Australian workplaces invest heavily in the front half of emergency preparedness: the plans, the training, the drills, the equipment. Far less attention goes to what happens after the incident is over, when the alarm stops sounding and the fire brigade drives away. Yet the after-incident phase is where the most valuable preparedness improvements come from. Every real incident, and every drill, produces lessons that only become useful if they are captured, examined, and translated into plan updates. Without a structured debrief, those lessons are lost and the same mistakes are repeated.

This guide covers the post-incident debrief in the Australian workplace context: why it matters, when to run it, who attends, how to structure it, and how to close the loop by feeding lessons back into the emergency plan. It sits alongside our companion guides on the AS 3745 Emergency Control Organisation and how to develop your emergency evacuation plan.

Why the debrief is not optional

AS 3745:2010 requires that plans are reviewed after evacuation exercises and after real incidents. It does not describe how the debrief should be run, which is why so many facilities either skip it or turn it into a superficial “everyone did well, thanks for coming” exercise that generates no learning. The intent of the standard, and the operational value, comes from a debrief that treats the incident or exercise as a genuine data source.

The consequences of skipping the debrief are cumulative. A plan that has never been updated based on real experience drifts steadily out of alignment with the facility it is supposed to protect. Buildings change. People change. Systems change. Threats change. The plan on paper stays where it was.

Debrief windows: when to run each type

Different incidents warrant different debrief timing. In practice, three windows matter:

• Hot debrief: within 15 to 60 minutes of the all-clear, while the Emergency Control Organisation (ECO) is still assembled. Captures immediate impressions before memory fades. Useful for drills and low-severity incidents.
• Structured debrief: within 24 to 72 hours. The formal session with the full ECO, facility management, and where relevant a police or Fire and Rescue liaison. This is the primary learning session.
• Lessons-learned review: within two to four weeks. A follow-up session to confirm which changes have been made to the plan, which are still outstanding, and to test any procedural changes with a targeted exercise.

Skipping any of the three creates predictable gaps. Hot debriefs alone capture emotion but rarely produce structural changes. Structured debriefs alone miss the immediate impressions that fade within hours. Lessons-learned reviews without earlier sessions have nothing substantive to work with.

Who attends the structured debrief

A serviceable structured debrief typically includes:

• The Chief Warden and Deputy Chief Warden
• The Communications Officer and any warden who had a specific role during the incident
• The person who first identified the incident (call-taker, occupant, security)
• Facility management and the Person Conducting a Business or Undertaking (PCBU) representative
• A representative from the Emergency Planning Committee
• For significant incidents, a liaison from the responding emergency service (police, Fire and Rescue, or ambulance) where available
• The building manager in multi-tenanted facilities

Attendance matters. A debrief that omits the Communications Officer misses the reality of what the communication tree actually delivered under stress. A debrief that omits the person who first identified the incident misses the recognition and reporting phase entirely. A debrief that omits building management in a multi-tenanted facility misses the coordination gaps that only that person can name.

The structured debrief agenda

An effective debrief follows a predictable structure. The version below runs 60 to 90 minutes for a moderate incident and adjusts up or down for scale:

Timeline reconstruction (15 minutes)

Walk through what happened, minute by minute, from initial detection through to all-clear. Use the incident log if one exists. Compare recollections. Establish an agreed timeline of the response before moving to evaluation.

What worked (15 minutes)

Deliberately start with what worked, not what failed. Cultural signal matters: the debrief is about learning, not about assigning blame. Capture the elements of the response that functioned as designed and any positive surprises.

What did not work (25 minutes)

The core of the debrief. Cover the categories systematically: detection and initial reporting; alerting and communication; ECO response and coordination; occupant behaviour; equipment and systems; interaction with emergency services; and Personal Emergency Evacuation Plan (PEEP) execution where relevant. Do not stop at symptoms. Ask why for each failure.

Surprises (10 minutes)

The things the ECO did not expect. New information about the building, new information about occupants, new information about the response systems. Surprises often reveal the largest gaps in the underlying plan.

Actions and owners (15 minutes)

Every issue identified gets an action, an owner, and a due date. Actions with no owner are wishes. Actions with no due date do not happen.

Categories to review specifically

For a fire or general evacuation incident, cover route usability, sweep completeness, assembly area function, and PEEP execution. Cross-reference against our guide on the role of fire wardens in evacuation planning for the specific actions to verify.

For a bomb threat or suspect item incident, add the credibility assessment, the phone or channel handling, the 25-metre electronic exclusion zone, and the police liaison. See our bomb threat procedures comprehensive guide.

For a lockdown, add the signal distinctness, the securing sequence, the room-by-room execution, and the all-clear communication. See preparing for a lockdown in the workplace.

For a hazardous substance or suspicious package incident, add the recognition indicators, the initial response sequence, and the decontamination and Fire and Rescue Hazmat handoff. See how to handle a suspicious package at work.

Occupant welfare after the incident

The debrief is not only about procedural learning. Real incidents produce real psychological impact, and the debrief window is where welfare needs are identified. Cover:

• Occupants directly involved (call-takers, first responders, people in the immediate vicinity)
• Occupants with pre-existing anxiety or trauma history who may be affected by the incident
• The ECO members who carried operational responsibility during the incident
• Occupants who observed the response and may have questions or concerns

For any incident involving violence, threats, injury or death, pre-arranged Employee Assistance Program (EAP) escalation should be triggered. Critical incident stress is common and can persist for weeks. Waiting for occupants to ask for support is not sufficient. Proactive offers of support, delivered discreetly and individually, matter.

Documentation: what the debrief produces

A debrief without documentation is a conversation. A debrief with documentation is a compliance and learning artefact. At minimum, the debrief report should capture:

• Incident summary and agreed timeline
• Attendees and their roles
• What worked, in enough detail to be replicable
• What did not work, with root causes identified where possible
• Surprises and their implications
• Actions, owners and due dates
• Occupant welfare arrangements
• Recommendations for plan or procedure changes
• Recommendations for training changes
• Any regulatory notifications required

Feeding lessons back into the plan

The Emergency Planning Committee owns the plan. Debrief actions flow to the EPC, which is where plan and procedure changes get authorised, documented and version-controlled. For the governance structure that makes this work, see our pillar guide on the AS 3745 Emergency Control Organisation explained. For the underlying document that captures the plan, see emergency management manuals.

Lessons that stop at the debrief report do not improve the plan. Every action captured in the debrief should either close (evidence attached) or escalate (owner reports to EPC) within a defined interval. Best practice is to review outstanding debrief actions at every EPC meeting until they are closed.

Regulatory notification obligations

The 2025 model WHS amendments extended notifiable incident duties in several jurisdictions to include certain violent incidents, work-related suicide and attempted suicide, and worker absences of 15 or more calendar days where the relevant jurisdiction has adopted the amendments. NSW additionally introduced the WHS Regulation 2025 (commenced 22 August 2025) with new obligations around psychosocial risk, lithium-ion storage above 25 tonnes, and other matters. The debrief is the point at which the notification obligation is confirmed and actioned. Do not assume no notification is required. Confirm affirmatively.

Common debrief pitfalls

From more than 40 years delivering AS 3745 training and incident support to Australian facilities, these are the recurring failures we see in workplace debriefs:

• The debrief is skipped because “everyone knows what happened”. Nobody actually knows what happened until the timeline is reconstructed collectively.
• The debrief becomes an exercise in blame. Cultural signal is set by the Chief Warden or facilitator in the opening minutes. If someone is looking for who to blame, no one will speak honestly.
• Only the ECO attends. Occupants, building management, and emergency services liaisons who saw the incident from a different angle are excluded. Their perspective is lost.
• Actions are captured without owners or due dates. Everything gets forgotten within a week.
• The report is written but never read. The EPC does not review the actions at its next meeting. Nothing changes.
• Occupant welfare is treated as a separate stream from the debrief. Support arrangements are improvised weeks later.
• The lessons are not shared with the broader ECO. Only the debrief attendees know what changed, and the next incident finds the same gaps.

Build the debrief into your emergency management framework

The debrief is not an add-on. It is the mechanism that turns emergency response experience into a stronger emergency plan. Facilities that treat the debrief as a core part of their preparedness cycle end up with plans that reflect their actual buildings, their actual occupants, and their actual response capability. Facilities that skip it end up with plans that reflect what someone thought the building was like when they wrote it.

First 5 Minutes supports Australian organisations across the full emergency preparedness cycle, from plan development to training to post-incident debrief facilitation. Explore our facility emergency evacuation plan service, our AS 3745 compliance essentials, and our Chief Warden training program, or contact our team on 1300 321 120 to discuss debrief facilitation for your facility.

Frequently asked questions

How soon after an incident should a debrief happen?

A hot debrief within 15 to 60 minutes captures immediate impressions while memories are fresh. The structured debrief follows within 24 to 72 hours, and a lessons-learned review within two to four weeks. Skipping any of the three creates predictable gaps.

Is a debrief required under AS 3745?

AS 3745:2010 requires the emergency plan to be reviewed after evacuation exercises and after real incidents. The debrief is the mechanism by which that review is done. The standard does not prescribe the format, but a review without a debrief is not a review.

Who should facilitate the debrief?

For smaller facilities, the Chief Warden can facilitate. For larger or complex incidents, an external facilitator (a Chief Warden trainer, an EPC chair, or an experienced consultant) is better because they can ask uncomfortable questions without organisational politics interfering.

Do we need to debrief every drill, or only real incidents?

Both. Drills are training opportunities that produce learning only if they are debriefed. AS 3745 requires an annual evacuation exercise; debriefing it is what makes it more than a fire alarm test.

What if the Chief Warden was one of the failure points?

Handled openly, this is one of the highest-value lessons available. Handled poorly, it destroys the debrief culture. This is why external facilitation is often preferable for significant incidents and why the “no blame” cultural signal set at the start of the session matters.

How do we support occupants who were traumatised?

Pre-arranged Employee Assistance Program (EAP) escalation should be triggered proactively rather than waiting for individuals to ask. Critical incident stress is common and can persist for weeks. Offers of support should be discreet, individual, and repeated.

Should emergency services attend the debrief?

For significant incidents, yes, where they are willing and available. Their perspective on the response, the handover, and the site information you provided is invaluable. Many state Fire and Rescue services will send a liaison to a workplace debrief on request.

How do we know if a lesson has actually been closed?

Each action from the debrief needs evidence of completion. A plan revision closes when the version is updated and issued. A training gap closes when the training has been delivered and attendance recorded. A procedural change closes when it has been documented, communicated to the ECO, and demonstrated in a targeted exercise. Anything less is an open action.

Are we required to notify anyone after an incident?

Depends on jurisdiction and incident. The 2025 model WHS amendments extended notification duties in several states to include certain violent incidents and worker absences of 15 or more calendar days. NSW WHS Regulation 2025 added further obligations. Confirm the notification position during the debrief. Do not assume none is required.

Where should the debrief report be kept?

With the Emergency Management Manual, under the same version control, retained for the life of the facility plan plus any statutory record retention period that applies. Debrief reports are compliance evidence and, in litigation, are also evidence that the organisation took its post-incident learning obligations seriously.