Lessons Learned: Turning Failures Into Better Controls

Financial services firms run an enormous number of post-incident reviews, and a meaningful share of them produce action items that never actually prevent recurrence. The difference between a lessons-learned exercise that works and one that doesn't usually comes down to whether it looks for root causes or stops at the surface-level description of what happened.

Distinguishing Root Cause From Symptom

"An employee made an error" is a symptom, not a root cause. Asking why the error was possible — was the process unclear, was there inadequate training, was there no check designed to catch this type of mistake — moves the review toward something that can actually be fixed at a system level.

Running a Genuine Learning Review

An effective review brings together the people closest to the incident, not just managers reconstructing it after the fact, and explicitly separates fact-finding from blame — a review conducted primarily to assign blame reliably produces less honest information than one focused on understanding what happened.

Assigning Real Ownership

Action items from a lessons-learned review need a named owner and a deadline, not a general commitment to "improve awareness." Vague actions are the most common reason lessons-learned reviews fail to change anything.

Judging Action Quality

Actions that change a system, a process or a control design tend to be far more durable than actions that rely on people simply being more careful. "Retrain staff" is rarely sufficient on its own if the underlying process still allows the same error to occur.

Verifying the Fix Actually Worked

A lessons-learned process isn't complete when the action item is marked closed — it's complete when there's evidence the underlying risk has actually reduced, whether through testing, monitoring data, or a documented control walkthrough.

Sharing Lessons Beyond the Immediate Team

Incidents often reveal risks that exist in other parts of the business, not just the team where the incident occurred. Sharing genuine lessons — appropriately anonymised where necessary — across the wider organisation multiplies the value of every review.

Frequently Asked Questions

Should every near miss get a full review? Not necessarily a full formal review, but every near miss deserves at least a brief root-cause check — near misses are often cheaper opportunities to learn than actual incidents.

How do you get honest information in a blame-averse culture? Explicitly separating the fact-finding phase from any disciplinary process, and stating this clearly at the start of the review, significantly improves the quality of information shared.

Who should own the lessons-learned process? Ownership often sits with risk or compliance, but genuine engagement from the business area involved is what makes the actions stick.

A Worked Example

Following a data-handling incident, an initial review concludes that "an employee made an error" and recommends refresher training. A deeper root-cause review finds that the underlying process required a manual step with no system check, which several other employees had also skipped without incident purely by chance. Redesigning the process to remove the manual step — rather than only retraining the individual involved — is the action that actually prevents recurrence.

Key Takeaways

A lessons-learned process that stops at the individual who made the error, rather than the system that allowed the error to be possible, reliably fails to prevent recurrence. Naming a specific owner and deadline for each action, and verifying afterwards that the underlying risk actually reduced, are what separate a genuine learning culture from a paperwork exercise.

How This Fits Into a Broader Compliance Programme

A genuine lessons-learned process is one of the few controls that gets stronger every time it's used, because each review adds to a firm's institutional understanding of where its real vulnerabilities lie. Firms that treat incident review as a compliance formality, rather than a core improvement mechanism, tend to see the same categories of failure recur under slightly different names.

Should lessons-learned reviews be shared with regulators? Where the underlying incident is reportable, yes — a well-run internal review is also strong evidence of a firm taking its obligations seriously.

Building This Into Team Practice

A lessons-learned culture is strengthened considerably when teams review near misses on a regular cadence, not only after a formally reportable incident — treating a near miss with the same seriousness as an actual event, while it's still cheap to fix, is one of the most cost-effective risk management habits a team can build. Sharing a short, anonymised summary of what was learned with adjacent teams multiplies the value of every review well beyond the team where it originated.

Some firms maintain a shared, searchable library of past lessons-learned summaries specifically so that new starters and other teams can learn from an incident without having to experience a version of it themselves — this turns each review into a lasting organisational asset rather than a one-time exercise.

See Learnsignal's CPD course library and the related course on auditor ethics and liability.