What is the purpose of after-action reviews?

An after-action review (AAR) is a structured process for analyzing a past event to improve future performance. Its primary purpose within a Governance, Risk, and Compliance (GRC) framework is to facilitate organizational learning and continuous improvement. By deconstructing an event—whether a success or a failure—the AAR helps identify the root causes and contributing factors. This analysis provides critical insights used to enhance the design and effectiveness of proactive (preventive), detective, and responsive actions and controls, thereby strengthening the overall GRC capability. This aligns directly with the "LEARN" component of the OCEG GRC Capability Model.

A. This describes an incentive or rewards program, which is a motivational tool, not a retrospective analytical process for learning and improvement.

B. This describes a whistleblower or confidential reporting program, which is a specific control to encourage reporting, not the AAR process itself.

D. This describes an incident triage and escalation procedure, which is an initial step in incident management, whereas an AAR is a post-event learning activity.

1. OCEG, "GRC Capability Model 3.0" (The Red Book), 2015.

Section 1: LEARN Component, Element 1.3 "Analyze Root Cause": This section details the process to "Analyze the root cause of undesirable outcomes and the contributing factors for desirable outcomes to improve objectives, strategies, and actions." This is the foundational purpose of an after-action review. The output of this analysis is used to improve controls and processes, as stated in the correct answer.

2. U.S. Army, "Training Circular (TC) 25-20: A Leader's Guide to After-Action Reviews," 1993.

Chapter 1, Page 1-1: Defines an AAR as a "professional discussion of an event, focused on performance standards, that enables soldiers to discover for themselves what happened, why it happened, and how to sustain strengths and improve on weaknesses." This foundational definition, widely adopted in corporate management, directly supports the concept of uncovering causes to improve future actions.

3. Busby, J. S. (1999). "An assessment of the learning from failures in organisations." Journal of Engineering and Technology Management, 16(2), 139-158.

DOI: https://doi.org/10.1016/S0923-4748(99)00004-X00004-X)

This peer-reviewed article discusses how organizations learn from failures. It emphasizes that effective learning involves moving beyond superficial causes to understand systemic root causes to prevent recurrence, which is the core objective of an AAR in a GRC context.