Lessons Learned

Organisations rarely fail because an incident happened; they fail because the same weakness surfaces twice. Lessons learned exist to close that gap: structured findings after every exercise or real disruption, converted into actions with an owner and a deadline. For leadership, the dependent decision is where the next improvement budget goes — toward the gaps the last event actually exposed, not toward guesses. It is the difference between ten years of experience and one year repeated ten times.

In practice a debrief is held within 1-2 weeks of the event or exercise, while memories are fresh, chaired by someone who was not running the response. Findings are recorded in a standing register — what was expected, what happened, what changes — and each item becomes an action with a named owner and a date, tracked to closure at the continuity or risk committee. After a supplier failure, typical actions include qualifying a second source within 90 days and adding a supplier concentration threshold to the escalation table. The crisis and continuity plans are then reissued, so the learning lands in the documents people will actually use.

The classic mistake is the report that assigns no owners: everyone agrees on the findings, nothing changes, and the next event replays the last one. A quieter one is recording only technical lessons while the decision-making failures go undocumented. In the ERGP programme, this improvement loop closes module M4, Crisis management and decision making.