Guides · 6 min read
Writing a Tabletop Exercise After-Action Report
The after-action report is the only part of the exercise that survives the week. Most are written like meeting minutes and read like them. This is how to write one a board will act on.
Lead with the decision quality, not the timeline
Executives do not need a minute-by-minute replay in the first section. Open with how the team performed against the objective, in three or four sentences, and name the single most consequential gap.
Separate strengths from gaps, and evidence both
- Every strength should cite a decision and a timestamp.
- Every gap should describe the consequence, not the behaviour: "the notification clock had no owner" beats "the team was unclear."
- Avoid grading people. Grade the process.
Recommend alternatives, not corrections
"You should have isolated sooner" closes the conversation. "An alternative would have been to isolate before rebuild, preserving the volatile evidence that later determined scope" teaches something.
The action plan is the deliverable
Unowned recommendations are decoration. If nobody will accept an item, that itself is a finding.
| Recommendation | Owner | Due |
|---|---|---|
| Add a notification-owner field to the first-hour checklist | CISO | 30 days |
| Run and record a restore test on the finance volume | IT Operations | 45 days |
| Draft holding statements approved by Legal | Communications | 30 days |
Include the confidence delta
Ask participants to score their confidence before and after on a five-point scale. The movement is the cleanest evidence of value you will get, and it is the number that renews budget.
Frequently asked questions
- How quickly should the after-action report be delivered?
- Same day if you can. A draft while the room is still assembled turns findings into commitments; a report two weeks later gets skimmed.
- Should the report name individuals?
- Name seats, not people. Findings should survive a personnel change.
Run this exercise in TableTop Sim
The scenario library, the facilitator control room and the after-action report — included in the free trial.