What is the purpose of a hotwash after an incident?

• A. The immediate debrief to capture lessons learned while events are fresh.
• B. A formal post-incident audit with metrics.
• C. A security drill scheduled weeks later.
• D. A debrief conducted after the incident has concluded.

Answer: (D)

The main idea is to review what happened after everything has wrapped up, so the debrief can reflect the full incident lifecycle and the final outcomes. Conducting the hotwash after the incident has concluded ensures you capture complete facts, assess how containment, response, and recovery went, and identify improvements that apply to future incidents rather than just the early moments. It helps avoid basing lessons on partial information or emotions that are present during the heat of events.

This fits because hotwash aims to yield actionable lessons that align with the final state of the incident, not just impressions from while it’s still ongoing. Immediate debriefs can miss later developments, formal post-incident audits with metrics are broader and more formal, and drills weeks later are about training rather than learning from the actual incident.