An after-action review (AAR) is a structured conversation, held soon after an event, that compares what you planned with what actually happened and decides what to do differently next time. The format is simple. What separates a review that changes behavior from one that produces a forgotten document is who is in the room, how honest the discussion is, and whether anyone owns the follow-up.
This guide walks through the four questions, the steps from preparation to follow-up, what belongs in the written report, and the mistakes we see leaders make when the pressure of a crisis is still fresh.
TL;DR
- An AAR asks four plain questions: what was planned, what happened, why it happened, and what you will do next time.
- Keep it about what went wrong, not who. Blame ends honest discussion within minutes.
- Spend about half the session on next steps, then put owners and deadlines on every corrective action.
- The written report should rest on validated findings and tie each recommendation to an action someone is accountable for.
- A review only counts when its lessons reach your plans, policies, procedures and training.
Table of Contents
- What an After-Action Review Is, and Where It Came From
- Why Crisis Teams Need One
- The Four Questions
- How to Run an After-Action Review, Step by Step
- Passing the Baton: Why Reviews Fail
- What Goes in the Report
- Turning Lessons into Change
- Where We Come In
- Our Perspective
- FAQ
- Sources
What an After-Action Review Is, and Where It Came From
The U.S. Army developed the AAR in the 1970s to help soldiers learn from both their mistakes and their achievements. Since then it has moved well beyond the military. Firefighters, public health agencies, hospitals, schools and corporate teams all use some version of it.
Definitions differ slightly in wording but agree on substance. FEMA's 2023 After-Action Review User Guide describes an AAR as a process for organizations or teams to assess performance and learn from data-supported findings about what happened, why it happened, and its effects. The World Health Organization frames it as a qualitative review of actions taken during an event, project or intervention, meant to identify and document best practices and challenges.
Notice what both leave out: a verdict. The point is learning, not judgment.
Other names you will hear
People search for this under several labels: after-action report, post-incident review, post-crisis evaluation, retrospective, lessons learned. They overlap heavily. The Asian Development Bank treats AARs and retrospects as conceptually linked, differing mainly in degree of detail and formality, and both aim to turn knowledge into action. That separates them from audits, which are often evaluative or built for accountability.
A practical way to hold the terms: the review is the conversation, and the report is the record of it. A post-crisis evaluation is usually the review done at larger scale, with more data and more voices.
Why Crisis Teams Need One
A crisis compresses decisions into hours. People improvise, and some of the improvisation is brilliant. Some of it is a mistake that will repeat. Without a review, both fade into memory, and memory is kind to the people who hold it.
The WHO lists several objectives for the exercise: reviewing actions at each phase of an event, identifying what worked and why, demonstrating preparedness and response capacity, identifying corrective actions to institutionalize lessons, and addressing the challenges the event revealed. Notice the second item. Reviews are not only about failure. Knowing why something worked is what lets you do it again on purpose.
In our experience, the organizations that come through a second crisis better than the first are rarely the ones with the thickest binder. They are the ones that sat down honestly after the first one.
The Four Questions
The core of any AAR is four questions. The wording varies by source, but the logic holds. The National Wildfire Coordinating Group puts them this way: What was planned? What actually happened? Why did it happen? What are we going to do next time?
A guide based on U.S. Department of Veterans Affairs material phrases them slightly differently: What did we expect to happen? What actually happened? What went well and why? What can be improved and how?
Question one: what was planned?
Start with intent. Many teams skip this, and it is where the most useful discoveries hide. If three executives describe three different plans, you have already found a problem, and it was not the crisis that caused it.
The NASA Pause and Learn guide offers a helpful discipline here: divide the event into discrete activities, each with its own identifiable objective and plan, and review what was supposed to happen for each one. A crisis is rarely one event. It is a chain of smaller ones: the first alert, the internal escalation, the holding statement, the media response, the employee message. Review them link by link.
Question two: what actually happened?
Build a timeline from records, not recollection. Pull emails, call logs, social posts, press inquiries and drafts. Then ask participants to fill gaps. The goal is a shared, factual account that nobody disputes before you move on to cause.
Question three: why did it happen?
This is the analytic heart of the review. Ask "why" more than once. A late statement might trace to a slow approval chain, which traces to unclear authority, which traces to a plan that never named a decision-maker. NWCG advises keeping the causal discussion on what rather than who, correcting weaknesses the group can actually fix, and sustaining strengths so that good practices get repeated.
Question four: what will we do next time?
This is where the value lives. NWCG's facilitation principle is to spend roughly half the review on what to do next time. If your session ends with a thorough autopsy and ten minutes of vague resolve, you have run a history class, not a review.
How to Run an After-Action Review, Step by Step
There is no single required format. A quick team huddle after a product announcement can follow the four questions in twenty minutes. A major crisis calls for something more formal. For larger efforts, FEMA's sequence is a useful backbone: scope and launch the project, plan and collect data, analyze the data, develop observations, have subject-matter experts review them, develop AAR products, and complete organizational and leadership reviews.
Here is how that translates for a corporation or nonprofit facing a reputational crisis.
Scope it before the emotions cool
Decide what event the review covers, which period it spans, and what decisions it will inform. Name a facilitator who did not run the response, or at least who can step back from it. Schedule it while memories are fresh, but not in the first hours, when people are exhausted and defensive.
Collect the data
Gather the timeline materials mentioned above, plus media coverage, social sentiment, stakeholder inquiries and any internal messages. If the crisis involved legal exposure, loop in counsel early about what the review will record and how it will be handled. That conversation belongs at the start, not after the notes are written.
Set ground rules in the room
The Veterans Affairs-based guide recommends full participation, equal value for everyone's views, no blame, openness to new ideas, creative solutions, and consensus where possible. It also assigns a note taker and a timekeeper. Those two roles sound trivial. They are what keep a review from drifting into either a venting session or a monologue by the most senior person present.
The WHO's emergency-review guidance stresses that an AAR is a constructive, collective learning opportunity, not an external evaluation of an individual's or team's performance. Say that out loud at the start. If the CEO speaks last, people will say more.
Walk the four questions
Move through the timeline, activity by activity. Capture successes along with how to ensure they happen again, and capture improvements along with specific recommendations. Resist the urge to solve every problem live. Log it, assign it, move on.
Validate the findings
FEMA's process has subject-matter experts review observations before products are finalized, and its guidance says the products should rest on validated, data-supported findings. In a corporate setting, this means checking draft conclusions against the record and with the people closest to the work. A finding that cannot survive that check does not belong in the report.
Write, review and close the loop
Produce the report, route it through leadership, and assign each corrective action an owner and a date. We come back to that below.
Passing the Baton: Why Reviews Fail
I often describe a crisis response as a relay race. Each function, whether legal, communications, operations or the executive team, carries the baton for a leg and hands it on. Most failures I have seen were not slow runners. They were bad handoffs. The statement was drafted well and approved late. The facts were right in the war room and wrong on the front desk.
An AAR is where you study the handoffs. And it fails in predictable ways.
The first is blame. Once someone feels they are on trial, the facts get softer. The second is rank: the most senior voice shapes the story before anyone else speaks. The third is the one-time review, held with enthusiasm, filed with relief, and never opened again. The fourth, and the most common, is findings with no owners. "Improve internal communication" is a wish. "The chief of staff will publish an escalation contact tree by the end of next quarter and test it in a drill" is a commitment.
What Goes in the Report
A reader searching for how to write an after-action report, or for a post-incident review template, usually wants a structure. There is no universal standard, but a report that does its job tends to cover the same ground.
Open with a short summary of the event, the scope of the review, and who took part. Follow with the timeline of what happened, then a comparison against what was planned. Next come the findings: strengths to sustain, and areas to improve, each with the cause identified. Close with recommendations, and attach to each one an owner, a deadline and a way to confirm it was done.
The VA-based template mirrors this shape by recording successes with ways to ensure future success, and improvements with recommendations. FEMA adds that the choice of products, whether a full report, a short summary or a briefing, should depend on when and how each is useful. A board may need two pages. The operations team may need twenty.
A quick illustration
Imagine a regional healthcare group whose patient-data incident reached local news before the leadership team had agreed on a statement. The planned response called for a holding statement within two hours. In fact it took nine. The review finds the approval path required sign-off from three people, and one was traveling. The cause is not carelessness. It is a plan that named approvers but no backups.
The corrective action is concrete: name deputies for each approver, pre-clear holding statement templates by incident type, and run a tabletop exercise within ninety days. The strength worth sustaining might be that the frontline staff followed the call script exactly. Both go in the report. (This example is illustrative, not a description of a specific client.)
Turning Lessons into Change
The WHO recommends institutionalizing lessons learned, and emergency-management guidance specifically points to incorporating them into emergency plans, policies, procedures and training. That is the test of a review. If the crisis plan, the spokesperson training and the approval chain look the same after the AAR as before it, the review did not happen in any way that matters.
Three habits help. Put a standing item on the leadership agenda to track open corrective actions until each is closed. Fold lessons into the next training cycle so new people inherit them. And revisit the original crisis plan within weeks, while the details still sting. If you are building out the preventive side of this work, our guide on reputation risk mitigation covers how leaders can spot exposure before it becomes an event.
Where We Come In
Many organizations can run a review. Fewer can run an honest one about their own response while still under scrutiny. We support leaders through the whole arc, from crisis readiness assessments and tailored communication plans before an event, to real-time response during it, to the reputation recovery work afterward. Our team can facilitate a post-crisis review with the independence an internal group often lacks, and turn the findings into updated plans and training.
If you are in the middle of a crisis, or want your next one to go differently, explore our crisis management and communications services and talk with us about what a review could look like for your organization.
Our Perspective
After more than 30 years in this work, we have noticed that organizations rarely lack intelligence. They lack a safe, structured moment to say what really happened. The AAR creates that moment, and the leader's behavior in it sets the tone for everything after.
We would offer one suggestion. Treat the review as the first act of rebuilding trust, not the last act of the crisis. Stakeholders forgive mistakes more readily when they see credible action follow, and the fixes that come from a candid review are credible action. A quiet change to an approval chain will never make a headline. It may be the reason the next headline never runs.
Preparation and response are not separate disciplines. The review is where one feeds the other, and where a painful episode becomes an asset.
— Mark
FAQ
What are the four steps of an AAR?
The commonly used sequence is the four questions: what was planned, what actually happened, why it happened, and what you will do next time. Some guides word them as what you expected, what occurred, what went well and why, and what can be improved and how. Either way, you move from intent to facts to cause to action.
How soon after a crisis should we hold the review?
Soon enough that memories and records are fresh, but not while people are still exhausted or the event is still unfolding. For a fast-moving incident, a short initial huddle can capture immediate observations, with a fuller review once the response settles. Check with legal counsel first if the matter involves potential litigation.
What is the difference between an after-action review and a post-crisis evaluation?
The terms overlap. An AAR is typically a facilitated discussion focused on learning, while an evaluation may be broader, more formal and more data-heavy. Both are different from an audit, which is usually built for accountability rather than learning.
Who should attend?
The people closest to the work, plus a facilitator who can stay neutral and a note taker. Include voices from each leg of the response, such as communications, legal, operations and frontline staff. Senior leaders should listen first and speak last.
What should an after-action report include?
A summary of the event and scope, a timeline, a comparison of plan against reality, findings on strengths and weaknesses with causes, and recommendations with owners and deadlines. Base conclusions on validated evidence and match the length of the report to its audience.
Sources
- After-Action Reviews: A Simple Yet Powerful Tool, Wharton Executive Education
- After Action Review, World Health Organization
- After-Action Review User Guide, FEMA, November 2023
- Conducting After-Action Reviews and Retrospects, Asian Development Bank
- After Action Reviews, NWCG
- AAR Guidelines, based on U.S. Department of Veterans Affairs material
- After Action Review (Pause and Learn), NASA