HOA Management Company Emergency Response and Business Continuity Questionnaire

Choosing an HOA management company is partly a continuity decision. The board is choosing who may receive the first call about a flood, fire alarm, gate failure, elevator outage, storm, cyber incident, payroll problem, or displaced resident. It is also choosing who will keep ordinary association work moving when the assigned manager, office, software, bank, or vendor is unavailable.

No management company can prevent every emergency or guarantee an outcome. A strong candidate can show how it prepares, defines authority, escalates life-safety issues, protects association information, maintains critical work, communicates, recovers, and learns. A weak candidate may offer only a 24-hour phone number and broad promises.

This questionnaire helps an HOA or condominium board ask every finalist the same questions and evaluate evidence instead of presentation style. It follows the all-hazards logic in federal business-continuity and emergency-planning guidance: identify essential functions, business impacts, response roles, communications, information technology, recovery priorities, and tests before disruption.

This is general board education, not legal, emergency-management, fire, medical, engineering, cybersecurity, insurance, accounting, employment, accessibility, construction, or property-specific advice. Emergency authority and duties depend on the governing documents, management agreement, applicable law, building systems, local agencies, insurance, and the facts. Use association counsel, insurers, emergency officials, engineers, accountants, and other qualified professionals as appropriate.

1. Ask for the continuity framework, not just the emergency number

Start with the candidate's overall system.

1. Do you maintain a written emergency response and business continuity plan?
2. Which events does it cover: severe weather, wildfire, flood, water loss, fire, utility outage, cyber incident, unavailable office, unavailable software, staff loss, banking interruption, vendor failure, civil emergency, and pandemic or public-health disruption?
3. Who owns the plan, who approves it, and how often is it reviewed?
4. Which association services are classified as essential, and how quickly does the company target restoration for each?
5. How do you adapt the company plan to the property-specific systems, contacts, governing documents, and risks of each client?
6. What is the board expected to approve before an event?
7. What response work is outside your scope?

Ask for a redacted plan outline, role chart, testing calendar, and sample property emergency profile. A candidate need not expose security-sensitive details, but it should be able to demonstrate that a real system exists.

2. Define the boundary between management and emergency authorities

A manager should not impersonate a first responder, engineer, electrician, fire technician, insurer, or lawyer. Ask:

• When does staff call 911, a utility, fire department, police, public works, or another public authority?
• What instructions are employees prohibited from giving?
• How does the company preserve access for responders without placing staff in danger?
• Who may shut off water, power, gas, fire-protection, elevator, gate, mechanical, or other building systems?
• How are qualified vendors and building-specific instructions identified?
• How does the company handle conflicting instructions from residents, directors, vendors, and public officials?
• How are safety decisions and handoffs documented?

Look for clear life-safety escalation and professional boundaries. “We handle everything” is not a credible answer.

3. Test the after-hours intake and triage process

An answering service is only one component. Ask the candidate to walk through a call from beginning to end.

1. Who answers after hours: company staff, a call center, an on-call manager, or a vendor?
2. What information does the responder see about the association?
3. How does the responder distinguish an emergency from an urgent maintenance request or routine owner issue?
4. What scripts or decision trees apply?
5. Who is on call if the assigned manager cannot respond?
6. What response targets apply to acknowledgement, vendor dispatch, board notification, and status updates?
7. How are calls, texts, recordings, decisions, and work orders retained?
8. How are language, hearing, mobility, or other accessibility needs handled?
9. Does the company measure abandoned calls, time to answer, escalations, and unresolved events?

During finalist review, place a controlled test call if the candidate permits it. Do not wait for a real emergency to discover that the number routes to a mailbox.

4. Require a property-specific emergency profile

Generic company plans do not locate the building's shutoff. Ask what the manager will collect during onboarding:

• public-safety and utility emergency contacts;
• building address, access points, maps, gates, keys, boxes, and credentials;
• water, gas, electrical, fire, elevator, mechanical, drainage, sewer, roof, pool, and security systems;
• shutoffs and the people qualified to operate them;
• residents or building functions that may require an accessibility plan, handled with appropriate privacy controls;
• emergency vendors and alternates;
• insurers, claims contacts, counsel, engineers, and reserve professionals;
• board emergency authority and spending thresholds;
• known hazards, open violations, active construction, warranties, and recurring failures;
• communication channels and approved message templates.

Ask who verifies the profile in the field, how often it is refreshed, where it is stored, and how authorized responders access it if the primary system is down.

5. Examine staffing continuity

The assigned manager may be sick, displaced, without power, or dealing with multiple affected communities. Ask:

1. Who is the named backup manager?
2. How quickly can the backup access the client file, contacts, vendors, contracts, systems, and board history?
3. How many communities may one on-call person cover during a regional event?
4. How are priorities assigned when several properties need help?
5. Can accounting, customer service, maintenance coordination, and executive supervision operate remotely or from an alternate location?
6. What happens if senior leadership is unavailable?
7. How does the company protect employees while still maintaining essential service?
8. Which functions depend on one person with unique knowledge or credentials?

Request the succession map and an example of a cross-training or backup test. A name on an organization chart is weaker evidence than a backup who has actually accessed a sample client file and completed a tabletop exercise.

6. Compare communication discipline

Emergency communication should be fast, factual, accessible, and sustainable. Ask:

• Who may send an emergency owner message?
• Which channel is primary, and what is the backup when internet, cellular service, power, or the resident portal is unavailable?
• How are contact lists maintained and exported?
• How does the company distinguish official public instructions, manager updates, board decisions, and unverified reports?
• Does every update include a time stamp, known facts, immediate action, source, and next-update time?
• How are board members briefed without creating conflicting public messages?
• How are renters, off-site owners, commercial occupants, vendors, and on-site staff reached?
• How are translations and accessible formats handled?
• Who monitors replies and misinformation?
• Where are sent notices and approvals retained?

Ask for redacted samples covering an outage, water loss, evacuation order, delayed repair, and return to normal operations.

7. Review vendor readiness and dispatch controls

A long vendor list is not the same as capacity. Ask:

1. Which emergency trades have a current agreement, and which are only contact names?
2. Is there an alternate for plumbing, water mitigation, electrical, fire protection, elevator, roofing, security, tree work, snow or ice, towing, gate access, and other property-specific needs?
3. How are license, insurance, contract, pricing, and geographic coverage checked?
4. What after-hours and disaster-surge terms apply?
5. Who may authorize dispatch and emergency spending?
6. How are fraud, vendor impersonation, and changed payment instructions controlled during a crisis?
7. How does the manager prevent duplicate dispatch by residents, directors, and staff?
8. How are arrival, work performed, photographs, temporary measures, recommendations, and invoices documented?

Require a property-specific vendor matrix and escalation sequence during onboarding. Regional disasters can exhaust vendor capacity, so ask how the company prioritizes work and communicates realistic wait times.

8. Evaluate financial continuity

An emergency can interrupt both money movement and financial controls. Ask how the company maintains:

• access to operating and reserve balances;
• payroll and critical recurring payments;
• vendor authorization and invoice evidence;
• dual approval or independent review;
• fraud verification for new or changed payment instructions;
• emergency spending authority;
• owner-payment processing and posting;
• bank reconciliation and cash-position reporting;
• insurance deductible and claim-cost tracking;
• special-assessment or borrowing records if later approved;
• audit trails during manual or alternate-system work.

Ask what happens if the primary bank, payment portal, accounting platform, office network, or authorized signer is unavailable. The fallback should not be “send the money from someone's personal account.”

9. Inspect information technology recovery

Cybersecurity and continuity overlap, but they are not identical. A secure system that cannot be restored is not resilient. Ask:

1. Which systems are required for resident contacts, work orders, accounting, payments, records, websites, email, phones, and access control?
2. Which party owns each account and administrator credential?
3. What are the target recovery time and acceptable data-loss window for each essential system?
4. Are backups isolated from the primary system and tested for restoration?
5. How does the company operate when the primary platform is unavailable?
6. Can the association export its owner list, financial records, contracts, incident records, and governing documents in usable formats?
7. How are multifactor authentication, recovery accounts, privileged access, and former-user removal handled?
8. How are cyber incidents escalated to the board, insurer, counsel, vendors, law enforcement, and affected people as directed?

Request recent redacted restoration-test evidence and an example of an alternate-process worksheet. A statement that a vendor “has backups” is not the same as a tested recovery process.

10. Require incident records and evidence preservation

The board may need to understand the event months later. Ask whether the company's incident file captures:

• discovery time and reporter;
• exact location and affected systems;
• observable facts, photographs, video, readings, and alarms;
• public-agency contacts and case numbers;
• decisions, authority, dispatch, arrival, and restoration times;
• residents and common areas affected;
• safety and access measures;
• vendor reports and removed components;
• contracts, estimates, invoices, purchase orders, and approvals;
• insurance, legal, engineering, and board communications;
• temporary measures, unresolved items, and closeout evidence.

Ask how records are protected from alteration, excessive access, and deletion. The manager should preserve evidence without delaying emergency mitigation or giving legal conclusions.

11. Review insurance and claim coordination

Management may coordinate information, but the carrier and qualified professionals determine coverage and claim handling. Ask:

1. Who maintains current policies, contacts, deductibles, notice instructions, and claim numbers?
2. What events trigger immediate notice to the broker or carrier?
3. How are owner and association insurance roles communicated without promising coverage?
4. Who gathers photographs, inventories, invoices, contracts, maintenance history, and mitigation records?
5. How are adjuster inspections and vendor access coordinated?
6. How are deductibles, uninsured work, depreciation, temporary repairs, and board decisions tracked?
7. How are potential subrogation evidence and responsible-party communications preserved?

Request a redacted claim checklist. Confirm that the management agreement identifies what the company does and what requires separate professional work.

12. Ask about accessibility, fair housing, and vulnerable operations

Emergencies do not affect every resident or building function equally. Ask how the company plans for elevators, mobility routes, communication disabilities, limited English proficiency, refrigerated medication dependencies, service animals, caregivers, children, older residents, and other needs without creating an unnecessary database of sensitive information.

The candidate should explain how requests are routed, privacy is protected, reasonable communication is maintained, and qualified legal advice is obtained. It should not promise individualized rescue or publish medical information. The board should understand what the manager can coordinate and what remains the responsibility of residents, public authorities, or specialized providers.

13. Test restoration and return to normal operations

Response is not complete when the immediate water stops or power returns. Ask how the company verifies:

• temporary and permanent repair status;
• safe restoration of interconnected systems;
• permits, inspections, testing, and closeout;
• resident access and common-area reopening;
• unresolved moisture, smoke, environmental, security, or structural issues;
• vendor and insurance documentation;
• invoice coding, approvals, and budget impact;
• warranties and as-built records;
• temporary procedure retirement;
• board and owner closeout communication.

The plan should distinguish stabilization from permanent reconstruction and identify who can authorize each phase.

14. Require exercises, metrics, and after-action review

Plans improve through testing. Ask for the company's annual exercise calendar and whether clients participate. Useful scenarios include a water loss, wildfire or storm, elevator outage, unavailable manager, payment fraud attempt, portal outage, office closure, and simultaneous incidents at several communities.

Ask the candidate to measure more than whether the phone was answered. Helpful metrics include time to acknowledge, dispatch, board notice, resident update, vendor arrival, stabilization, system recovery, and closeout; abandoned calls; stale contacts; failed backups; missing records; repeated incidents; budget impact; and open corrective actions.

Every material incident or exercise should produce a short after-action review: what happened, what worked, what failed, why, who owns each improvement, due date, verification, and plan update. Ask for a redacted example.

15. Put material commitments in the management agreement

Proposal language is not an operating commitment until the contract, exhibits, or adopted procedures define it. Ask counsel to address:

• included and additional emergency services;
• after-hours coverage and response targets;
• board and manager authority;
• emergency spending and contracting limits;
• vendor selection and related-party disclosure;
• communication responsibilities;
• record ownership, access, retention, and incident evidence;
• data security, backups, outage procedures, and breach cooperation;
• insurance and claim coordination;
• staffing backup and key-person continuity;
• extra fees, disaster surcharges, and pass-through costs;
• indemnity and limitation provisions;
• transition assistance and unresolved-event handoff;
• termination during a prolonged disruption.

Avoid an absolute guarantee that no event or service interruption will occur. Require defined preparation, actions, evidence, escalation, and reporting.

16. Score evidence, not confidence

Use the same scoring model for every finalist. One practical 100-point allocation is:

• Property-specific planning — 15 points. Systems, contacts, authority, access, hazards, and local agencies are mapped.
• After-hours response and staffing — 15 points. Intake, triage, backup managers, regional surge, and employee continuity are tested.
• Communications — 10 points. Redundant channels, approvals, accessibility, factual templates, and next-update discipline are documented.
• Vendors and physical operations — 15 points. Qualified primary and alternate vendors, dispatch controls, system boundaries, and closeout are credible.
• Financial continuity — 10 points. Banking, payroll, approvals, fraud checks, reconciliation, and alternate procedures remain controlled.
• Technology and records — 15 points. Recovery targets, tested backups, exports, credentials, alternate workflows, and incident evidence are demonstrated.
• Insurance and professional coordination — 10 points. Notice, evidence, claim support, and expert boundaries are clear.
• Exercises and improvement — 10 points. Tabletop tests, metrics, after-action reports, and corrective-action tracking are current.

For every score, record the candidate's answer, requested evidence, evidence received, exception, risk owner, and contract commitment. A polished narrative without evidence should not receive the same score as a tested process.

17. Red flags to investigate

• One manager or one phone is the entire emergency plan.
• The assigned manager has no named, trained backup.
• The company cannot explain how several client emergencies are prioritized.
• Staff claim they will personally perform technical or life-safety work outside their qualifications.
• Vendor contacts are old, uninsured, or unavailable after hours.
• Resident contact data cannot be exported or reached outside the primary portal.
• The company does not know who owns critical administrator accounts.
• Backups exist but restoration has not been tested.
• Emergency payments can bypass all approval and fraud controls without later review.
• Incident records are scattered across personal texts and inboxes.
• Accessibility and privacy questions receive no defined routing process.
• The proposal promises “24/7 service” but the contract defines no scope, escalation, or fees.
• The transition clause does not require delivery of open incidents, claims, credentials, vendors, and emergency records.

18. Final due-diligence request

Before selection, request a controlled evidence package:

1. Redacted continuity-plan outline and role chart.
2. Property emergency-profile template.
3. After-hours intake and escalation workflow.
4. Backup-manager and staffing-continuity method.
5. Emergency communication samples.
6. Critical-vendor matrix and qualification process.
7. Financial alternate-process and fraud-control summary.
8. Technology recovery targets and recent restore-test evidence.
9. Incident-report and after-action templates.
10. Insurance-claim coordination checklist.
11. Exercise calendar and a redacted corrective-action log.
12. Proposed contract language for emergency scope, fees, records, and transition.

Then run a finalist tabletop using the same property-specific scenario. Give each candidate a burst pipe after hours, an unavailable manager, a resident-access problem, a payment request, and a portal outage. Ask who does what in the first 15 minutes, first hour, first day, and recovery period. The board will learn more from the handoffs and questions than from a promise that the company has “seen it all.”

Sources

• Ready.gov: Emergency Plans for Business
• Ready.gov: Business Continuity Plan
• FEMA: Emergency Management Guide for Business and Industry
• ManageMatch: HOA Management Company Cybersecurity Questionnaire
• ManageMatch: HOA Management Contract Clauses Checklist

Federal resources provide general continuity and preparedness frameworks. They do not create a property-specific emergency plan or replace local authorities, governing documents, contracts, insurance requirements, or qualified professional advice.