After Action Report: How to Write One (+ Template)

An after action report is the document that decides whether your drill was practice or just interruption. It records what was supposed to happen, what actually happened, why the two differed – and who fixes what by when. This guide covers the review, the report structure, and a template you can copy today.

Table of Contents

1. What is an after action report?

2. The four questions of an after action review

3. What goes into the report: structure that follows FEMA practice

4. The hot wash: capture observations while memory is fresh

5. After action report template (copy and adapt)

6. Corrective actions: the part that makes the report matter

7. The communication section: the only part you can build on data

8. The bottom line

9. Frequently asked questions

What is an after action report?

An after action report (AAR) is a structured document written after an exercise, drill, or real incident. It records what was expected to happen, what actually happened, why the two differed, which strengths to keep, which gaps to fix – and assigns every fix an owner and a due date.

Three terms get mixed up around this document, and the difference is practical, not academic:

The sequence matters: the hot wash feeds the review, the review feeds the report. Skip the first two and the report becomes a work of fiction written by whoever had time to write it.

The method comes from the US Army, which built the after action review as a routine learning tool, and it has spread far beyond the military: FEMA formalized it for emergency exercises, WHO applies it to public health responses, and business schools teach it as a project-learning practice. For a workplace safety program, the AAR is the step that turns workplace emergency drills into documented improvement instead of a calendar entry.

The four questions of an after action review

Every after action review, from a fire drill debrief to a full-scale exercise evaluation, answers the same four questions:

1. What was expected to happen? The objectives, the plan, the timings you set before the event.
2. What actually happened? The factual timeline, built from observations and records, not impressions.
3. Why was there a difference? Root causes – a missed alert, an unclear role, a blocked stairwell – not blame.
4. What will we sustain, and what will we improve? Strengths worth keeping, gaps worth fixing, each fix with an owner.

The discipline is in question three. A review that stops at “evacuation took eleven minutes instead of eight” has described a symptom. A review that finds out the delay came from the second floor never hearing the start signal has found something you can fix.

What goes into the report: structure that follows FEMA practice

There is no single mandated format for private organizations, but the structure used in FEMA’s continuous improvement guidance is the de facto standard, and for exercises FEMA’s HSEEP methodology pairs the report with an improvement plan – the combination is called an AAR/IP. The working structure:

• Event overview – what was exercised or what happened, when, where, who took part, which objectives were set
• Analysis of objectives – for each objective: met, partially met, or not met, with the evidence
• Strengths – what worked and should be kept, stated specifically enough to repeat
• Areas for improvement – what did not work, with the root cause from question three
• Corrective actions – the fixes: each with an owner, a due date, and a way to verify it happened

For a tabletop exercise the same structure applies with lighter evidence – the discussion notes stand in for the timeline. If you run discussion-based exercises, our guide to tabletop exercise examples covers how to generate the findings an AAR needs.

Length follows the event, not ambition. A routine evacuation drill fits on two pages; a multi-site functional exercise may need ten. A report nobody reads fixes nothing – shorter and finished beats comprehensive and abandoned.

The hot wash: capture observations while memory is fresh

A hot wash is the short, facilitated debrief held immediately after the event – in the assembly area, in the incident room, on the video call – while participants still remember what confused them. Fifteen to thirty minutes is usually enough. It is not the review and not the report: its only job is to capture raw observations before they fade or get rationalized.

A workable hot wash needs three standing questions and a note-taker:

• What did you see or hear first, and was the instruction clear?
• What slowed you down or confused you?
• What would you change before the real thing?

The facilitator’s rule: collect, do not debate. Disagreements about why something happened belong in the review, with evidence on the table. The hot wash notes go into the AAR file the same day, alongside the objective records – delivery logs, alarm timestamps, roll-call sheets.

After action report template (copy and adapt)

This template fits a routine workplace drill or a moderate incident. Delete what your event does not need; keep the corrective actions table no matter what.

Two rules keep the template honest. Every “area for improvement” must produce at least one row in the corrective actions table.

A finding without an action is a complaint.

And every action needs a verification column entry: who will confirm the fix exists, and how.

Corrective actions: the part that makes the report matter

An AAR without owners and due dates is a filing exercise. The corrective actions table is where the document either changes the organization or does not – and it fails in predictable ways:

• Actions assigned to teams, not people. “Facilities will review signage” has no owner. “[Name], facilities manager, replaces the stairwell B signage” does.
• Fixes that restate the finding. “Improve communication” is not an action. “Add the second-floor workshop to the drill notification audience” is.
• No review cadence. Actions that nobody rechecks quietly expire. Put the open-actions list on a standing agenda – safety committee, monthly operations review – until every row is verified closed.

Closed actions feed the next planning cycle: update the emergency plan, the training content, the notification audiences and message templates. That loop – event, findings, fixes, updated plan – is what regulators and insurers mean when they ask whether your program does continuous improvement. The same loop should update your incident response communication plan whenever a communication finding touches roles or escalation paths.

The communication section: the only part you can build on data

Most of an AAR relies on observation: how people moved, whether wardens swept their floors, what the hot wash surfaced. The communication section is different – it can be built entirely on records, and that makes it the most defensible part of the report:

• When the start signal was sent, and through which channels
• When each audience received it, and who acknowledged it
• Who was reached late or not at all – the list that drives the next fix
• When the all-clear went out and how long the full cycle took

If your alerting tool records delivery and acknowledgment, this section writes itself from the logs. DeskAlerts is emergency notification software that timestamps every send, delivery, and acknowledgment – the export becomes the timeline and the evidence for objective analysis, instead of a reconstruction from memory.

The bottom line

The after action report is the cheapest part of a preparedness program and the one that compounds: every drill or incident either leaves behind verified fixes or it leaves behind nothing. Hold the hot wash the same day, run the review against the four questions, write the report while findings are fresh, and keep the corrective actions table alive until every row closes. The template above is enough to start with your next drill.

The rest of the report relies on what people remember; the communication section is the part you can prove.

Frequently asked questions