1.7 · Risk, rules, and safety

BeginnerDuration ~11 min readTools Your master timeline sheet, One page

The big idea: you cannot plan for everything, so plan for the things that only exist once. Find what your event has exactly one of, write one plan B beside each, and put a named person behind the promise that this room is safe.

The analogy

Film sets have a risk system and it is almost insultingly simple. Before anything dangerous happens, the crew stops and holds a safety meeting. It takes minutes. Somebody says out loud what is about to happen, where the hazards are, and what everyone does if it goes wrong. Nobody enjoys it. Nobody skips it either.

Then two rules run underneath the whole shoot. The first is that anyone can call cut. The runner on her first day has the same authority to stop the set as the director, because the person who sees the danger is rarely the person in charge of it. The second rule is that one person owns safety. Seeing the problem is everybody’s job. Fixing it is somebody’s job, with a name.

And every department quietly doubles up on whatever the day cannot survive losing. Two camera batteries. A second copy of the footage before anyone goes home. Not because they expect failure, but because they have counted what exists only once.

That is the whole lesson. A safety meeting, a rule that anyone can stop things, one named owner, and a spare for whatever the day cannot lose.

Watch

Thumbnail for 7 Risk Management Strategies for Event Planners — **Watch for:** Start with Linda's venue walkthrough questions, because she is basically reading you a checklist out loud: crowd flow and choke points, blocked doors, secure storage for gear, whether there is cell coverage everywhere, first aid kit, first aid room, an AED, anyone on staff trained to use it. Write those down as she says them. Then stay for her story about an outdoor festival that landed four weeks after 9/11, and listen for two things. One, how the team decided to proceed only if adequate safety measures were achievable, which is a go/no-go call dressed as a safety call. Two, the radio codes they invented so volunteers could report trouble without the whole crew hearing it and panicking. Near the end, notice the split the panel lands on: spotting risk is everyone's job, fixing a given risk belongs to one named person.

How it works

The trap with risk is that the question “what could go wrong” has no floor. You can worry forever and produce nothing. So swap the question. Ask what your event has exactly one of.

That is a single point of failure: anything the event owns one copy of, where losing it stops the show rather than bruising it. Walk the August event and they surface fast. One venue. One live podcast audio chain, probably borrowed. One person who actually knows how the projector talks to the laptop. One headline guest whose name is on the poster. One sponsor whose payment your budget is quietly leaning on. One route in, if the road floods. Notice how many of those are a person rather than a thing. At community scale, most of your fragility has a name and a face, and that is the uncomfortable part, because a spare human is harder to arrange than a spare cable.

You do not fix all of them. You rank by what would hurt most and take the top five. Each one gets a single line: what breaks, what you do instead, who decides, and by when. That last part carries more weight than it looks. “We’ll figure it out on the day” is not a plan B, it is a hope with a timestamp. A real plan B says the guest confirms in writing by Wednesday or the MC opens the program instead.

Then there is the walkthrough. You already learned the site visit in the last lesson, so this is the same trip with a second pass of questions. Where does the crowd bunch up. Which doors are blocked by the booth layout. Where do you lock the gear that is not yours. Is there phone signal in the back corner where your registration desk lives, and if not, how does that volunteer reach you. Is there a first aid kit, and does anyone here know what to do with it. You are not being paranoid, you are converting somebody else’s building into a place you understand.

Now the part that matters most for this community specifically. A code of conduct is not a legal formality, it is the operating manual for the promise Filmmakers Connect makes. The whole reason this community exists is that the old rooms were bars and nightlife venues where plenty of filmmakers did not feel safe, and where gatekeeping went unchallenged. Safety is not a policy sitting next to the product. It is the product. DevOpsDays, the volunteer-run conference this course keeps borrowing from, treats a code of conduct as mandatory before an event can even publish, and their required contents are the useful bit: multiple ways to report something, volunteers trained in advance on what to do when a report lands, swift action when it does, and a review afterward. Read that list again and notice that only the first item is writing. The rest is people. A code of conduct with no named receiver and no briefed volunteers is a poster.

Two more pieces of paper. Force majeure is the clause in venue paperwork covering what happens when something outside anyone’s control kills the date, and post-pandemic the specific words to look for are whether pandemic or epidemic are named, not just fire and flood. Your venue may not issue formal contracts at all. Community venues here often work off a chat quote and a downpayment receipt. Fine. You still ask the question, in writing, before you pay: if a typhoon or a suspension order takes this date, what happens to this money, and can we move it. Their answer in a chat thread is worth more than the clause you never asked for.

And permits. The Philippine layer is where this course stops teaching and starts pointing. Fire safety and occupancy in the Philippines run under RA 9514, with a fire safety inspection certificate from the BFP and permits at the LGU level, and the course research did not verify how those apply to a gathering of your size at a venue that already operates. So treat this as a question, not a fact. Ask the venue who holds the occupancy permit and the fire safety inspection certificate and whether your kind of event is covered by theirs. Ask the LGU or barangay what else they want to see. Do it when the date is confirmed, not the week before. Being early is free and being late is not.

The receipts (evidence, if you want it)

A code of conduct is mandatory for every DevOpsDays event and cannot be skipped: their guide states adherence and enforcement are non-negotiable, and that no event may be published without one. Required contents: establish reporting mechanisms with multiple avenues, train staff and volunteers to handle violations, take swift action including removal or involving law enforcement in severe cases, and run a post-event review of any violations (devopsdays.org/organizing).
Venue insurance requirements are a normal ask: DevOpsDays advises checking what your venue requires and looking into event insurance available in your area (devopsdays.org/organizing).
Force majeure clauses in venue contracts limit liability when uncontrollable circumstances kill an event (Bizzabo event planning glossary). In the Whova panel above, Linda’s post-COVID advice is to check whether the clause explicitly names pandemic or epidemic (around 33:37, outside the clip).
The walkthrough safety questions in this lesson are transcribed from Linda’s answer in the segment above: crowd flow with no choke points or blocked doors, secure storage for supplies and equipment, venue policy questions, how you communicate with venue staff during the event, cell coverage throughout the venue, first aid kit, first aid room, first aid staff, an AED, and whether anyone on site is trained in CPR or to use it (Whova, 7 Risk Management Strategies for Event Planners).
The single-point-of-failure story: an outdoor arts and crafts festival scheduled four weeks after 9/11, with roughly 400 vendors, 30 food booths, and 200,000 expected visitors. The team decided to proceed only if adequate safety measures were achievable, partnered with police, fire, EMT, airport and local government for expertise and manpower, trained volunteers, put radios in their hands, and built code words so a report could not spread panic across the channel (same source, from 44:51).
Ownership split from the same panel: larger events staff risk management deliberately, smaller ones make identification everyone’s responsibility, and mitigation of a given risk belongs to a specific individual.
Contingency habit: a written plan B per single point of failure (venue, headline guest, AV) plus a contingency line in the budget, commonly quoted at 10 to 15 percent. That percentage is repeated widely by practitioners but the course research found no authoritative source stating the range, so it is taught as convention, not citation (industry map §2.6 and §8).
Philippine specifics are flagged, not taught. The fire-code thresholds available in the research (for example crowd managers required at 1,000 attendees) come from US state codes such as Virginia SFPC §403.3. Philippine equivalents under RA 9514, the BFP fire safety inspection certificate, and LGU permits were not researched in this pass and must be verified locally with your venue and the BFP (industry map §8, item 7).
Honest gaps this course does not fill. Contracts, insurance, and liability are properly taught in paid, jurisdiction-specific programs, notably ELI/PCMA Event & Meeting Management Fundamentals, week 5 on Risk Management and Contracts. Formal crowd science sits with UK crowd safety providers such as ESM Operations / crowdrisks.com. The free partial substitute is Alison’s Mastering Crowd Management course and Event Safety Alliance guidance.

Your one move

Open your master timeline sheet, add a tab called Risk, and list the five things the August event has exactly one of, ranked worst first. Beside each, one line: what you do instead, who makes the call, and the date they make it by. Twenty-five minutes, done when all five rows have a plan B with a name and a date in them.

Want to go further?

Draft the code of conduct next, and start from the end rather than the beginning. Before you write a word about expected behavior, decide who receives a report on the day, how someone reaches that person (a number, a face at a specific table, a chat handle), and what that person does in the first five minutes. Then write the behavior section around it. Post it on the Luma page, and read it out in the volunteer briefing so the team hears it from you before an attendee ever needs it.

Then send one message to the venue: who holds the fire safety inspection certificate and occupancy permit, does it cover an event of this size, and what happens to the downpayment if the date is lost to weather or a suspension order. Screenshot the reply into the Risk tab.

The needle: an event is won before doors open, and this is the page that decides what happens on the worst version of show day. On the day itself you will not be planning. You will be reading.

Terms introduced

Check

You can move on when you can… name the five things your event has only one of, say the plan B and the decider for each without opening the sheet, and point at the person who receives a code of conduct report on the day.

Go deeper

That is Level 1 complete. Everything you have built, the concept, the org chart, the runway, the budget, the prospectus, the venue scorecard, and this risk page, assembles into one document on the Practice and capstones page. The Level 1 gate is blueprinting one event end to end on paper, with every function owned by a named person.
Optional companion listen: Risk, safety and emergency management for events and festivals from The Event Tutor, a working safety officer with Burning Man and Glastonbury experience. It plays whole in under twenty minutes. It is pitched at festival scale, so read it as where you are headed rather than what to do at your size, but his closing tip transfers exactly: loop in local public safety the moment your date and venue are confirmed, not days before.
Free checkpoint if you want to go further on crowds: Alison’s Mastering Crowd Management course, free to study. It comes back in 3.4 · When things go wrong, where this risk page becomes something you actually run.
Next up: Level 2 opens with 2.1 · The promotion runway. The blueprint is finished. Now you fill the room.