"In a crisis, the plan you trained for is the only plan you have."
Post-Incident Recovery and Debrief
Instructor Sele: The incident is over. Now the real work begins. How you close out a crisis — the debrief, the documentation, the welfare check, the review — determines whether lessons are learned and whether your team is ready for the next one. This module covers everything that happens after the immediate response ends.
Section 1 — Immediate Post-Incident Actions
As soon as the immediate crisis is stabilised: account for all persons — confirm all staff, visitors, and contractors are safe and located. Preserve the scene — do not disturb evidence; establish a cordon if required by LNP. Secure the site — prevent unauthorised re-entry. Brief the client — the IC delivers an initial situation report to senior client management. Begin documentation — every guard writes their own account of what they observed and did, while memory is fresh.
Section 2 — The Hot Wash Debrief
A hot wash is an immediate, informal debrief conducted directly after an incident, while events are fresh in everyone's minds. It is not a disciplinary hearing — it is an operational review.
Format: What happened? — a factual timeline of events. What did we do well? — identify and reinforce effective responses. What did not go as planned? — identify gaps and failures without blame. What do we need to do differently? — specific, actionable improvements.
The hot wash is the IC's immediate responsibility. It should happen within 2 hours of the incident being resolved. It feeds directly into the formal After-Action Review.
Section 3 — The After-Action Review (AAR)
The AAR is a formal, structured review conducted within 24–48 hours of the incident. It is more detailed than the hot wash and produces a written report with: full incident timeline; assessment of response against the Emergency Response Plan; identification of training gaps; recommended changes to SOPs, post orders, or the ERP; action list with owners and deadlines.
The AAR is the primary mechanism for continuous improvement in crisis management capability. Every significant incident must have one.
Section 4 — Staff Welfare and Post-Incident Support
Involvement in a serious incident — particularly one involving injury, death, or active threat — can cause significant psychological impact on security personnel. Post-incident stress is a normal physiological and psychological response. It is not weakness.
SafeHaven's obligations: conduct a welfare check with all staff involved in a major incident within 24 hours; provide access to professional support where symptoms of acute stress are identified; never dismiss or penalise staff for reporting psychological impact after an incident; monitor affected staff for at least two weeks post-incident for signs of delayed stress response.
- •Immediate post-incident: account for all persons, preserve the scene, brief the client, begin documentation
- •Hot wash: immediate, informal, factual — within 2 hours of resolution
- •AAR: formal, written, within 24–48 hours — the primary continuous improvement mechanism
- •Post-incident stress is normal — provide welfare support, do not dismiss or penalise
- •Every major incident produces a written AAR with action items and owners
"After a serious incident involving an armed robbery at a client site — nobody was physically injured — I checked in on the guard who had faced the weapons three days later. He said he was fine. I asked him how he was sleeping. He went quiet. We got him proper support. He came back to work six weeks later and is now one of my best supervisors. Post-incident welfare is not a checkbox. It is a professional and ethical obligation. The incident ends. The person continues."
What is a "hot wash" debrief?