Spot the difference: The “Lesson Learned Report” and the “After Action Review” and why it matters today (30 October 2024)

Summary

In this LinkedIn blog, Judy Walker outlines four ways that After Action Reviews (AARs) differ from more informal 'Lessons Learned' events, and how AARs can result in more effective learning. She also highlights four topics that organisations affected by recent cyberattacks can explore in AARs:

1. Leadership and co-ordination - Large cyber-attacks demand that robust command and control structures are switched on, to respond to the initial chaos that inevitably ensues when disasters strike. Large incidents also involve a multitude of agencies, each of which must direct its own resources and co-ordinate with each other.
2. Communications. Systems of command, control, and coordination are predicated on being able to communicate efficiently and requires that people are willing to share information with each other.
3. Planning - Gaps in emergency plans cause serious problems when disaster strikes and weaknesses in plans often go unnoticed because actual plans are not trained fully or exercised realistically.
4. Resilience – AARs should always address what supportive behaviours, processes and structures enabled efficient and effective response and recovery so that these can be repeated and strengthened as required.