business associates reviewing a business continuity plan

Leveraging after action reviews in the midst of a pandemic

Nearly a year and a half ago the world essentially came to a halt as a result of the coronavirus pandemic. For many organizations that meant transitioning operations and employees into a virtual environment and operating model, which brought about tremendous challenges and uncertainty. Some organizations fared better than others with minimal disruption to the delivery of their services or products, while others struggled to adapt.

Organizations that were successful in transitioning to a virtual environment likely had strong business continuity plans (BCP) in place to help them weather the COVID-19 black swan event (i.e., an event that results in severe and widespread consequences). Similarly, the organizations that struggled to adapt have since realized (hopefully!) the importance of having clearly defined processes and plans in place to enable the continuity of their operations (as well as maintaining customer/consumer confidence and brand and reputation, and managing financial risk) both before and throughout a disruption event.

By 2025, 70% of CEOs will mandate a culture of organizational resilience to survive coinciding threats from COVID-19, cybercrime, severe weather events, civil unrest and political instabilities, according to Gartner Predicts 2021: Organizational Resilience.

As the world aims to return to some semblance of pre-pandemic normalcy, organizations must evaluate the strength of their business continuity programs and make the necessary updates or changes based on over a year’s worth of data. One of the best ways to accomplish this is through the use of an after action review (AAR).

Originally developed by the U.S. military, an AAR is a systematic review process for management and process owners responsible for the project or event to:

  • Analyze what happened
  • Examine why it happened
  • Consider how it can be done better

AARs serve as an opportunity to learn from the past year and take actions to be better prepared for the next event. AARs are an integral piece of business continuity planning and enterprise risk management programs. When conducting an AAR, organizations should be assessing and updating plans to address the following areas:


  • Are the essential functions of the organization identified (those that need to be up and running within 24-48 hours to meet the strategic objectives of the organization)?
  • Are recovery processes clearly documented, defined and accessible by all?
  • Do recovery processes identify interdependencies across departments or operating units?
  • Do recovery processes outline communications mechanisms?


  • Have process owners of key functions been adequately identified?
  • Are roles and responsibilities clearly defined?
  • Are back-ups identified in case key personnel are unavailable?
  • Have contingency plans been established in case internal resources are unavailable?
  • Have core skills needed to be successful at the organization been adequately identified and catalogued?


  • Are recovery processes in place to address information technology interruptions to networks, servers, key business applications, desktops and laptops and mobile/handheld devices?
  • Are processes in place to support employees working remotely and virtual operations of the organizations?
  • Have manual workarounds been identified and defined to ensure core operations are supported until service can be restored?
  • Is data stored at a different location (physically or virtually) in case the primary location is destroyed or damaged?

Making targeted investments

Leveraging AARs can help to ensure your investments are targeted and made in the areas that will help the organization moving forward. According to the BCI Horizon Scan Report 2021, nearly 33% of organizations will be investing further into BCP efforts in programs.

Taking the time now to bring key team members together in a virtual environment to walk through how an issue or project was implemented is essential for continued success, but may bring challenges. Looking back at what worked, or didn’t work, could quickly deteriorate into a finger pointing or conflict quickly if not planned and managed properly. One way organizations can productively update their business continuity programs is through disciplined AARs, with the assistance of an external facilitator to help plan and guide the process. The facilitator can encourage a positive and forward looking approach to the process while allowing the team members to step back and objectively reflect on what went well, where and why the challenges occurred, and identify lessons learned and best practices that can be leveraged in the future.

Whether or not we see another globe-shuttering pandemic in our lifetime, disruptive events (e.g., weather, civil unrest, cyber attacks, utility outages) will continue to persist. For organizations to continue to be successful they must:

  • Manage knowledge acquisition
  • Make sure knowledge is accessible and communicated in a timely manner to team members
  • Document BCPs in a detailed yet realistic way
  • Test BCPs to verify effectiveness and agility

For more information on this topic or to speak with a specialist, contact our team.

A 2021 Gartner survey found that “greater focus on building operational resilience” was the top answer when asked for the top risk management areas organizations are likely to prioritize because of the crisis.

Adrienne Larmett
Eric Wunderlich
Team meeting to discuss strategy in a conference room
Next up

Prenuptial agreements and the forensic accountant