Write up a resolved incident — what went well, what went wrong, recommendations — assign follow-up action items, and sign it off as the regulatory record. One review per incident.
Responding to an incident is half the job; learning from it is the other half — and for regulated teams, recording that you did so is a duty, not a nicety. An after-action review (AAR) captures what happened, what worked, what didn't, and what you'll change, attached permanently to the incident it's about.
A review usually surfaces things to fix — a door that should have been locked, a contact list that was out of date. Capture each as an action item with an owner, a priority and a due date, and track it from open through to done. The lessons don't get lost the moment the review is filed.