What Is an After-Action Report (AAR)?

An after-action report (AAR) is a structured document produced after an exercise or incident that captures what happened, what worked, what failed, and what actions must be taken to improve future response. It is the mechanism that turns an exercise from a conversation into an improvement program.

See How Opsbook Works → ← Back to Glossary

Key Elements of an After-Action Report

A concise summary of the scenario, date, participants, and scope
A timeline of key decisions, escalation points, and response actions
Clear documentation of what worked well and should be preserved
Clear documentation of what failed, stalled, or created risk
Assigned action items with owners, deadlines, and verification criteria

Why AARs Matter for Security and Resilience Leaders

The most common failure mode in resilience programs is not the exercise itself — it is what happens afterward. Teams leave with good intentions, but without a structured AAR process, findings evaporate and the same issues resurface in the next incident.

AARs close that loop. They create a formal record of required improvements and make it possible to prove that response capability is getting better over time.

For regulated organizations, that matters not just operationally, but from an audit and governance perspective as well.

After-Action Reports and Regulatory Requirements

DORA requires financial entities to maintain records of resilience testing and document the outcomes, including improvement actions and their status. NIS2 similarly pushes organizations toward demonstrable continuous improvement in incident response capability.

That is no longer just about showing that an exercise took place. Organizations increasingly need to show what they learned, what they changed, and how those changes were tracked.

See how AARs apply in practice: Financial Services · Healthcare

How Opsbook Helps with AARs

Opsbook automatically generates AARs at the end of every exercise, capturing the scenario, participant decisions, role performance, and identified gaps in real time.

Action items are assigned owners and deadlines within the platform, and playbook updates can be triggered directly from findings. That makes the AAR a living operational artifact instead of a static PDF no one revisits.

See How Opsbook Works →

Frequently Asked Questions

Who is responsible for writing the after-action report?

The exercise facilitator usually drafts it with participant input. In more mature programs, the facilitator still reviews it, but automated tooling can capture most of the structure during the exercise itself.

How long after an exercise should the AAR be completed?

Within 48–72 hours is best practice. The longer the delay, the more likely details will be lost and action items will become vague.

What is the difference between a hot wash and an after-action report?

A hot wash is the immediate verbal debrief. The AAR is the formal written record that structures those observations and turns them into tracked improvements.

What should be included in an AAR action item?

At minimum: what must change, who owns it, when it is due, and how the organization will verify that the change actually solved the problem.

Related Terms

Ready to put after-action reporting into practice?

Capture findings, assign fixes, and make improvement visible after every exercise.

Book a Demo →