Evidence After an Incident

Evidence after an incident is the record of what actually happened when a service was disrupted, preserved quickly, reviewed honestly, and turned into owned changes to the service. It begins during the incident, with a timeline, decisions, communications, and recovery steps recorded as they happen, and it continues afterwards, with a review that compares what happened with what the plan expected and decides what must change. Without that record, the firm cannot show a supervisor, an auditor, or its board what happened, and it cannot learn reliably from its own experience.

The discipline is to preserve first and judge later. In the hours after an incident, memories are fresh but also unreliable, and the temptation is to agree a tidy narrative before the facts have been checked. A good incident record resists that temptation: it keeps the original timeline, notes where facts are uncertain, and separates what was known at the time from what was learned later. Judgement belongs in the review, where it can be challenged, not in the record, where it would quietly rewrite history.

Preservation should start while the incident is still running, not after it has ended. The timeline of detection, escalation, decisions, and recovery steps, the communications sent to users and to suppliers, and the data about which users were affected and how should all be captured as they occur, by the people involved, in whatever form is available. A rough log written during the event is more valuable than a polished account written later, because it shows the sequence as it unfolded, including confusion and delay.

A useful timeline records events in order, with times, actors, and sources, and it distinguishes between observed facts and inferences. It should show when the disruption was detected, when it was escalated, what decisions were taken and by whom, what recovery steps were attempted and in what order, and when the service was judged to be back within tolerance. Gaps and uncertainties should be marked as such, rather than filled with plausible guesses, because a timeline that admits its gaps is more credible than one that invents continuity.

Decisions deserve particular care, because they are what a later reviewer, auditor, or supervisor will scrutinise. For each significant decision, the record should show who decided, what information they had at the time, what alternatives were considered, and what the outcome was. That record protects the decision makers as well as the firm, because it shows reasoned judgement under pressure rather than hindsight. Decisions recorded only as outcomes, without their reasoning, invite later criticism that the firm cannot fairly answer.

An incident review is useful when it compares what happened with what the plan expected, and treats every difference as a question. Where the plan worked, the review should say why, so that the working arrangement is preserved and understood. Where the plan did not work, the review should identify whether the fault lay in the plan, the map, the tolerance, the supplier arrangement, or the training of the people involved, because each fault needs a different fix. A review that attributes everything to a single cause, or to bad luck, has stopped asking questions too early.

Learning becomes change only when review findings are turned into owned, dated actions that are evidenced in the service trail. Each action should name its owner, its date, and the record that will show it is complete, and the action list should be tracked until closure, with overdue items escalated. Actions should also be checked across services: if a supplier step failed for one service, other services using the same supplier or the same recovery pattern should be checked before they face the same disruption.

Sharing should be proportionate and honest. The board or committee responsible for the service should receive a clear account of what happened, what harm occurred, what the review found, and what actions remain open, without technical detail obscuring the user impact. Supervisors and auditors should be given the record as it stands, with its gaps acknowledged, rather than a summary that smooths over awkward facts. Sharing a candid record builds more credibility than sharing a polished one, because the reader can see that the firm is willing to be judged on its actual performance.

An incident should be closed only when its actions are closed on evidence, not when the review meeting has taken place or the report has been written. Until then, the incident remains an open item in the service trail, visible to anyone who follows that trail. That discipline prevents the most common failure of incident evidence, which is a thorough review followed by quiet inaction, leaving the firm to face the same disruption, with the same weakness, and to explain why a lesson it had already identified was never applied.