What is an after-action report? Structure, examples, and a downloadable template

After a security incident, emergency event, operational disruption, or workplace safety issue, teams need to understand exactly what happened, how the response unfolded, and what should change moving forward. That’s where an after-action report comes in.

In this guide, we’ll break down what an after-action report is, what a useful after-action report format includes, and how teams can use it to improve future response efforts. You can also download our after-action report template to use with your own team.

What is an after-action report?

An after-action report (AAR) is a structured document that captures what happened during an incident, how the response unfolded, what worked, what didn’t, and what should change as a result. The goal isn’t to place blame, but to gather learnings that help teams improve their response capabilities before the next incident.

The term was first used by the military to extract lessons from operations and is now used in fields where structured learning from security incidents is critical. 

When should you write an after-action report?

AARs are most commonly used following:

• Emergency evacuations or shelter-in-place events
• Security incidents involving unauthorized access, workplace violence, or active threats
• Natural disasters or severe weather events affecting operations
• Cyberattacks or system failures with operational impact
• Major planned events where security or emergency plans were activated
• Tabletop exercises and drills

To the last point, after action reports are valuable after exercises and drills, where you can surface gaps in a controlled environment rather than under real pressure. They’re not just for when things go wrong. 

{{protip-1}}

What makes an after-action report useful?

An after-action report is only effective if teams use it to improve future response efforts and make the next incident easier to manage. A useful AAR has four qualities.

• It’s specific. A useful AAR names exactly what communication failed, when, between whom, and what the consequence was.
• It’s honest. AARs that only document successes don’t improve programs. The most valuable section of any report is the one that describes what didn’t work and why.
• It’s timely. Details fade quickly, and waiting too long after an incident to write a report relies on reconstructed memories. Write it within 72 hours when possible, so the sequence of events is still clear.
• It leads to action. Every issue identified in an AAR should have a clear next step, an owner, and a timeline so the same problems don’t repeat during the next incident.

For multi-site enterprises, AARs should be written at both the site level and the enterprise level when an incident affects multiple locations. A site-level report captures what happened on the ground. An enterprise-level report captures how the coordinated response performed across the portfolio—and where the handoffs between sites, systems, and teams broke down.

{{protip-2}}

What good incident data makes possible

The quality of an after-action report is only as good as the data available to write it.

When an incident occurs, the questions that matter most are: 

• Exactly who was in the building?
• When were they notified?
• What actions were taken and in what sequence? 
• What systems were operational throughout?

When visitor logs are on paper, notification records are in one system, access control data is in another, and employee presence data lives in a third, piecing together an accurate timeline is slow, incomplete, and often relies on people’s recollections rather than system records.

Organizations that have integrated their safety and security infrastructure (visitor management, access control, emergency notifications, and threat monitoring in a connected system) can reconstruct incident timelines accurately and quickly. They can see exactly who was onsite, confirm whether notifications were delivered and acknowledged, and identify precisely where the response broke down rather than approximating it.

With that quality of data, recommendations are more precise, accountability is clearer, and the follow-through is easier to verify. 

{{protip-3}}

—

The outcome is what changes afterward, not the report itself. The best after-action processes turn lessons into actionable steps by assigning owners, tracking follow-through, and using what was learned to strengthen future response and prevention efforts.

Want to learn how Envoy supports integrated emergency response and incident management across multi-site enterprises? Learn more about Envoy for emergency management.