After-Action Reporting: How to Conduct an Effective After-Action Process

After-action reporting is how an organization stops repeating its own mistakes. Every crisis and every exercise leaves behind lessons, and most of them evaporate within a month. A structured after-action process, ending in a written After-Action Report (AAR) with owners and dates, is what turns those lessons into changes.

A few years ago my younger daughter asked me why I like history so much. I told her, “I want to make new and original mistakes in my life.”

That is the whole point of the after-action process. Your organization will make mistakes in the next crisis. Everyone does. The goal is to make original ones, not the same ones you made last time.

Before founding Bryghtpath, I led crisis response at Target. After Hurricane Sandy, our CEO, our board, and the communities we served were thrilled with how we responded. Our hot wash still produced about 40 things that didn’t go great. One of them was site access: the credentials we used to get trucks and people into the impact zone worked in every state but one, where local officials turned away a convoy the state had already cleared. A successful response is still full of lessons. You only find them if you look.

Since 2014, we have run this process with organizations of every size, after real incidents and after exercises. Here is how it works.

What Is an After-Action Report (AAR)?

An After-Action Report (AAR) is the written record of how your organization performed during a real incident or an exercise, and what it will change as a result. The after-action process is everything that produces it: the hot wash, the review sessions, the report, and the follow-through.

The process answers three questions:

• What went well?
• What didn’t go well?
• What should we do differently next time?

That’s it. Not a performance review. Not an audit. As I said on Managing Uncertainty, Episode 9, “This is not a performance review or audit. It’s, how do we be better at the things that we’re trying to accomplish here?”

Old View	New View
We only review the responses that went badly	Every incident and exercise gets reviewed, especially the good ones
One big meeting with everyone in the room	Separate sessions, so people can speak candidly
The AAR summarizes what happened	The AAR is a prioritized work plan with owners and dates
Action items belong to teams	Action items belong to a named person
The report gets filed	The fixes get tracked, closed, and tested in the next exercise

Why After-Action Reporting Gets Skipped

After-actions rarely get skipped out of malice. They get skipped because everyone is exhausted, nobody wants to start an uncomfortable conversation, and the day job is waiting. Within two weeks the moment has passed.

Two fixes solve most of this. First, write the after-action process into your crisis management plan as the last step of every activation, so it happens by default. Second, name the person who owns the after-action process before the incident, not after it.

Your plan should also say which events get the full process. A minor incident that never reached a crisis activation may need only a hot wash. A major activation, an injury, or an active assailant event gets the whole thing.

Step 1: Run a Hot Wash Meeting Right Away

A hot wash meeting is a short, informal debrief held as soon as the response ends, while memories are fresh. Plan on 20 to 45 minutes. The incident leader or crisis team leader runs it, and a scribe captures everything.

Start with the facts, then ask the three questions. Keep it about the response, not about individuals.

Expect emotion. Crisis leaders often feel the adrenaline drop the moment the incident closes, and the hot wash is where it shows. The answers are raw, but they are honest. Treat the hot wash as the raw snapshot you tuck in your back pocket for the formal review, when calmer and more rested heads prevail.

For an exercise, the hot wash follows the exercise directly. Our usual pattern is a short break, then a 30-minute hot wash, then a participant survey the next day.

Step 2: Hold Separate After-Action Sessions

Give people a few days to rest and reflect, and encourage them to jot notes in the meantime. Then, within 7 to 10 days, hold the formal after-action sessions.

Run them in separate groups. Power dynamics shape what people will say in front of their boss’s boss. Typical groups:

• Your executives
• The crisis management team
• Leaders and support teams at the impacted sites
• For large events, focus groups or surveys of affected employees

People who lived through the event itself need a different conversation. Don’t open with the three questions. Open with “Tell me what happened to you that day,” and listen.

When a population is too big to interview (a thousand people at an impacted site, for example), use a short survey with open-ended questions.

Probe vague feedback. “There wasn’t enough communication” is the most common answer you will get, and on its own it is useless. Keep asking. What did you receive? What did you want? How often? From whom? Containing what? You’re not challenging the person. You’re getting to what they need next time.

Expect to hear things you won’t like. Some people will be angry. Don’t get defensive. Keep asking questions.

Step 3: Agree on the Facts, Then the Fixes

Run each session in the same order:

1. Agree on the factual timeline. What happened, when, and who knew what.
2. Agree on what to improve. Wins first, then opportunities.
3. Define the action and assign an owner. Then stop.

Don’t solve the problem in the room. In one multi-day ransomware simulation, a team found its crisis documents scattered across too many places and started debating platforms on the spot. The right move was to hand the problem to the resiliency team and move on. As I put it on the podcast: “We don’t need to solve that in the after-action discussion. Now we have an owner.”

Separate the one-off lessons from the process problems. A missed phone call is an incident detail. A notification process that depends on one person’s cell phone is a program gap. Fix both, but know which is which.

Step 4: Write the After-Action Report

Keep the AAR short and plain. A useful structure:

1. Incident summary and timeline. The facts, including how often the crisis team met and what it decided.
2. What worked. Name the wins. They are what you want to repeat.
3. Opportunities. What didn’t work, grouped by category: communications, decision-making, technology, facilities, third parties.
4. Action items. Each one specific, assigned to a person (not a team), with a priority and an agreed due date. A quarter out is fine for most items.

Add a one- or two-page executive summary and a short slide version for executives and the board. Put the raw notes from the sessions in an appendix.

Record the big decisions while you’re at it: the question, the decision, who made it, the date, and what stayed open. Months later, why a decision was made is the hardest thing to recover. I wrote about this in Your Crisis Decision History Is a Single Point of Failure.

Then circulate the AAR to participants, executives, and stakeholders, and file it with your crisis management records. Sharing it is not a formality. A well-run after-action process is proof that your program works, and it is the strongest case you will ever have for the resources it needs.

If you want a starting point, our After-Action Process and Templates include the lessons-learned process and an AAR template.

Step 5: Track Every Action to Closure

An AAR with no follow-through is a diary. Someone has to own the action list after the report goes out, review it on a set cadence, and report progress to executives.

Anything left unresolved gets tested again in your next exercise. If the gap is still there, the exercise will find it. Because that’s real life.

For a prolonged crisis, don’t wait for the end. Run shorter interim reviews along the way so you can correct course. During the COVID-19 pandemic, a review roughly every six months worked well for the large organizations we supported.

Three Rules for After-Action Reporting

Keep feelings out of the review, not out of the organization. We get asked why our after-action templates don’t ask how people felt about the response. The review stays on what worked, what didn’t, and what you’ll do about it. Supporting your people after a hard event is essential, but it belongs in a separate effort: your Employee Assistance Program, counseling, and leaders who check in. The Ultimate Guide to Crisis Management covers both halves.

Ask what, not who. “If Legal had done their job, none of this would have happened” ends the conversation. Blame shuts down the candor the process depends on. Ask what failed and why. Criticism belongs to plans, training, and preparation.

Don’t overcomplicate it. Many emergency managers learned after-action reporting under FEMA’s Homeland Security Exercise and Evaluation Program (HSEEP). Its principles are sound, but its full apparatus is built for government and multi-agency response. Most companies need the three questions, separate sessions, a short report, and owned actions. That gets you the right level of detail without the bureaucracy.

What Happens When Lessons Aren’t Learned

Public after-action reports exist for one reason: so the next responder doesn’t repeat a known failure.

After the 1999 Columbine shooting, law enforcement learned that setting a perimeter and waiting for a specialized team to enter cost lives. Active shooter doctrine changed to confronting the attacker as quickly as possible. In May 2022 in Uvalde, Texas, that lesson was not applied. A Texas House investigative committee found “systemic failures and egregious poor decision making” in a response that involved 376 law enforcement officers and lasted more than an hour before the gunman was confronted.

I talked through this on Managing Uncertainty, Episode 163: Make Original Mistakes. The responders in Uvalde did not make original mistakes. They repeated one the profession had already paid for.

Your crisis team works the same way, at lower stakes. The cycle is simple: hold the after-action sessions, write the AAR with clear actions, make the changes, update your plans, train, and exercise. Then the next event finds something new.

In the next disruption, in the next disaster, we will make original mistakes.

Keep Going

A few ways to go deeper if this was useful.

• Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Crisis Management.
• Get an AAR worth acting on. Our facilitated tabletop exercises include the hot wash, survey, and a plain-English After-Action Report built as a prioritized work plan.
• Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
• Talk to us. Set up a call to think through your after-action process with us.