SIRV / Operational AI / Incident review
Post-incident review: turning findings into actions and lessons learned
An incident can be thoroughly reported, investigated and reviewed, yet change very little. The test is what the organisation decides, implements, verifies and remembers.
A post-incident review should do more than document a discussion. Recommendations may be recorded, actions added to a tracker and the incident closed, but months later it can still be difficult to establish what was decided, whether anything changed or whether the same weakness has appeared again.
A review completed is not necessarily a lesson learned.
Two practical resources accompany this article. They separate the review itself from the follow-up work needed to show what happened next.
Post-Incident Review Template
Word template for evidence, uncertainty, findings, decisions, actions, outcomes and retained learning.
Post-Incident Action & Lessons Tracker
Excel tracker for ownership, completion evidence, effectiveness checks and later learning.
What should a post-incident review establish?
The incident report records what happened, what was done, what evidence exists and what remains uncertain. An investigation, where required, examines causes and contributing circumstances. The post-incident review asks a different question: what should the organisation do with what it has learned?
The answer could be a procedure change, briefing, physical security measure or different contractor instruction. It could also be a justified decision to make no further change. An incident does not automatically prove that every control involved failed.
For example, if a contractor follows an authorised employee through a controlled door, the reader may have worked exactly as specified. Replacing it may not address the weakness. The more relevant controls may be staff expectations, contractor arrival instructions and challenge arrangements.
This is consistent with NPSA incident-management guidance on debriefing, improving responses and reconsidering security measures.
Record what is supported by sources and what remains uncertain.
Identify contributing circumstances, weaknesses and controls that worked.
Accountable people accept, reject or defer recommendations.
Assign owners and deadlines; retain objective completion evidence.
Where justified, assess whether the intended operational change happened.
Make approved lessons usable in later decisions at this or other sites.
Start with evidence, and retain uncertainty
A review should use the incident report or investigation record rather than reconstructing the event unnecessarily. It must also avoid promoting possibilities into established facts.
If CCTV shows a contractor following an employee through an entrance and the access-control system records only the employee's credential, those are supported observations. They do not, on their own, prove that the employee deliberately permitted the contractor to follow. Likewise, a contractor's claim that they believed entry was permitted is evidence of their account, not proof that the joining instructions were clear.
These distinctions matter where the consequences might include additional training, disciplinary decisions, procedures or security investment. A tidy account is not necessarily a defensible one.
Look at the whole operating arrangement
Consider a fictional tailgating incident. A contractor enters through a controlled staff door without presenting a credential. The employee's valid card releases the lock, the door closes normally and a security officer subsequently challenges the contractor inside the building.
The review should not simply label the access-control equipment defective. It should ask whether employees knew they were expected to challenge tailgating, whether contractors were instructed to report to reception, whether such events had occurred before and whether informal workarounds had become normal.
It should also record what worked. The security officer's challenge identified the person and limited the time they remained inside without following the intended reception process.
That combination of findings is more useful than the unsupported conclusion that a single technology failed.
A recommendation is not a decision
“Review contractor procedures” sounds reasonable but does not identify what will change. Suppose the instructions merely say that contractors should “report on arrival”. The review might recommend explicitly requiring reception check-in before entry into controlled areas.
An accountable manager then decides whether to accept that proposal. If accepted, the Facilities Manager can be assigned to revise and issue the joining instructions by an agreed date.
These are separate records: a finding, a recommendation, a decision and an action. A manager may decide that the existing control is suitable, that the proposed alternative creates different risks or that further information is required.
Human judgement sits between the evidence and the action.
A proposed change.
Whether it is accepted, rejected or deferred, and why.
Evidence the agreed work was done.
Whether the work changed operational performance.
Evidence of subsequent behaviour or outcome.
What remains uncertain and whether more follow-up is needed.
An approved, specific lesson connected to its evidence.
Whether the lesson is used when similar decisions arise.
Check completion separately from effectiveness
Every accepted action should have an owner, deadline and a defined completion record. For amended contractor instructions, that could be the approved document and evidence it was issued. A physical change might require installation and commissioning evidence. A briefing could require the materials issued and attendance recorded.
For significant findings, an effectiveness check adds another question: did the action produce the intended improvement? Briefing attendance does not demonstrate that future behaviour will change. An assurance review, exercise or later incident may provide useful evidence, although never absolute proof.
HSE's HSG245 investigation guidance distinguishes implementing actions from the earlier investigation work. It is health and safety guidance, rather than a mandated security-review framework, but the action discipline is relevant.
A lesson identified is not necessarily a lesson learned
Recording “staff should remain vigilant” is not useful retained learning. A more actionable lesson from the example is that controlled entrances relying partly on users preventing tailgating need to be considered alongside contractor joining instructions, staff expectations and arrangements for challenging unfamiliar people.
Six months later another site may be designing a new contractor entrance. The lesson has value if the new decision-maker can find it with its supporting evidence, not merely if an old report exists in a folder.
The UK Resilience Academy's Lessons Management Best Practice Guidance distinguishes lessons identified, implemented and embedded. The guidance is non-statutory and non-mandatory, but provides a useful approach to the management of organisational learning.
Match the review to the consequence
A minor, straightforward incident may justify a short review and one documented action. More substantial work may be needed where weaknesses are serious, repeated or uncertain; several suppliers or departments are involved; or a procedure was followed but did not adequately control the risk.
Excessive administration for minor events is counterproductive. So is closing a significant finding with a vague recommendation. The level of review should reflect the decision at stake and the consequence of getting it wrong.
What to record, without creating another lengthy report
The accompanying template separates evidence and findings from recommendations and decisions. It prompts the reviewer to identify the incident, the material sources, important uncertainties, what worked, weaknesses requiring attention, potential relevance at other sites and the decision made by the accountable person.
The separate action tracker then records the owner, deadline, completion evidence and, where proportionate, the effectiveness check and later observation. The final question is what should be retained for future procedures, risk reviews, security design and operational decisions.
Where operational AI can help
Many organisations already possess procedures, previous incident reports and lessons in SharePoint or other libraries. The challenge is knowing that relevant material exists, finding it and judging whether it applies to a new situation.
With controlled access to approved sources, AI can help a reviewer locate earlier incidents with similar features, relevant decisions and unresolved actions, with source references for human examination. It can also bring approved learning into a later procedure review or site-design decision.
AI does not independently determine whether a control was adequate, a recommendation should be approved, a risk tolerated or an action effective. Those judgements remain with accountable people. Operational memory becomes valuable when evidence-backed learning can be retrieved at the point it is needed.
The test is what happens afterwards
Six months after the incident, could someone establish what the organisation learned, what it decided to do, whether the action occurred and whether the result made a difference?
That is a stronger standard than marking the review complete.
Move from recorded incidents to accountable follow-up
SIRV AI supports controlled access to operational evidence, previous decisions and approved learning. Human review, ownership and verification remain part of the workflow.
Discuss a workflow
