26 June 2026

Dear colleagues,

Over the past 12 months, the NHS has responded to a significant number of incidents and sustained operational pressure, against a backdrop of organisational change and uncertainty.

The resilience of our organisations, and our ability to respond safely and effectively as well as to rapidly recover, is a direct result of investment in all EPRR activities. It is also the result of your ongoing leadership.

In this context and notwithstanding NHS reforms, we are writing to confirm that the EPRR assurance approach for 2026/27 remains consistent with previous years.

Under the NHS Act 2006, NHS England has a statutory duty to ensure that the NHS in England is properly prepared for emergencies.

This includes monitoring the compliance of each integrated care board (ICB) and provider of NHS-funded services with EPRR requirements through the annual assurance process.

The 2026/27 assurance cycle has begun, and this letter summarises the key actions for NHS organisations.

The assurance process is based on organisational self-assessment of compliance against the NHS Core Standards for EPRR.

Organisations should use the outcome of this process to identify areas of good practice and aspects of their arrangements that require further development.

Self-assessment findings should inform annual workplans and local improvement priorities.

As commissioner of local services, ICBs will again lead this process across the local health resilience partnership, to ensure providers of NHS-funded services remain accountable for their EPRR arrangements under the terms of the NHS Standard Contract.

NHS Core Standards for EPRR

The NHS Core Standards for EPRR are set out in the self-assessment tool.

ICBs and providers of NHS-funded services should complete a self-assessment against the standards relevant to their organisation type and record a compliance rating for each.

The compliance level for each standard is defined as:

Organisational assurance rating

The number of applicable core standards varies by organisation type.

The overall EPRR assurance rating is based on the percentage of relevant standards that an organisation assesses itself as being fully compliant with, as set out below.

Deep dive

In line with last year, no deep dive will be undertaken as part of the EPRR assurance process.

Action to take/next steps

Stage 1: Self-assessment

• All NHS organisations must complete a self-assessment against the current NHS Core Standards for EPRR (attached) relevant to their organisation.

Stage 2: Local assurance

• ICBs must work with their commissioned providers of NHS-funded services to establish a process for gaining confidence in provider organisational compliance ratings.
• The outcome of the self-assessment and ICB review must be formally presented at the organisation’s public board for executive approval and sign-off. Where an organisation does not have a public board, it must still obtain executive approval and sign-off, and publish results in a public area, such as their annual report or the organisation’s website.
• ICBs must also work with their local health resilience partnership partners to develop a process to support the sharing of learning and good practice.
• Provider organisations must submit an assurance outcome report to their ICB, including their self-assessment against core standards, an action plan for addressing areas of partial or non-compliance, and their overall organisational compliance rating.

Stage 3: Regional assurance

• NHS England regional deputy directors of EPRR and their teams must work with ICBs to establish a process for gaining confidence in ICB organisational compliance ratings.
• The outcome must formally be presented at each ICB’s public board for executive approval and sign-off.
• NHS England regional deputy directors of EPRR and their teams must also create opportunities for ICBs to come together formally to discuss the outcomes of their assurance processes, promoting the sharing of learning and good practice examples across the region.
• ICBs must provide NHS England regional EPRR teams with an assurance outcome report that includes their self-assessment against core standards, action plans for addressing areas of partial or non-compliance, common risks, good practice examples, and organisational compliance information for all organisations within their geography.

Stage 4: National assurance

• NHS England regional deputy directors of EPRR must submit assurance ratings for each organisation in their region, together with a description of the regional assurance process, to me by Wednesday 23 December 2026.

Any queries should be directed in the first instance to your ICB EPRR lead or the relevant NHS England regional EPRR team.

We will write to you separately with further detail on the outcome of the tri-annual review of Core Standards, including expectations for adoption next year.

Finally, to strengthen NHS resilience and reduce the administrative burden on organisations, work has begun on the development of a digital EPRR tool.

It has long been our intention to introduce a system to support EPRR teams with annual work planning, including the scheduling of plan reviews, training and exercises.

As this work develops, elements of the annual assurance process will also be automated, reducing the time and resource to complete and enabling teams to focus on other priorities.

Thank you for your continued contribution to maintaining effective EPRR arrangements across the NHS and to supporting safe and resilient services for patients and the public.

Yours sincerely,

Dr Mike Prentice
National Director for NHS Resilience
NHS England

Publication reference: PRN02556