Incidents are formally reviewed after resolution to identify improvements
A documented post-incident review requirement belongs mainly to learning from incidents, but it also defines the criteria for reviews this preparation control assumes exist.
A documented requirement for a review after every significant incident sets the policy expectation this control depends on, but requiring a review does not itself apply lessons to strengthen controls, the operational improvement A.5.27 demands.