Analysing the activity of work in emergency incident management