be available to a small number of authorized people and unavailable to everyone else. Define the access scope by role, not by seniority. A CEO’s assistant may need the record; a broader executive team may not.
Use minimum-necessary disclosure when contacting a family member. Share only the information needed to respond, and follow the key person’s stated preferences. If the situation is a medical emergency, the responding professionals control the disclosure.
The NIST Privacy Framework provides a useful structure for data minimization, access control, and retention. NIST Privacy Framework. FEMA’s continuity guidance provides context for why the data must survive a disruption. FEMA continuity.
Analysis plan
Report the record count, the exclusions, the freshness rate, the completeness rate, and the reachability rate. Show the distribution by record owner and by key-person group. Report the age of the oldest unverified record.
Use a run chart by quarter to show whether the process is improving. Annotate known changes: a new HR system, a policy change, a reorganization, or a new assistant. Those events provide context, not proof of cause.
Limitations
A verified record is not a guarantee that the contact will answer. A reachability test is a point-in-time check, not a continuous one. The study cannot observe whether the contact would consent to be reached in an actual emergency or whether the information shared would be appropriate.
The records may be incomplete because the key person declined to provide a contact. That is a legitimate choice, not necessarily a process failure. Report it as a policy exception, not a data-quality defect.
Decision record and follow-up
Summarize the freshness, completeness, reachability, access findings, and quality exceptions. Record which changes the owner accepted: a shorter review interval, a self-service verification link, an offline backup, an access review, or a new field.
Every accepted action needs an owner and a date. Re-audit with the same definitions. If the definitions change, preserve both versions and disclose the break.
The value of the audit is not a perfect list. It is confidence that the people who need to reach a key person’s contact can do so, with the right authorization and the right privacy controls, when the normal systems are under strain. For the operating workflow, see key-person emergency contact review and the executive phone tree activation drill. Administrative operations support can maintain the review cadence through administrative operations.