Is it Time for an After-Action Review of your Business Continuity Management Plan?

By Rick Wheeler, Executive Director, Life Cycle Engineering

As I write this article we are in the early stages of economic recovery from the Covid-19 pandemic. Business leaders are asking “What can we do to recover?” and “What can we do to be better prepared in the future?” While the events of the last few months are still fresh in our minds we need to conduct after action reviews.

An after action review (AAR) is a structured review process for analyzing what happened, why it happened, and how it can be done better by the participants and those responsible for the project or event. The lessons learned from the AAR are then incorporated into a Business Continuity Management system.

Business Continuity Management (BCM) is a holistic management process that identifies potential threats to an organization and the impacts to business operations those threats might cause. Based on an organization’s risk profile, mitigation strategies are developed that provide a framework for building organizational resilience with the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand, and value-creating activities

The ISO standard 22301:2109 “Security and resilience — Business continuity management systems — Requirements” addresses the topic. This standard specifies requirements to plan, establish, implement, operate, monitor, review, maintain and continually improve a documented management system to prepare for, respond to, and recover from disruptive events.

There are clear linkages to these activities in the ISO 55000 Asset Management standards. The ability of a company to understand and control the risks of not providing its service and meeting the stakeholder expectations is the central requirement of this standard.

Both of these standards outline expectations for developing a risk-based plan that documents your ability to meet the stakeholder requirements, to monitor and test that plan, and to have a continuous improvement in place to improve the robustness of the plan.   

In a recent article published by McKinsey titled “Managing a manufacturing plant through the coronavirus crisis,” authors Vivek Furtado, Tom Kolaja, Curt Mueller, and Julian Salguero outline three focus areas for plant leaders moving from the initial crisis response stage to establishing what the authors refer to as the “next normal”: protect the workforce, manage risks to ensure business continuity, and drive productivity at a distance.

Part of moving from the crisis response stage to planning for the future is defining how a company will manage risks to ensure business continuity. In many cases companies were forced to innovate on the fly as the fast-moving pandemic forced business to change literally overnight. An AAR will capture those practices and provide an opportunity to evaluate them, improve them, and codify them into the asset management / business continuity management system so those hard-earned lessons learned will not have to be relearned.

AARs are focused on four questions:

• What was expected to happen?
• What actually occurred?
• What went well and why?
• What can be improved and how?

When conducted most effectively, AARs include three elements: advanced planning, a facilitator who is not a member of the team, and a report which captures lessons learned and actions that will be taken. Planning logistics include who will facilitate the review, who will participate, how the meeting will occur, and who will document the discussions.  

An AAR is typically facilitated by a neutral party with experience in leading AARs. An experienced facilitator will prepare for the meeting with gaining an overview of the scope of the project or event being reviewed. They can help recommend which teams and individuals should be included in the review and determine a schedule for getting appropriate and honest input from all involved. Professional facilitation can yield a full picture of what went well and why, as well as what can be improved and how. The resulting report will document the findings as well as summarize actionable recommendations for improving how a company functions in the future.

LCE has experience with facilitating AARs and a deep understanding of best practices in risk-based asset management. If we can help you with an after action review and incorporating what you have learned into your business continuity management plan, please contact us at info@LCE.com. We are ready to help you recover and plan for a resilient future.