AmalfiCORE Blog

Avoid Editorial Opinion in Your AAR

When an After Action Report is developed it should be based on facts observed and discovered during the exercise. Sometimes, editorials and opinions make their way into the feedback and documented findings that are used to create the AAR. These reports should never be altered and should be retained as originally submitted. However, not every opinion needs to be nor should be included in the official AAR.

This is especially true when it is discovered that many issues raised are tied to a particular senior person in the organization. If these issues are brought out in the exercise injects, debrief, and written evaluations, then it is up to the facilitator who is developing the AAR to determine how best to manage this situation.

I have found that there is either very good reasons for the comments or that the comments are complete bunk, as in the case where the senior person is disliked or has taken a hard stand and individuals have used the exercise as an opportunity to ‘get back’.

In the former case, when there is some merit to the raised issues, I believe a one-on-one direct conversation with the senior person is appropriate. The discussion should be honest and the data should be shared. Often times a seasoned professional will very aptly manage the feedback and may go public directly and ask for help in making things better. The opposite could also happen and that could be a ‘career limiting move’ on the part of the exercise facilitator.

In the end, the person responsible for the AAR must present a fact-based set of lessons learned that are focused on the objectives and not any one individual. The collective organization owns the responsibility to make improvements and that should be the focus of the follow up.

Which BCP Standard for Your Company?

When considering which standard the BCP program at your company should be based on some look to these for consideration:

1. ASIS SPC.1-2009, National Standard: Organizational Resilience Standard.
2. DRII Professional Practices for Business Continuity Planners.
3. NFPA 1600.

Since BSI has not been offered for this discussion point, I believe that NFPA 1600 has the most viability for the municipality organization. This is not simply because of the nature of emergency management in the public sector, but also because NFPA 1600 offers the widest interpretation of guidelines while still ensuring that there is some strictness in implementation (opinion).

Annex C of the NFPA 1600 provides a very useful rubric which can be used immediately, simply, and at a high level to determine the current status of an organization. [1] This self assessment for conformity can be used to identify key weaknesses and help begin a program management process that focuses on those areas in most need of improvement.

With the extremely tight budgets these days and a slow to recover economy, cities and counties are simply not able to implement the full array of guideline adherence typically found in the 10 professional practices of  DRII.

While the ASIS standard does specify threats and hazards assessment and can be very helpful to the private sector, it focuses a great deal on topic areas not particularly useful to a public sector entity, particularly a small town under 100,000 population.

[1] NFPA (Dec 2009). “NFPA 1600 Standard on Disaster/Emergency Management and Business Continuity Programs 2010 Edition. Annex C Self Assessment for Conformity with NFPA 1600, 2010 Edition“. Retrieved 1-29-11: http://www.nfpa.org/assets/files/PDF/NFPA16002010.pdf

Maintaining BC Plans

The primary issue to consider regarding business continuity plan maintenance begins with early involvement of a team of representatives from each key department or function. Early on in the process, particularly for a Continuity of Operations Plan-COOP, public sector functions throughout the city need to understand that ongoing updates and maintenance are essential to the viability of the COOP.

I’ve accomplished this mind set by introducing awareness concepts for maintenance before beginning the COOP program. I scheduled a maintenance event for immediately following completion of the first program. This essentially provided a practice for testing our system of data backup and retrieval and loading new data items such as staffing and changing responsibilities.

Once that initial mind set is in motion as described above, we turn our attention to three key issues for how to actually perform plan maintenance successfully.

1. Central

By using a software application, each department is responsible for keeping their own section of the COOP updated in real time. This common format is very useful for supporting consistency. If a BC program manager is assigned then that person can manage a central review of the software program. This is the approach we took. However, for those companies who don’t use a software application, it may be necessary to collect hard copies or Word documents with updates. In this case, (unlike the lecture from Ms Phelps) I would require a similar format and have a central folder within a designated and protected directory which is backed up regularly. Thus, a paper (or electronic) trail is established the provides a means to validate that the plan is current.

2. Consistent

In order to ensure that the plan is consistent, the BC manager must set clear expectations. The goal is to ensure that the maintenance of the plan(s) is performed in a manner that makes it an accountable, and repeatable requirement. It should be an easy to use tool and it should be easy to submit changes.

3. Clearly Defined Responsibilities

Identify the people in each function responsible for updating the plan and representing the teams during meetings, practices, and training.

The BC manager can publish a schedule, issue reminders to review updates, and institute a mandatory return receipt policy that acknowledges that those who needed to receive direction and provide input have in fact received such notice.

Maintaining and storing plans must occur according to a specific set of guidelines. Some of the pitfalls of maintaining plans is keeping them up to date, storing them and backing up the data, and if there are multiple copies for redundancy then updating all the copies can be tedious, time consuming and costly.

To ensure successful plan maintenance:

§  Identify roles and responsibilities

§  Identify which plans are to be maintained by whom and by when

§  Use an easy software application or method

§  Make remedies clear improvements can be tracked readily

Some hold the position that it’s best not to hire vendors or third parties to maintain a plan. However in my experience, it can be helpful to have an independent external person assist the BC manager or designated person responsible for maintenance. Oddly, people may respond better sometimes to a third-party than their own colleagues.

Manage “Stonewalling” During and Exercise

An actual disaster exercise can be quite dynamic. Just because the exercise design team planned the event down to the most finite detail does not mean that the event will go exactly as planned.

People make judgments based on ever changing information and data in real life and will do the same during a disaster exercise. Sometimes that can lead to participants taking short cuts to solve problems. For example, they may stonewall and buy time, respond to injects [1] with responses like “We’ve already fixed that”, “The situation wasn’t that bad”, or “We called the vendor and got what we needed”. If it’s clear that those responses are not possible, then it’s important for the exercise facilitator [2] to help get the exercise back on track.

In advance of the exercise, here are some ways to help prevent or reduce stonewalling:

§  Pre-arrange with the Simulation team [3] to check-in periodically to ensure things are going smoothly.

§  At exercise briefing, remind participants of ground rules and expectations to reinforce how the injects should be handled.

§  Be clear that issues cannot be resolved by waving away the problem with words, but only by making that phone call and actually resolving the situation.

§  Make injects realistic, valid and believable to help improve the likelihood that participants follow through on tasks and don’t shortcut the actions.

During the exercise, here are some ways to help prevent or reduce stonewalling:

§  Instruct evaluators [4] and observers [5] to listen as they watch for how key injects are being handled. They can inform the facilitator if tasks are being ignored or glossed over.

§  The Simulation team can use status boards to keep track of how injects are moving along and make corrections proactively by sending out new information to get the teams back on track.

§  The facilitator should roam, listen and observe the activity, even for table top exercises. If the facilitator hears something that might throw the team off or that the team has misconstrued a message, then the simulation team can be alerted with a suggested response to manage the course correction in the exercise flow.

Remember that the ultimate exercise goal is LEARNING! We want the participants to act and make decisions in a way that meets the exercise objectives, builds personal and team confidence, and helps assess our readiness to handle the real disaster. Everyone involved should do what it takes to reach these goals.

[1] Inject: During the course of an exercise, an inject is data or information provided to participants that must be acted on or considered as new to the scenario.

[2] Facilitator: Conducts and directs the exercise event and is ultimately responsible for its success.

[3] Simulation Team: A person or group of people who help conduct an exercise and who act as the outside world, offer and confirm information and direct the participants through the exercise.

[4] Evaluators: To assess the key injects and actions taken relative to the stated exercise objectives.

[5] Observers: Watch and listen to learn the exercise progress in order to learn or provide general feedback to the facilitator and design team.

Giving the Exercise Plan Out Too Soon

In general, it is not a good idea to give out the disaster exercise plan to the participants in advance of the event.

I can think of one situation when it would be OK to do so: If the narrative is of a broad regional basis and the exercise clock is several days into it, for example 3+ days plus.  It would be a disadvantage and deemed unfair by many to expect the participants to understand what has already taken place and pretend to account for those variables in their next steps in the exercise.

A good example is an earthquake which may produce wide, broad damage. If the exercise time stamp starting point is 72 hours post quake they would have been working on it for 3 days. It’s simply unfair to drop the participants into the scenario. They. they need time to think about it. A good solution is to offer information only 24 hours in advance by email. This gives participants some opportunity to think about it before exercise without tainting the objectives to be evaluated.

The primary reason that giving out the exercise plan in advance is a bad idea is that when provided too far in advance, the participants will begin to think through and create corrections to the injects. This results in much less of a learning experience and defeats the purpose of the simulated pressure of the event.

The exercise facilitator could and should provide the appropriate training for participants. When the event draws close, an email notification can go out and include generic information to help focus everyone on their roles and responsibilities. Also, it can include reinforcement of how the event will unfold and better prepare the participants for the exercise without actually giving away the story line of the narrative.