What a finished after-action report looks like, sheet by sheet

What it is

A complete after-action report from a 3-hour facilitated tabletop exercise, written out in full and set for print. It runs to seven sheets and covers all eight sections of the report, in the order the published report skeleton sets out. Nothing is summarised or left as a heading.

It is illustrative, not redacted client work. No client took part and no firm is described. The first sheet says so in a box before the summary, so nobody can read it as somebody else's engagement. What is real is the structure: the section order, the way a finding is written, the severity labels, the recommendation table and the exact attestation wording are what we deliver. The firm in it is a composite, built to be ordinary. An Ontario law firm of 140 people, a core system somebody else hosts, a leadership team that has never rehearsed together, and an incident response plan written by a person who has since left.

The exercise behind it is a ransomware and data exfiltration scenario reaching the firm through a hosted document management vendor, delivered in five timed injects to nine people over 3 hours, with the report issued 15 days later. That is the same shape as a real engagement.

What is inside

The seven sheets of the sample after-action report, and what is on each

Sheet	Sections	What is on it
1	Cover, and section 1, summary	The engagement in four lines, then the finding that organises the rest of the report. A box at the top says in plain terms that this is an illustrative sample and that no client took part.
2	Sections 2 and 3, scope and participants	What was exercised and against what, the documents reviewed beforehand, what was explicitly out of scope, and the nine people in the room listed by role against what the plan names them as.
3	Sections 4 and 5, decisions and what worked	What the room decided at each point of the exercise, and three things it did well. The strengths are in the report on purpose, and the sheet says why.
4	Section 6, findings and gaps	Five findings, three high, one medium, one low, each written as what happened rather than what was missing. The severity scale is defined on the sheet before the first finding, in the impact vocabulary of the federal incident handling guide rather than one of our own invention.
5	Section 7, recommendations	Six recommendations grouped as technical, operational and strategic, each with an owning role, a target date and an effort estimate. We set the owner and the date. The sheet says why, and says that we do not soften a recommendation when asked.
6	Section 8, attestation of exercise	The facilitator’s signed statement of fact: the date, the hours, the number of participants, the scenario, the independence declaration, and the block it is signed in. Below it, what an attestation is and what it is not.
7	Appendix, what this report evidences	Seven things a renewal application or a customer security questionnaire asks about incident response testing, each mapped to the section that answers it, so a broker can attach one document instead of writing a covering note.

The five findings are worth naming, because they are what a reader is really looking for. No out-of-hours authority to commit funds. An incident response plan that lives inside the system the scenario removes. No breach counsel, and a conflict nobody resolved. Two executives instructing the outside world separately and neither telling the other. Insurer notification raised once and never returned to. Two of the five are about authority rather than technology, and none of the six recommendations needs new software or new headcount.

When to use it, and when it is the wrong thing to reach for

Reach for it when somebody has asked you to produce evidence that your incident response plan has been tested and you do not yet know what that evidence looks like. It is the fastest way to find out what you are being asked for. It is equally useful in the other direction: if a provider has quoted you for an exercise, this is a fair thing to hold their proposed deliverable against.

It is the wrong thing to reach for if you want to run an exercise. This is the output, not the method. The three-hour agenda and report skeleton is the one that tells you how to run the session, and it is on this site in full with nothing to fill in.

One thing it is not. It is not the Extended Exercise Record, which is a separate document with a separate price and is never published. The extended version adds a decision timeline with a clock time against every entry, framework mapping across the scenario and the recommendations, and a gap analysis comparing what the plan said against what the room actually did. Those three things need a scribe in the room and analyst hours afterwards, which is why they are not in the report that ships with every engagement. If a regulator, an auditor or a claims reviewer is your reader rather than an underwriter, that is the conversation to have on a call.

Why it is not on this page in full

Most of what we publish is on the site to be read and quoted, and this one is not. The sample is the whole of the deliverable a paid engagement produces, from the summary through to the attestation page, so we send it to somebody who asks for it by name rather than posting the finished article. One email address is all it takes and the file is on the next page, not in your inbox.

The one section that is genuinely ours is section 8. Everything else in the report you could write yourself: you can build the scenario, run the three hours and draft every finding. An attestation is a signed statement of fact by the person who was in the room, and it is worth something for exactly one reason, which is that the person signing it is not on your payroll. It is not a certification. It does not say your firm is secure and it does not approve your plan. Anybody offering a tabletop that certifies your security posture is selling something that does not exist.