An incident log that holds up in audit

Why it matters

The incident log serves four successive purposes:

1. During the crisis — it gives anyone arriving mid-event a full picture in three minutes.
2. In the debrief — it lets you rebuild the real chronology, including what collective memory will have rephrased.
3. In audit and regulatory notification — DORA and NIS 2 require documenting the chronology and the impact; the log is the source.
4. In litigation — it demonstrates the organisation acted diligently, or its absence suggests otherwise.

What goes in it

The last two rows are the ones almost always missing. A discarded hypothesis stops it coming back three times. A decision to do nothing is a decision, and with no trace it will later be read as inaction.

What invalidates a log

• It is written after the crisis, from memory;
• Times are approximate or absent;
• Facts and commentary are mixed;
• Authors are not identified;
• It is corrected after the fact without the changes being visible.

The last point is the most serious. A log is completed afterwards — by adding entries dated at the time of completion — but never rewritten. A corrected chronology loses all evidential value, and the correction itself becomes a problem.

Practice

Keeping an incident log is a skill, and it decays. Two exercises a year are enough to maintain it: by the third, the secretary writes twice as fast and naturally separates facts from hypotheses.