An after-action review (AAR) is a structured process used by organizations to evaluate what happened, why it happened, and how it can be improved. AARs are conducted after favorable or unfavorable events to uncover root causes and enhance future actions and controls.

Key Purposes of After-Action Reviews:

Root Cause Analysis:

AARs identify the underlying factors contributing to both successful and unsuccessful outcomes.

Example: Analyzing the root cause of a cybersecurity breach or the success of a new product launch.

Improvement of Controls:

Insights gained during the review are used to strengthen proactive, detective, and responsive controls, ensuring the organization is better prepared for future events.

Continuous Learning:

AARs promote a culture of continuous improvement by learning from past experiences.

Example: Adjusting training programs based on lessons learned from an incident.

Feedback Loop:

Findings are shared with relevant teams to create actionable recommendations and adjustments to policies, processes, and controls.

Why Option C is Correct:

After-action reviews are conducted to uncover root causes and improve proactive, detective, and responsive actions and controls, ensuring the organization learns from past events to enhance its future performance.

Why the Other Options Are Incorrect:

A. Disclosure of unfavorable events: While disclosure decisions may be informed by findings from an AAR, this is not its primary purpose.

B. Providing incentives: AARs focus on learning and improvement, not on employee incentives.

D. Establishing a tiered response: While AARs may inform response plans, their primary focus is root cause analysis and improvement.

References and Resources:

ISO 31000:2018 – Discusses learning from events to improve risk management practices.

COSO ERM Framework – Highlights the role of after-action reviews in refining controls and processes.

NIST Cybersecurity Framework (CSF) – Recommends post-incident analysis to strengthen organizational resilience.