What is the purpose of a 'lessons learned' repository, and how should it be maintained?

• A. To store insights for reuse; maintain with tagging, searchability, access controls, and periodic reviews to ensure relevance.
• B. To archive incidents with no plan for use.
• C. To restrict access to only top management.
• D. To replace the incident report with the lessons learned.

Answer: (A)

The purpose of a lessons learned repository is to capture insights from past incidents so they can be reused to prevent recurrence, improve responses, and strengthen future work. To be effective, it should be designed for practical reuse: each entry clearly describes the issue, root causes, concrete corrective actions, owners, and due dates; it uses tagging and a solid taxonomy to organize topics; it supports fast search and retrieval so teams can find relevant lessons when planning, training, or assessing risks. Maintenance should include clear ownership, structured metadata, versioning, and regular reviews to keep content current and relevant. Access controls protect sensitive information while enabling learning across the organization, and entries are linked to related policies, controls, and incident reports to provide context and traceability. A curator or owner should drive periodic audits—retiring outdated items, updating actions taken, and ensuring lessons are tested in practice.

Archiving incidents with no plan for use misses the whole point of reuse. Restricting access to top management prevents widespread learning and improvement, which should be accessible to those who implement changes. Replacing an incident report with lessons learned eliminates the essential context and evidence that explain why the lesson matters.