The crisis team has stopped meeting. People are back to their usual work, and the urgent messages are thinning out. What remains is to understand what actually happened.
A meeting gets booked. Everyone turns up with their notes. A few weeks later, a document lists the difficulties encountered and the measures under consideration. Senior management signs it off.
Nothing wrong with any of that. It needs doing. But one question is still on the table: if the same situation happened tomorrow, would we handle it better?
That is the question a lessons-learned review has to answer. A good report is welcome. What really counts is what the organisation can do afterwards: spot trouble earlier, decide without dithering, pass on information people can use, keep a vital activity running, or admit sooner that a strategy is not working.
A post-crisis review is therefore a piece of transformation work. It comes with the demands, and the difficulties, that this implies.
First trap: judging yesterday with what we know today
Once the crisis is over, some warning signs look so obvious it is almost embarrassing. Why did nobody see it? Why wait? Why that option?
These are fair questions. They become misleading when they assume people knew at the time what we have only learned since.
A fictional example
An IT manager notices several anomalies. An attack? A technical fault? He cannot tell. Shutting the systems down would limit a possible compromise, but it could also halt a critical activity for nothing. He calls his service provider, asks for checks, and holds off on the shutdown.
If the attack is later confirmed, the delay will look indefensible. Yet to understand it, you have to rebuild what he knew, what he was missing, what he feared and what he actually had the authority to decide.
Research on debriefing describes this trap well: once you know how the story ends, you overestimate how predictable it was and you oversimplify the explanations. A 2024 article in Advances in Simulation looks specifically at how this hindsight bias affects the analysis of behaviour (PMC: https://pmc.ncbi.nlm.nih.gov/articles/PMC11656545/).
In practice: before judging a decision, reconstruct what the person had in front of them.
For each key moment, the review should help you answer a few questions:
- What information had actually reached them?
- How much did they trust it?
- What options did they think they had?
- What risks did they see in each one?
- Which constraint weighed most heavily on their choice?
This does not erase mistakes. It lets you fix what really caused them.
One timeline, many different experiences
In a crisis, nobody sees the whole picture.
Senior management is watching business continuity. Operational teams are trying to keep a site running. Communications is fielding outside enquiries. Customer service hears the first worries building. A supplier sometimes spots a problem long before head office does.
These experiences do not always fit neatly together.
A message can be sent and never arrive, arrive and not be understood, be understood and still be impossible to act on. An instruction that seems crystal clear to the person writing it can be read three different ways at the other end.
The job is to document these gaps. Merging them too quickly into a single version means losing what they reveal about how the organisation really works.
One simple method is to keep three things apart (fictional example):
- The verifiable record: an email asking for an activity to be stopped was sent at 2:12 pm.
- The reported experience: the site manager says he first saw it at 2:47 pm.
- The explanation to test: the channel used was rarely checked while teams were busy on the ground.
The third point remains a hypothesis until it has been checked against other data.
This discipline stops a plausible explanation from hardening too quickly into established fact. It also leaves room for uncertainty: some times will stay approximate, some exchanges will never be confirmed. A serious review can say so.
Open discussion is proven by how people react
The facilitator can invite everyone to speak freely. That alone will not reassure the room.
An employee hesitates to contradict their manager. A contractor is thinking about their contract. A manager plays down a problem to protect their team.
Research on psychological safety in debriefings shows that it depends on context, relationships and how the discussion is run. It is fragile, and you cannot simply declare it at the start of a meeting. This research comes mainly from healthcare simulation, so it needs adapting for a business review (PMC: https://pmc.ncbi.nlm.nih.gov/articles/PMC8936758/).
A few precautions make a real difference to the quality of the discussion:
- gather individual accounts before the group discussion;
- let the people who faced the difficulties speak first, before management comments;
- ask managers to hold back their explanations when a problem is raised;
- have sensitive discussions run by someone sufficiently independent;
- be clear about how accounts will be used, who will read the report and where confidentiality ends.
Everything hinges on the first disagreement. If leadership brushes a comment aside or makes fun of it, people quickly learn what is best kept to themselves.
On the other hand, asking for detail and then going to check shows that the organisation is willing to look at what challenges its own version of events.
Individual error is where the analysis starts, not where it ends
"The procedure was not followed."
That may well be true. But it does not tell you much.
Could people get to it once the usual tools went down? Did the stand-in on duty that day know it existed? Did it fit the situation? Did applying it require an approval that was impossible to obtain?
The same goes for the usual suspects: poor communication, weak coordination, insufficient training. These findings point to where you should dig. On their own, they rarely explain what happened.
You need to look at how people, tools, rules, resources and trade-offs interact. For example: insisting that alerts be escalated quickly while regularly criticising teams for bothering management with minor incidents. Adding another instruction will not resolve that contradiction.
Accountability does not disappear. If the event calls for an investigation or disciplinary action, make clear how that process relates to the review. Presenting a session as a learning exercise and quietly using it to build a case destroys trust and degrades everything you collect afterwards.
The World Health Organization's framework for after-action reviews takes the same line. It focuses on collective improvement and offers several formats, including individual interviews and workshops, rather than the same meeting for every situation (who.int: https://www.who.int/publications/i/item/WHO-WHE-CPI-2019.4).
Understand what held up, too
Analysing the difficulties should not erase what went well. But you still need to look at what lies behind those successes.
Was the activity kept going thanks to the planned arrangements, or because an employee called on their personal network? Did the alert get through via the official system, or because someone rang colleagues from their own mobile? Was the deadline met at the cost of an effort nobody could sustain?
The distinction matters. A good outcome can hide a dependence on two or three people, or an expenditure of energy that cannot be repeated.
The review should identify the good practices worth keeping, and the conditions that made them work. A workaround sometimes deserves a place in the official arrangements. Sometimes it mainly exposes a weakness to fix.
One question helps you dig deeper: would we have achieved the same result with a different team, fewer people, or a crisis that dragged on?
A recommendation has to change something specific
An action plan can keep growing without the core capabilities really moving.
"Strengthen coordination" or "improve information flow": the intention is clear. To act on it, you have to say which problem you are solving and what result you expect.
A few possible rewrites:
- Improve alerting: test a backup channel with the functions the crisis team cannot do without, then count the acknowledgements.
- Clarify roles: list the decisions a manager can take when their superior is absent, then test that delegation in an exercise.
- Make information more reliable: use a situation update that separates what is confirmed, what still needs checking and the decisions required.
- Prepare better: train post holders and their stand-ins on the difficulties actually encountered during the event.
Every action needs an owner, a deadline, resources and a criterion for checking that it works.
FEMA's HSEEP programme formalises this logic: what is observed in exercises should lead to concrete, measurable corrective actions, tracked in an improvement plan (fema.gov: https://preptoolkit.fema.gov/web/hseep-resources/improvement-planning).
You also have to choose. Fixing a handful of major weaknesses straight away often delivers more than opening dozens of workstreams without the resources to match. To prioritise, look at the expected effect, the exposure to risk and the dependencies between actions.
A completed action still has to prove itself
A revised procedure is a deliverable. Seeing it applied correctly under pressure is a result.
In between, you still need to make sure the people concerned know about the change, can get to it and know how to apply it when things are degraded.
Exercises let you check this without waiting for the next incident. FEMA explicitly recommends using them to assess the actions that come out of reviews, if necessary across several exercises to judge their effect over time (Preparedness Toolkit: https://preptoolkit.fema.gov/web/cip-citap/ncig/-/knowledge_base/ncig/2-2-4-3-assessing-recommended-actions-through-exercises).
There is no need to think big. If the problem was alerting, there is no point tying up the whole company for a day. A short exercise is enough to test activation, message receipt, the mobilisation of stand-ins and the first decisions.
Do avoid replaying a scene everyone knows by heart, though. To test an improvement properly, change one constraint: a manager who is absent, a tool that is unavailable, an initial report that is ambiguous.
Set your observation criteria before the test, for example:
- how long it takes to mobilise the functions you need;
- the ability to spot information that has not been confirmed;
- a decision taken explicitly, despite the uncertainty;
- the ability to work without the main tool;
- the quality of the handover between two teams.
A successful test proves something under the conditions tested. It does not guarantee you will master every future crisis.
Run the review as a tracked process
The method should stay proportionate to the event. A limited incident can be reviewed quickly. A long crisis involving several functions and partners calls for more in-depth work.
A workable approach has five steps:
- Keep the useful records: gather the crisis log, messages, decisions and documents, in line with the applicable rules.
- Collect people's experiences: interview those involved, including people who stayed on the edge of the crisis team.
- Analyse the decisive moments: compare the information available, the constraints and the possible explanations.
- Choose the improvements: select actions that are achievable and give them the resources they need.
- Check their effects: observe practice, run targeted tests and review the results.
A quick hot debrief saves observations that fade fast. A later, colder analysis lets you compare them with fuller data. Keep in mind how tired and available the teams are: being close to the event is no reason to force an in-depth analysis on people who are still badly shaken.
The guide published by the ECDC in March 2026 structures reviews around preparation, conducting the analysis and follow-up. It also covers reviews carried out while the response is still under way, so that adjustments can be made before the event ends. It was designed for public health emergencies, but its overall structure is a useful reference for other sectors (ecdc.europa.eu: https://www.ecdc.europa.eu/en/publications-data/guide-designing-and-conducting-action-and-after-action-reviews).
Change has to outlast the people involved
An organisation can have staff who learned a great deal during a crisis and still be vulnerable as soon as they move on.
For the experience to benefit the organisation over time, the lessons have to reach stand-ins, new joiners, the partners concerned and future decision-makers. They need to find their way into training, tools, delegations and exercises.
This is also where leadership commitment becomes visible: time given to testing, a budget for a backup solution, an outdated rule finally revised, a difficulty raised from the field taken seriously.
A few months after the review, the most useful question is a very concrete one:
What have we changed, and what evidence do we have that it works better?
The answer may be modest: an alert that finally gets through, a relief team able to take over running operations, a decision that no longer depends on one indispensable person. It is these observable gains that give the post-crisis work its value.
From review to test
A useful next step: take the action plan from your last review and, for each measure, write down how you will know it works. The ones without a criterion are the first to put to the test.
The Exerce-Ease platform lets you build short, targeted exercises to check these improvements, observe decisions and prepare your next review.
Discover the platform: https://www.exerce-ease.com/en/plateforme.php