What is a hotwash?
A hotwash (also written “hot wash”) is a short, facilitated debrief held immediately after an exercise, or after a real incident, so the people involved can say what worked and what didn’t while the details are fresh. FEMA’s exercise doctrine calls it the player hotwash: a meeting that gives players an opportunity to discuss strengths and areas for improvement.
What it means in practice
A hotwash is spoken, quick and unpolished. It is not the after-action report. The report comes later and is built from evaluator notes, player feedback and the hotwash, and it carries recommendations with owners and dates. The hotwash supplies the raw material.
The person who ran the exercise usually runs it. One US state’s hotwash guide says every hotwash needs an experienced facilitator who keeps the discussion focused, brief and constructive. Two formats work. The open version asks what went well, what didn’t and what should change. The grouped version works through themes such as communication, decision-making and technical response, which gives quieter people a prompt. A short feedback form lets those who don’t speak up still write something down. Evaluators who recorded observations against an exercise evaluation guide can bring those notes to the room.
Here’s what a good one sounds like. After a ransomware exercise at a 150-person company, the finance director says she never found out who could approve an emergency payment. The IT manager says the order for restoring systems exists only in his head. Both points go on the flip chart with a name beside each. Two specific gaps, two owners.
Where it shows up in an incident
Hotwash is an exercise term, but the habit carries over. Once the immediate response ends, the incident lead gathers the team for a quick debrief before people go back to their day jobs and the details blur. It is separate from the post-incident review, which looks at root cause and the full timeline and takes longer.
Common mistakes:
- Waiting. A debrief held a week later is a different and vaguer conversation.
- Letting the most senior person speak first. Everyone else then agrees.
- Turning it into a search for someone to blame, after which people stop being candid.
- Keeping no notes, or notes with no owner and no date, so nothing reaches the improvement plan.
- After a real breach, writing candid comments into a shared document without asking counsel first. Debrief notes may be requested later in litigation or by a regulator, so ask how to run and record the session.
In a tabletop exercise
The hotwash is the last item on the agenda, and the facilitator runs it before anyone leaves the room. Three prompts that draw out specifics:
- “Name one decision that took longer than it should have. Who were we waiting on?”
- “Where did the plan say one thing and we did another?”
- “What did we assume today that we have never actually checked?”
Ask each person to finish with one thing they will change in their own area. Then read the list back so owners can correct it on the spot.
Sources
Want to see how your team would handle this for real? Here is how a facilitated tabletop works.