How to Conduct an Emergency After-Action Review
The after-action review is where an event becomes an improvement. Skip it, and the next response starts from the same place this one did.
The after-action review (AAR) is the mechanism that turns a single incident or exercise into organizational learning. The format traces to U.S. military doctrine and has been adopted by FEMA under its Homeland Security Exercise and Evaluation Program (HSEEP), by healthcare and aviation safety programs, and by most mature emergency management functions. The details vary; the shape is consistent. Reconstruct what happened. Compare it to what was supposed to happen. Identify the gaps. Assign owners.
The Improvement Cycle
Assemble data - timelines, delivery reports, message logs, decisions, participant notes. Distribute an agenda before the session.
Build a shared timeline of the event, from first indication through all-clear, using facts before interpretation.
Ask the four AAR questions: What was supposed to happen? What actually happened? What worked, and why? What could be improved?
Turn every finding into a corrective action with an owner, due date, and retest requirement.
Verify closure in a subsequent exercise or activation. Findings without retest tend to reopen quietly.
The blameless rule
Findings describe systems, procedures, tools, and training - not people. When individuals need coaching, that happens outside the AAR, through the normal management chain. Mixing the two produces defensive answers and unusable findings.
What Data to Collect
The quality of the review depends on the quality of the reconstruction. Pull data before opinions.
- Alert activation. Who activated, at what time, from where, using which template.
- Message approval. Which approvals were required, which were obtained, and how long each took.
- Message delivery. Per-channel delivery rates and any bounces, retries, or fallbacks used.
- Employee acknowledgement. Per-recipient acknowledgement inside the response window, by group and by channel.
- Supervisor escalation. Non-responder counts and how they were resolved.
- Employee feedback. Direct input from a sample of recipients, gathered within days rather than weeks.
- Operational impact. Downtime, missed shifts, injuries, property or environmental impact, and cost where known.
Running the Session
Ninety minutes is often enough for a single-incident AAR. Longer for multi-site or multi-day events. Use a facilitator who was not the incident commander, and a note-taker separate from the facilitator. Start by walking the timeline in silence - no interpretations - then open discussion module by module. End with an explicit list of top-priority findings and named owners.
Sample Facilitator Prompts
- "Walk us through the first 15 minutes as you experienced them."
- "At what point did you first feel unsure what to do next?"
- "Which parts of the plan did you actually use? Which parts did you not?"
- "Where did the message go that you didn't expect, or fail to go where you did?"
- "If you re-ran this incident tomorrow, what one change would matter most?"
Sample Corrective-Action Tracker
| Finding | Impact | Corrective action | Owner | Due date | Status | Retest required |
|---|---|---|---|---|---|---|
| Shelter-in-place template lacked muster-cancel language, causing 12 employees to leave the interior room early | Life safety | Revise template; add explicit "remain in place until all-clear received" | Communications Lead | 30 days | Open | Next tabletop |
| 18% of night-shift recipients did not receive SMS within the 5-minute window | Coverage | Audit night-shift contact data; enable voice fallback for critical templates | HR Lead + IT Lead | 45 days | Open | Notification test |
| Backup incident commander was unreachable during shift change | Command | Publish revised on-call roster; add shift-change confirmation to on-call handoff | Operations Director | 14 days | In progress | Next drill |
| Contractor accountability at Site 2 was ad-hoc; two subcontractors were not accounted for at muster | Accountability | Deploy host-of-record procedure and daily contractor roster at Site 2 | Facilities Lead | 60 days | Open | Site audit |
Illustrative example only - findings, impacts, owners, and dates must reflect your organization's real review.
Leadership Review and Plan Update
Publish the after-action report to executive sponsors, safety committee, and the ERT. Update the emergency communication plan and template library within the corrective-action due dates. A finding that changes a template is only closed when the new template is in the live library and the previous version is archived.
AAR Checklist
- Data pulled before opinions - timelines, delivery, acknowledgement, decisions
- Facilitator and note-taker separate from the incident commander
- Session scheduled within one to two weeks of the event
- Blameless framing communicated at the start of the session
- Findings written against systems, plans, and training - not individuals
- Each finding has an owner, due date, and retest requirement
- Corrective actions tracked in a single visible register
- Plan and template updates land in the live system before close
- Follow-up exercise scheduled to verify closure
- Executive readout completed and archived
How Safeguard Signal Fits
An honest reconstruction depends on honest data. Safeguard Signal's delivery analytics produce a per-recipient record of who was messaged, on which channel, at what time, with what acknowledgement, and how long each escalation step took. Exporting that report becomes the factual backbone of the review - freeing the discussion to focus on decisions, plans, and gaps rather than arguing about what actually happened.
Related Guides
- How to Build an Emergency Communication Plan
- How to Create an Emergency Response Team
- How to Conduct an Emergency Tabletop Exercise
- How to Write Effective Emergency Notification Templates
- Hurricane Response
- Manufacturing Emergency Communication
Authoritative Sources
- FEMA - Homeland Security Exercise and Evaluation Program (HSEEP), After-Action Report / Improvement Plan (fema.gov/hseep)
- FEMA Emergency Management Institute - After-Action Review guidance and courses (training.fema.gov)
- U.S. Army - A Leader's Guide to After-Action Reviews (public doctrine; the modern AAR format originates here)
- CDC - After-Action Review guidance for public health emergency response (cdc.gov)
- Ready.gov - Program Review and Improvement (ready.gov/business)
Frequently Asked Questions
What is an after-action review?
A structured discussion held after an incident or exercise that reconstructs what happened, evaluates what went well and what did not, and produces specific corrective actions with owners and due dates.
When should we conduct one?
For every real activation and every exercise. A short hot-wash immediately after, and a longer structured review within one to two weeks while memories and data are fresh.
Who should attend?
Everyone with a role in the response, plus at least one observer who was not directly involved. Executive sponsors receive the report but do not usually attend the working session.
Is it a blame exercise?
No. Effective after-action reviews are blameless. Findings focus on plans, procedures, systems, and training - not on individuals. Blame produces defensive answers; blamelessness produces accurate ones.
How do we make sure findings actually get fixed?
Assign each corrective action an owner, due date, and retest requirement. Track them in a single visible register and review status on a defined cadence.
Do small incidents need a full review?
Not always a full report, but at minimum a short hot-wash with anything worth remembering captured in a running log. Patterns across small incidents often reveal larger gaps.