Which of the following should be included in a post-incident review of a Business Continuity...

In GPG 7.0’s Validation practice (PP6), a post-incident review is emphasised as a way to evaluate response and recovery efforts and determine the extent to which “plans, capabilities, and competencies met the business continuity requirements.” To do that credibly, the review must capture factual, first-hand evidence from the people who experienced the incident and those who executed the response and recovery—what happened, what decisions were made, what worked, what didn’t, and why. That is exactly what option A provides.

Option B shifts the review into blame allocation, which undermines the constructive learning mindset that validation aims to build (identify strengths and improvements positively). Option C contains a desirable outcome (an improvement plan), but the question asks what should be included in the post-incident review itself; without structured input from participants, improvement actions become speculative. Option D (audit reports) can be a useful reference, but it is not the defining content of a post-incident review of actual response/recovery performance.