Hold the lessons-learned review within five business days and track the fixes

Incident Response policy, §8

Every High or Critical incident, and any Moderate incident the Compliance Officer selects, receives a post-incident review. Within five business days of containment the response team holds a facilitated lessons-learned meeting covering what happened and why, what went well and what did not, and the control changes needed. Each improvement is assigned an owner and a completion date and tracked to closure; high-impact items go on the compliance roadmap, and the findings are shared with the sponsor bank in the closure report.

Event-driven

Each High or Critical incident, within 5 business days of containment; findings shared within 30 days of closure

Schedule the meeting from the containment date, record the root cause and the agreed improvements with owners and dates, track each to closure, and include the findings in the bank’s closure report.

• Lessons-learned record

  Meeting date, attendees, root cause, improvements with owner and due date

• Remediation tracker

  Each item with its status and closure date

Compliance Officer

Leela can set the review date from the containment date, chase each open remediation item, and flag the ones past due.

Tell Leela about your company to see whether this applies.