If you work within an NHS or NHS-funded organisation, you may have heard people refer to the NHS Core Standards for Emergency Preparedness, Resilience and Response, or more commonly known as the “EPRR Core Standards”.
But what are they? Who do they apply to? And what does it mean for an organisation to be compliant?
At their simplest, the Core Standards provide a common framework for assessing whether NHS or NHS-funded organisations have appropriate arrangements in place to prepare for, respond to and recover from incidents and emergencies.
While they can sometimes feel a bit like an exercise in completing a spreadsheet, they provide a useful way to check and challenge whether the arrangements an organisation relies upon are actually robust, current and understood.
What does EPRR mean?
EPRR stands for Emergency Preparedness, Resilience and Response.
Within the NHS, EPRR covers the arrangements organisations put in place to prepare for and manage emergencies, major incidents, critical incidents and business continuity events while continuing to provide safe services to patients.
NHS England's EPRR Framework applies to NHS-funded organisations in England, including NHS trusts, foundation trusts, integrated care boards and providers of NHS-funded primary care.
The framework sits within a wider legal and regulatory landscape that includes legislation such as the Civil Contingencies Act 2004, the NHS Act 2006 and the Health and Care Act 2022, alongside requirements within the NHS Standard Contract.
So, what are the NHS Core Standards?
The NHS Core Standards for EPRR are the minimum requirements that commissioners and providers of NHS-funded services are expected to meet in relation to emergency preparedness, resilience and response.
Their purpose is to provide a consistent framework for organisations across the NHS.
According to NHS England, they are intended to:
support a common approach to EPRR across health organisations;
allow EPRR arrangements to reflect the organisation's size and scope;
provide a consistent framework for preparedness activity; and
help inform an organisation's annual EPRR work programme.
In other words, they create a common baseline.
The exact arrangements needed in a large acute hospital will obviously look very different from those required by a much smaller community provider, but both organisations still need to demonstrate that they have considered the risks relevant to their services and have appropriate and proportionate arrangements in place.
What do the Core Standards cover?
The standards are grouped into 10 domains covering the main components of effective emergency preparedness, including:
governance
duty to risk assess
duty to maintain plans
command and control
training and exercising
response
warning and informing
co-operation
business continuity
chemical biological radiological nuclear (CBRN) and hazardous material (HAZMAT).
A final domain is only applicable to NHS ambulance trusts and covers the ‘interoperable capabilities’ they must have in place.
The individual standards within these domains go beyond asking whether an organisation has a plan.
They look at things such as whether there is clear ownership of EPRR, whether relevant risks have been assessed, whether plans are regularly reviewed, whether staff are trained for their roles and whether arrangements have actually been tested.
And that distinction matters.
Having a document called “Business Continuity Plan” saved somewhere on a shared drive is not the same as having effective business continuity arrangements.
Who needs to complete the Core Standards?
The EPRR assurance process applies to commissioners and providers of NHS-funded services.
For 2026/27, NHS England once again asked Integrated Care Boards and providers of NHS-funded services to complete a self-assessment against the Core Standards relevant to their organisation type.
The number and type of applicable standards vary depending on the organisation and the services it provides. That is why understanding the relevance of each domain to your organisation, rather than simply working mechanically through the entire framework, is important.
What is the annual EPRR assurance process?
The Core Standards form the basis of the NHS annual EPRR assurance process.
NHS England has a statutory responsibility to assure itself that the NHS in England is properly prepared to respond to emergencies, and the annual assurance process contributes to that assessment.
Organisations complete a self-assessment against the standards applicable to them and assign a compliance rating to each.
For 2026/27 the individual ratings are:
Fully compliant: the organisation fully meets the standard.
Partially compliant: the organisation does not yet fully meet the standard, but its EPRR work programme demonstrates progress and there is an action plan to achieve full compliance within the next 12 months.
Non-compliant: the organisation does not meet the standard and full compliance is not expected within the next 12 months.
Those individual assessments then contribute to an overall organisational assurance rating as follows:
Full compliance: 100% of standards met
Substantial: 89-99%
Partial: 77-88%
Non-compliant: Up to 76%
But the percentage only tells part of the story.
A good assurance process should also help an organisation understand where its vulnerabilities are and what needs to happen next.
What happens if an organisation isn't fully compliant?
A partially compliant rating does not necessarily mean an organisation has poor EPRR arrangements overall.
In fact, the assurance process is designed in part to identify areas that require further development.
Where gaps are identified, organisations should have clear actions showing how those gaps will be addressed. NHS-funded organisations are expected to submit an assurance outcome report to their ICB which includes their Core Standards self-assessment, an action plan for areas of partial or non-compliance and their overall organisational rating.
This is where the assurance process becomes most useful.
A partially compliant rating accompanied by a clear understanding of the issue, appropriate governance and a realistic improvement plan is very different from an organisation discovering the same gap every year.
Compliance isn't the same as preparedness
This is probably the most important point.
The Core Standards provide an excellent framework, but meeting the standards should not become the end goal in itself.
An organisation can have plans, policies, governance structures and training records and still discover during a real incident that:
staff don't know where the plan is;
the contact details are out of date;
escalation routes aren't understood;
a key supplier has never been considered;
the person named in the plan left six months ago;
remote working arrangements don't work during an IT outage; or
nobody has practised making decisions under pressure.
That is why good EPRR assurance needs to look beyond whether evidence exists and consider whether the arrangements are usable in practice.
A useful question is not just:
“Can we evidence compliance with this standard?”
but:
“If we needed this arrangement at 3am, would it actually work?”
That is a much tougher question to answer honestly, but usually a much more valuable one.
How should organisations use the Core Standards?
Rather than treating them as an exercise that appears once a year and disappears again afterwards, organisations can use the Core Standards as a framework for their wider EPRR programme.
For example, identified gaps can inform:
annual EPRR workplans;
plan reviews;
training priorities;
exercise programmes;
risk management;
business continuity improvement;
governance reporting; and
discussions with partner organisations.
NHS England explicitly expects organisations to use the findings from their self-assessment to identify good practice and areas requiring further development, with those findings informing annual work programmes and local improvement priorities.
That is where the standards become genuinely useful rather than simply another assurance return.
In summary
The NHS Core Standards for EPRR provide the NHS with a common framework for assessing emergency preparedness and organisational resilience.
For organisations, though, their value should go beyond achieving an annual compliance rating.
Used properly, they can help answer a much more important question:
Are our arrangements genuinely capable of supporting our operational resilience when something goes wrong?
That is ultimately what good emergency preparedness is about.
How Horizon Planning & Resilience can help
Horizon Planning & Resilience supports organisations to review, develop and test practical resilience arrangements.
Whether that means identifying areas of good practice, understanding current gaps, strengthening plans or putting arrangements through a realistic exercise, the focus is always on making sure plans work in the environment they were designed for, not just in principle.
Not sure how your current arrangements measure up against the Core Standards? Get in touch for a practical, independent review of your organisation’s resilience arrangements.
Practical planning. Real-world resilience.
