How do organizations learn from information system incidents? A synthesis of the past, present, and future

We review the literature on how organizations learn from information system (IS) incidents. We identify three modes of learning depending on the practices that constitute the learning process, the specific actors who play roles in learning, the temporal orientation of the learning practices, and the specific contextual focus of the learning. The literature focuses primarily on learning from past experience to draw lessons for future incidents (reflective learning mode). Yet, a growing stream of literature stresses the importance of learning through engagement with present incidents (embedded learning mode), and a few studies suggest that organizations can learn prospectively to prepare for future incidents (prospective learning mode). We argue that although these three learning modes are effective, they do not adequately explain how organizations learn from IS incidents when used in isolation. Since IS incidents unfold increasingly as sets of interacting events across information systems and organizational settings, organizational learning needs to be theorized as an iterative process among these learning modes. We synthesize these three learning modes into an integrative framework and theorize about their supportive and inhibiting relations. We suggest some opportunities for future research, which would advance our understanding of how organizations learn from IS incidents.