An After-Action Report (AAR) should convert an exercise or real disruption into improvement. The report is not a transcript of everything that happened. It explains what was intended, what actually happened, what evidence supports the observation, why it matters and what action will close the gap.
AAR template structure
| Section | What to capture |
|---|---|
| Event summary | Date, scope, scenario/event, participants and facilitator/lead. |
| Objectives | The capabilities the exercise or response intended to validate. |
| Timeline | Key decisions, injects, recoveries and significant delays. |
| What worked | Strengths supported by evidence. |
| What did not | Observed gaps and their operational consequence. |
| Root/contributing cause | Why the gap occurred, not just the symptom. |
| Corrective action | Specific action, owner, due date, priority and verification evidence. |
| Lessons | Changes to plan, training, strategy, technology, supplier or governance. |
Write findings so they can be fixed
Weak: “Communication needs improvement.” Strong: “The alternate incident bridge number in the finance continuity plan was invalid, delaying team coordination by 18 minutes. Update the master contact record, verify the fallback channel and retest within 30 days.” The second finding identifies evidence, impact and a verifiable action.
Corrective action fields
- Finding ID and severity.
- Affected service/process or control.
- Action statement with measurable completion condition.
- Accountable owner.
- Target date.
- Dependencies or funding needed.
- Status and escalation rule.
- Closure evidence.
- Independent verification where required.
Lessons versus actions
A lesson is an insight; an action is a controlled change. “Suppliers need earlier involvement” is a lesson. “Add supplier escalation contacts to the exercise planning checklist and include the top five critical suppliers in the Q4 tabletop” is an action. Track both, but do not close a lesson merely because it was written in the report.
Use the BCM System Playground Exercise module to record a demonstrated recovery time and finding, or start with the Exercise Planning Checklist.
Frequently asked questions
What should an after-action report include?
Objectives, timeline, evidence-based observations, strengths, gaps, causes, lessons and corrective actions with owners and due dates.
Who should own corrective actions?
The person or function able to implement the change. BCM can coordinate and verify but should not automatically own every action.
Evidence quality checklist
- Record the actual timeline, not only a retrospective summary.
- Separate observed facts from assumptions and opinions.
- Link each major finding to the exercise objective or incident outcome it affected.
- Record recovery timings and compare them with RTO or other approved targets where relevant.
- Assign every corrective action an owner, due date, risk/priority and verification method.
- Close an action only after evidence confirms the change was implemented and, where needed, retested.
Example finding and corrective action
Finding: the alternate customer-support team could not access the current call tree for 35 minutes because the file was stored only in the unavailable collaboration platform. Impact: escalation and stakeholder contact were delayed. Corrective action: publish a controlled offline contact export, assign the service owner, set a 30-day due date and verify the change in the next call-tree drill.
Frequently asked questions
What is the difference between an after-action report and meeting minutes?
Meeting minutes record discussion. An after-action report evaluates what happened against objectives or expected capability, identifies lessons and creates traceable improvement actions.
Should every observation become an action?
No. Convert observations into actions when a change is required. Positive practices and accepted observations can be retained as lessons without creating unnecessary work.