The worst outcome of a tabletop exercise is not finding gaps. It is finding them, writing them into a tabletop exercise after action report, and running the same exercise next year to find them again.
We see the moment it happens. The scenario reaches recovery, the room goes quiet, and someone says what everyone is thinking: “We wouldn’t be in a good spot should we have to recover.”
That sentence is the exercise working. What you do in the next 90 days decides whether it was worth the afternoon.
What Usually Happens After the Exercise
The pattern is familiar:
- The hot wash captures strong opinions while they are fresh.
- The after action report (AAR) arrives six or eight weeks later, after the urgency has faded.
- It lists thirty or forty recommendations, unranked, with no owners.
- The exercise sponsor files it, the team goes back to the day job, and the findings age quietly.
- Next year’s exercise finds the same gaps, and the audit finding repeats.
None of that is a facilitation failure. It is a follow-through failure, and it is the most common one we see.
| Old View | New View |
| The exercise is the deliverable | The improvement plan is the deliverable |
| The AAR summarizes what happened | The AAR decides what changes, who owns it, and by when |
| Every finding goes on the list | Findings are triaged: fix now, fund, or formally accept |
| Next year’s exercise is a new scenario | The next exercise re-tests the gaps this one found |
| Success means the team performed well | Success means the gaps are closed and proven closed |
The First Week: Capture and Brief
Within 72 hours, finish the hot wash notes and brief the sponsor. The urgency in the room is your most valuable asset, and it decays fast. A short sponsor debrief in the first week, before the full report, keeps the findings in front of leadership while they still feel real.
Name the three gaps that matter most. Not thirty. Three. If the exercise reached recovery, at least one is usually about sequencing: nobody could say what gets restored first, or what depends on what.
Book the executive debrief now. Your executives need to hear the findings in their own language: what would have happened to customers, revenue, and regulators if the scenario had been real.
Weeks One to Four: A Tabletop Exercise After Action Report That Drives Decisions
A tabletop exercise after action report has one job: turn observations into decisions. It does that when:
- Every observation is tied to a moment in the exercise. “At the second move, the team could not identify which systems payroll depends on” is actionable. “Dependency awareness could be improved” is not.
- Recommendations are ranked by business impact, not listed in the order they came up.
- Every recommendation has an owner and a date. An unowned recommendation is a wish.
- It is short enough for executives to read. Put the decisions on the first page.
Pair the AAR with an improvement plan. The Homeland Security Exercise and Evaluation Program (HSEEP) formalizes this as the After-Action Report/Improvement Plan, and FEMA publishes a free AAR/IP template you can adapt. For a deeper look at the process itself, see how to conduct an effective after-action process.
A simple improvement plan you can use today
You do not need software to start. A table with seven columns works:
| Finding | Plan or capability affected | Corrective action | Owner | Due | Status | Verified by |
| No agreed recovery order for payroll | IT disaster recovery plan | Map payroll dependencies and write the recovery sequence | Director, IT Infrastructure | 60 days | In progress | Technical recovery test |
| Severity levels applied inconsistently | Crisis management plan | Rewrite severity definitions with examples; brief the crisis team | Crisis Program Lead | 30 days | Not started | Next tabletop |
| No decision owner for accepting data loss | Recovery governance | Name the decision-maker and pre-authorize thresholds | CIO with General Counsel | 45 days | Not started | Executive sign-off |
The last column matters most. A gap is not closed when the task is done. It is closed when a test proves it.
Triage Every Gap Into One of Three Bins
Not every finding deserves the same treatment. Sort them:
- Fix now (within 30 days). Low cost, high clarity: contact lists, decision rights, severity definitions, escalation paths. Closing these fast builds credibility for the harder work.
- Fund (needs a decision and a budget). Dependency mapping, recovery capability, tooling, or staff. These need a business case, framed in what the risk costs and what it takes to reduce it.
- Formally accept. Some gaps are not worth closing this year. That is a legitimate executive decision, but it should be a decision, documented and owned, not a finding that quietly expires.
The second bin is where most programs stall. Practitioners tell us their executives say some version of: “Great job reporting the risk. We need to do something about it.” The improvement plan is how you answer with a funded proposal instead of another report.
Days 30 to 90: Close, Fund, Re-Test
- Close the fix-now items and report progress to the sponsor every two weeks.
- Take the fund items to your executives with options and costs, not just risk ratings.
- Schedule the re-test. Put the next exercise on the calendar now, built around the same gaps. If recovery sequencing was the problem, the next exercise should go straight to recovery, and a technical restore test should prove the new sequence works.
If the gaps were about recovery order, our guide to building the business layer of a ransomware recovery plan walks through the five decisions to make before the next event.
When the Gaps Are Bigger Than a Fix List
Sometimes an exercise exposes something the improvement plan cannot hold: no current Business Impact Analysis (BIA), two crisis plans with overlapping teams, nobody who owns recovery. Those are program problems, not exercise findings.
That is the moment for a baseline. A business continuity maturity assessment tells you where the program stands, which gaps matter first, and what order to fix them in. Our Resiliency Diagnosis® is built for exactly this situation, and we often run it right after an exercise.
If the problem is capacity, not knowledge, and your team does not have the time or hands to work the improvement plan, Business Continuity as a Service and Resilience as a Service put senior practitioners on the work until it is closed.
Common Failure Modes
- The AAR takes two months. By then, nobody remembers why the findings felt urgent.
- Findings get softened for the executive audience. If the report is written to avoid discomfort, it will not produce change.
- The sponsor leaves. Name a second owner for the improvement plan on day one.
- Next year’s exercise uses a new scenario. A new scenario cannot prove the old gaps are closed.
- Closed means “task done,” not “tested.” Verify every fix in an exercise or a real test.
An exercise that finds gaps did its job. Closing them is yours.
Keep Going
A few ways to go deeper if this was useful.
- Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Crisis Management.
- Plan the re-test. Our tabletop exercises are custom-built around the gaps your last exercise found, and end in an improvement plan with owners.
- Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
- Talk to us. Set up a call to think through your improvement plan with us.
