The After-Action Review Is Where Review Happens

Across four Level 4 and conflict-affected operating environments, Haiti, Afghanistan, Kurdistan, and South Sudan, I ran an extensive program of tabletop exercises, scenario planning, and drills built specifically to test business continuity and recovery under disruption, with after-action review as the closing step of every one. The environments did not permit exercises that ended in a debrief and a coffee. The scenarios were later run for real: a full-scale country evacuation from Kurdistan during acute civil unrest, and post-earthquake disaster recovery in Haiti that held the client's business continuity intact while coordinating life support and logistics for more than 60 expatriate personnel.

The review that works has a fixed structure. First, the timeline is reconstructed from records, not memory, because memory in a crisis compresses and reorders. Second, each decision point is examined against the plan: what the plan said, what was done, and why they differed. Third, every difference is classified as a plan failure, a training failure, a resource failure, or a correct deviation from a plan that was wrong. Fourth, each classified finding becomes a corrective action with a named owner and a completion date. Fifth, the review closes with the list read aloud and each owner acknowledging the item.

The classification step is where most reviews go soft. A team that has performed under pressure wants to record that it performed well, and it usually did. The review is not a judgment of the team. It is a judgment of the plan, and a plan that survived only because people improvised around it has been found deficient, no matter how well the improvising went.

FEMA's improvement-planning guidance states that an effective corrective action program develops improvement plans that are dynamic documents, with corrective actions continually monitored and implemented as part of improving preparedness. Dynamic means someone is holding the list open. In practice that is one accountable person per finding, with the authority to change the plan, the training, or the resource that failed, and a date by which the change is verified rather than promised.

Ownership has to sit at the level that can act. A finding that the emergency communications plan named a telephone number that no longer worked is owned by whoever maintains the plan, not by the team lead who discovered it at two in the morning. A finding that the evacuation assembly point was unreachable under the actual road conditions is owned by the security manager who set it, and the fix is verified by driving the route, not by editing a document.

The Institute of Internal Auditors' Three Lines Model is useful here as a discipline rather than a diagram. The people who own the plan fix the plan. Someone independent of them checks that the fix landed. When the same person writes the finding, owns the fix, and signs it off, the after-action review has become a diary.

Review feeds Learn. The findings from an after-action review are the most reliable intelligence a program has about its own vulnerabilities, and they belong in the threat model alongside the external reporting. A drill that showed the compound could not be sealed in under twenty minutes has told the threat analyst which adversary courses of action are viable. A review that found the medical evacuation plan depended on a single aircraft operator has written the next capability requirement.

NIST SP 800-61 Revision 3 describes the older incident response model as a separate team performing post-incident activities that identified needed improvements and fed them into the preparation stage. It then argues that the current state demands more: lessons learned should be shared as soon as they are identified, not delayed until after recovery concludes, and continuous improvement is necessary across every facet of risk management. The protective equivalent is an after-action finding that reaches the country security plan the same week, not at the annual review.

The measure of whether the loop closes is plan currency. Across those four environments, country security plans, site assessments, route risk assessments, and mitigation actions were held at 98% or better currency against fast-changing threat conditions and client requirements. Currency is not a document-control statistic. It is the proportion of the plan that has absorbed what the environment taught since the last exercise.

The failure mode is familiar to anyone who has read an old after-action report. The report is thorough, the findings are sharp, and the corrective actions are listed without owners, without dates, and without a place in the next plan. Two years later the same finding appears in a new report, written by a new team, in slightly different words. The organization has learned nothing and documented everything.

The fix is not a better template. It is the decision, made before the exercise, that the review will end with named owners and dates, that an independent person will verify closure, and that the findings will be written into the threat model and the plan on a stated schedule. An after-action review run that way is the Review phase of protection in its purest form: assess effectiveness, test the controls, feed the findings back, and refine the measures based on what the environment teaches.