Glossary
After-action report (AAR)
A written analysis produced after an exercise or incident that documents strengths, areas for improvement, root causes and an improvement plan.
An after-action report (AAR) is the formal written output of an exercise or real incident. It analyses how well objectives and capabilities were met, identifies strengths and areas for improvement, and turns recommendations into an improvement plan with owners and due dates.
In the HSEEP methodology the document is called an After-Action Report/Improvement Plan (AAR/IP). A typical AAR contains an executive summary, an exercise overview, analysis by objective or capability, key findings written as observation, analysis and recommendation, and the improvement plan.
Because an AAR describes weaknesses in incident response, it should be treated as sensitive: classify it, for example with the Traffic Light Protocol, limit distribution and avoid attributing statements to individuals.
The AAR is where an exercise delivers value. Improvement-plan items should be tracked to closure and re-tested in a later exercise. See writing a tabletop after-action report for a template.