Leveraging after action reviews in the midst of a pandemic

Nearly a year and a half ago the world essentially came to a halt as a result of the coronavirus pandemic. For many organizations that meant transitioning operations and employees into a virtual environment and operating model, which brought about tremendous challenges and uncertainty. Some organizations fared better than others with minimal disruption to the delivery of their services or products, while others struggled to adapt.

Organizations that were successful in transitioning to a virtual environment likely had strong business continuity plans (BCP) in place to help them weather the COVID-19 black swan event (i.e., an event that results in severe and widespread consequences). Similarly, the organizations that struggled to adapt have since realized (hopefully!) the importance of having clearly defined processes and plans in place to enable the continuity of their operations (as well as maintaining customer/consumer confidence and brand and reputation, and managing financial risk) both before and throughout a disruption event.

As the world aims to return to some semblance of pre-pandemic normalcy, organizations must evaluate the strength of their business continuity programs and make the necessary updates or changes based on over a year’s worth of data. One of the best ways to accomplish this is through the use of an after action review (AAR).

Originally developed by the U.S. military, an AAR is a systematic review process for management and process owners responsible for the project or event to:

• Analyze what happened
• Examine why it happened
• Consider how it can be done better

AARs serve as an opportunity to learn from the past year and take actions to be better prepared for the next event. AARs are an integral piece of business continuity planning and enterprise risk management programs. When conducting an AAR, organizations should be assessing and updating plans to address the following areas:

Process

• Are the essential functions of the organization identified (those that need to be up and running within 24-48 hours to meet the strategic objectives of the organization)?
• Are recovery processes clearly documented, defined and accessible by all?
• Do recovery processes identify interdependencies across departments or operating units?
• Do recovery processes outline communications mechanisms?

People

• Have process owners of key functions been adequately identified?
• Are roles and responsibilities clearly defined?
• Are back-ups identified in case key personnel are unavailable?
• Have contingency plans been established in case internal resources are unavailable?
• Have core skills needed to be successful at the organization been adequately identified and catalogued?

Technology

• Are recovery processes in place to address information technology interruptions to networks, servers, key business applications, desktops and laptops and mobile/handheld devices?
• Are processes in place to support employees working remotely and virtual operations of the organizations?
• Have manual workarounds been identified and defined to ensure core operations are supported until service can be restored?
• Is data stored at a different location (physically or virtually) in case the primary location is destroyed or damaged?

Taking the time now to bring key team members together in a virtual environment to walk through how an issue or project was implemented is essential for continued success, but may bring challenges. Looking back at what worked, or didn’t work, could quickly deteriorate into a finger pointing or conflict quickly if not planned and managed properly. One way organizations can productively update their business continuity programs is through disciplined AARs, with the assistance of an external facilitator to help plan and guide the process. The facilitator can encourage a positive and forward looking approach to the process while allowing the team members to step back and objectively reflect on what went well, where and why the challenges occurred, and identify lessons learned and best practices that can be leveraged in the future.

Whether or not we see another globe-shuttering pandemic in our lifetime, disruptive events (e.g., weather, civil unrest, cyber attacks, utility outages) will continue to persist. For organizations to continue to be successful they must:

• Manage knowledge acquisition
• Make sure knowledge is accessible and communicated in a timely manner to team members
• Document BCPs in a detailed yet realistic way
• Test BCPs to verify effectiveness and agility

For more information on this topic or to speak with a specialist, contact our team.