After closing an incident, repeated delays are traced to unclear on-call authority. What is the most useful improvement?

1. Delete the after-action review
2. Update the playbook, ownership, and exercises using the lessons learned
3. Increase alert severity labels only
4. Buy unrelated hardware without changing the process