Lessons learned

A review that produces no owned, funded, completed change was a debrief, not a lessons-learned exercise.

The pattern is familiar: a well-attended meeting, a document, a list of recommendations, and eighteen months later the same incident. The only output that counts is a change somebody is accountable for and has the budget to finish. It is worth being honest that most of these reviews produce a document and a feeling of closure, which is why the same root cause reappears so often.

Checked against the primary source.

More on Incident response