If you work in public safety leadership, you’ve probably wrestled with this question: Exactly when should we transition from a single Incident Commander to Unified Command during an active shooter or hostile event? Chiefs and commanders ask it in every ASIM class we teach. They want a clear trigger: “At X minutes, do Y.” The reality is more nuanced.
There is no magic time stamp for Unified Command. You don’t flip the switch at minute 10 or minute 20 just because a checklist says so. The transition depends on your jurisdiction (metro, urban, suburban, rural), how you staff executive leadership, and the day and time the incident occurs. A large metro agency with 24/7 executive coverage may have the right leaders on scene in under 10 minutes. A suburban jurisdiction at 2 a.m. on a Saturday might wait 45 minutes or more. The right answer is not “what time is it,” but “are the right people here and ready to add value.”
So who are the “right people”? When I say executive leadership, I’m talking about individuals who have the authority to make policy decisions and speak for their agency. Rank labels vary widely, so you can’t rely on insignia alone. Generally, that means Chiefs, Deputy Chiefs, Assistant Chiefs, and their equivalents. Once you bring non–public safety partners into the Command Post – school district leadership, hospital administration, city or county executives – formal ranks matter even less than their actual decision authority. These are the leaders who should form Unified Command.
Unified Command’s job is not to run tactics. The Unified Command team focuses on community impact and policy decisions, and provides strategic direction and clear objectives to the Operations Section Chief. The Ops Chief runs the fight. That’s why, in the ASIM model, when Unified Command stands up, the initial Incident Commander becomes the Operations Section Chief. The person who has been running the response keeps running it. Their situational awareness, their control of contact teams and rescue task forces, their understanding of the building and the threat – none of that gets reset. You gain strategic leadership without disrupting ongoing operations.
This also preserves a crucial principle that has been watered down over time: Unified Command should still speak with one voice. Orders flow to the field through Operations, not around it. In smaller, slower incidents, many agencies use a model where the law enforcement leader commands law enforcement, the fire leader commands fire, EMS commands EMS, and so on. That can work fine on routine calls. In large, fast-moving, high-consequence events, it breaks down. Multiple “mini-ICs” issuing discipline-specific direction from the command post slows everything, creating bottlenecks and confusion.
It may surprise many to know when we first developed the Active Shooter Incident Management Checklist, we advocated for immediate Unified Command by the first arriving supervisors. On paper it looked great. In exercises and real training events, we discovered it was slow – very slow – in the first 10–20 minutes. Every time we plugged an arriving supervisor into a command or general staff role, they needed 6–8 minutes just to build situational awareness before they could be effective. Multiply that a few times and you’ve significantly delayed the response. That’s a top-down ICS model that works well in the fire service, where the incident can be “read” from the sidewalk. In an active shooter, the people inside the building know what’s happening. Information and control have to move bottom-up if you want speed.
Putting it all together, here’s the pattern we strongly advocate: the second arriving law enforcement supervisor takes over incident command from those that had it before and runs it. Command stays with that supervisor until executive leadership from the involved disciplines arrives on scene, receives a detailed face-to-face briefing, and is ready to stand up Unified Command. At that point, Unified Command is formally established, and the initial IC transitions into the Operations Section Chief role. You don’t transition because the clock hit a number; you transition when the right leaders are present and prepared to provide strategic value without disrupting the tactical operation that is already underway.
At the end of the day, our goal is simple: find the fastest way to neutralize the threat and rescue the injured so responders can save every savable life. How and when you transition to Unified Command should always serve that goal. If you want to talk through how this applies in your jurisdiction, or pressure-test your current procedures, my team and I are happy to have that conversation.
