Post closure of a major incident, a post incident review and analysis must be performed and completeness of the incident record should be checked. Major Incident Recovery Team (MIRT) should be contacted in case any further information is required.

The Major Incident Manager must call for the Post Incident Review (PIR) meeting to:

• Establish the root cause of the major incident
• Review effectiveness of technical response and actions
• Review what could have been done to reduce the resolution time
• Review effectiveness of communications
• Agree remedial actions to be taken to prevent a recurrence e.g. apply a permanent fix
• Agree accountability and dates by when remedial actions will be complete
• Check the response of any third-party agencies.

Once all these documentation is complete, outstanding actions (if any) should be handed over to incident management team.