An exercise after-action review (AAR) determines what the exercise proved, what remains uncertain and what must change. Its purpose is not to produce a positive event summary. A useful AAR preserves evidence, compares observed performance with pre-agreed objectives, identifies why gaps occurred and creates actions that can be verified through implementation or re-test.
Capture evidence during the exercise
Do not reconstruct the result from memory days later. Collect timestamps, decision logs, notification records, screenshots, recovery outputs, observer notes, participant actions and business validation evidence while the exercise is running. Link each item to an objective where possible. This creates a traceable basis for distinguishing fact from participant perception.
Compare performance with the stated acceptance criteria
For every objective, record the target, observed result, evidence and conclusion. If the objective was to restore a service within four hours, report the actual elapsed time and the point at which business users confirmed minimum service—not only when infrastructure became available. Use Pass, Partial, Fail or Not Demonstrated only when the organization has defined what those states mean.
Separate observations from findings
An observation describes what happened. A finding explains why it matters. “The supplier was contacted 35 minutes after invocation” is an observation; “the plan contains no out-of-hours supplier escalation path, creating a material delay against the recovery sequence” is a finding. This distinction prevents the AAR from becoming a list of comments without risk significance.
Identify root cause before assigning the action
Avoid defaulting every issue to “update the plan” or “provide training.” Ask whether the cause was unclear authority, unavailable data, unrealistic capacity, missing access, architecture, supplier dependency, staffing, an incorrect recovery assumption or poor plan usability. Corrective action should address the cause that would otherwise reproduce the failure.
Rate findings by consequence and confidence
Prioritize findings using the affected critical service, recovery objective, regulatory or safety consequence, shared dependency exposure and likelihood that the issue would occur in a real disruption. Also record evidence confidence. A suspected weakness observed only in discussion may need validation, while a failed technical restore is demonstrated evidence of a capability gap.
Write actions that can be closed objectively
Each action should identify the required outcome, accountable owner, due date, interim treatment and closure evidence. “Review supplier process” is weak. “Establish and approve a 24x7 escalation route, update the recovery runbook, verify contactability and demonstrate invocation in the next exercise” is auditable. Route these actions through BCM Corrective Action Management.
Decide when re-test is mandatory
Document changes do not prove recovery capability. Re-test when a material objective failed, when the remediation changes technology or operating procedure, when the root cause involved capacity or timing, or when the original exercise could not demonstrate the capability. Define the evidence needed to close the finding before the action owner begins remediation.
Worked AAR example
A tabletop assumes the primary operations team is unavailable. The alternate team receives the activation message in eight minutes, within target, but cannot access the recovery dashboard because privileged access was tied to primary-team accounts. The AAR records notification as passed and alternate-team access as failed. Root cause is access design, not participant knowledge. The action therefore provisions role-based emergency access, verifies audit logging and requires a re-test by the alternate team before closure.
Run the review while evidence is fresh
Hold an immediate hot debrief for time-sensitive observations, then a structured review after evidence has been consolidated. Give participants an opportunity to challenge factual accuracy, but do not dilute a supported finding merely to achieve consensus. The exercise owner should maintain the evidence trail and record any unresolved disagreement.
Feed assurance back into the BCM program
The AAR should update exercise coverage, recovery confidence, plan maintenance and management reporting. Repeated findings across services may indicate a systemic issue such as identity dependency, supplier concentration or weak change control. Escalate systemic themes to BCM Management Review rather than treating each occurrence as an isolated local action.
AAR acceptance checklist
- Every exercise objective has an evidence-backed conclusion.
- Observed facts are distinguishable from analysis and participant opinion.
- Material findings state consequence and root cause.
- Actions have accountable owners, dates and objective closure evidence.
- Failed material capabilities have explicit re-test decisions.
- Systemic themes are visible to program governance and management review.
Relationship to the exercise lifecycle
The BCM Exercise Program decides what capability requires proof and at what fidelity. BCM Tabletop Facilitation and Evaluation governs exercise conduct. The AAR converts resulting evidence into findings and improvement, while broader organizational learning can be consolidated through BCM Lessons Learned.
Operational validation checkpoint for BCM Exercise After-Action Review: Evidence, Findings and Improvement
For BCM Exercise After-Action Review: Evidence, Findings and Improvement, the most useful quality test is whether the organization can convert exercise observations into defensible findings, root causes, owners and verified improvements instead of producing a narrative that closes when the meeting ends. A credible implementation should be supported by objectives, observed evidence, expected behavior, finding severity, root cause, corrective action, owner, due date, retest method and closure evidence. Reviewers should be able to trace those artifacts to an accountable owner and to the critical service, scenario or decision they are intended to protect. If the evidence is old, generic or disconnected from the actual operating environment, treat the gap as an improvement item rather than assuming the documented approach will work during disruption.
A practical failure mode for BCM Exercise After-Action Review: Evidence, Findings and Improvement is recording vague lessons such as “communication should improve” without identifying the failed decision, process, tool or ownership mechanism. Challenge that assumption in a walkthrough, exercise, test or evidence review that reflects realistic constraints. The corrective action is to write each material finding as a testable gap and require closure evidence or a retest before marking the action complete. Record the decision, owner, due date and proof required for closure so the improvement can be verified instead of remaining a narrative recommendation.
- Decision: state what must be decided, triggered or recovered when this capability is used.
- Evidence: identify the current artifact or test result that proves the capability exists for BCM Exercise After-Action Review: Evidence, Findings and Improvement.
- Dependency: name the person, system, supplier, facility, data source or authority that can prevent the outcome.
- Threshold: define the point at which the current approach is no longer sufficient and escalation is required.
- Verification: specify how the owner will demonstrate that the corrective action materially improved the capability.
Connect this review to BCM Exercise Program: Multi-Year Capability Validation so the decision does not sit in isolation. BCM Exercise After-Action Review: Evidence, Findings and Improvement should remain consistent with the wider BIA, recovery strategy, crisis governance and exercise evidence that apply to the same service.