The After-Action Review for Protective Details

An after-action review is a short, structured conversation held after a movement that establishes what was supposed to happen, what actually happened, and what the team will do differently. For a small detail it is the cheapest capability improvement available, and the one most consistently skipped.

Why it gets skipped

The movement ends. Everyone is tired, the principal is secure, the vehicles need fuel, and the next tasking is already sitting in somebody's phone. Nothing broke, so the reasoning goes, there is nothing to discuss.

That reasoning is exactly why teams repeat the same friction for years. Big failures get talked about whether anyone schedules a conversation or not. The small stuff does not: a drop point that puts the principal in the open for nine seconds longer than it needs to, a comms dead spot in a parking structure, a venue contact who never answered a phone call in three visits, a load plan that puts the medical bag in the wrong vehicle. None of it caused an incident. All of it will still be there next quarter, because nobody ever said it out loud in a room where somebody could write it down.

The purpose of the review is to convert experience into something the team can reuse. Without it, the only thing a detail accumulates is mileage.

The four questions

Keep it doctrinally standard. The sequence is the same one used across the military and emergency services, and there is no reason to invent a local version.

1. What was planned? State it briefly: the intent, the scheme of movement, the timeline, the contingencies as briefed.
2. What actually happened? Walk the movement in sequence. Facts, times, positions. Not interpretations yet.
3. Why was there a difference? Traffic, a venue change, a late principal, a decision someone made in the moment, a piece of information that arrived after the plan was set.
4. What do we sustain, and what do we change?

The fourth question is the only one that produces value. The first three exist to make the fourth honest. Skip straight to "what should we do differently" and you get opinions, defensiveness, and whoever talks loudest. Build the shared picture first and the changes tend to name themselves.

Fifteen minutes, standing up, same day

Length is a discipline. Fifteen minutes, on your feet, at the vehicles or in a back hallway, before the team scatters. If it needs an hour, either something significant happened or the conversation has drifted into war stories.

Timing matters more than most teams believe. Specifics are the entire product of an AAR, and specifics degrade fast. Ask on Friday about a Tuesday movement and you get themes: "comms were spotty." Ask forty minutes after the movement and you get "we lost the net at the northwest ramp on the second sublevel, both times." One of those is actionable. The other is a feeling.

When the day runs long and people are past useful, do not force it. Capture voice notes at the vehicle while the details are still sharp, then hold the conversation in the morning with those notes as the starting point. That is a real fallback, not a failure.

The culture part, which is the hard part

An AAR works only if the lead's own decisions are on the table. If the findings are consistently about junior people, the team learns quickly that this is a performance review with a different name, and contributions dry up. Once that happens the format is dead, and it is difficult to revive.

The practical move is simple: the lead names their own miss first. "I held us at the curb ninety seconds longer than I needed to because I was waiting on a confirmation I could have gotten in advance." That single sentence does more for the quality of the next twelve reviews than any set of ground rules read aloud.

Two supporting habits:

• No blame framing. Focus on the decision and the information available at the time, not on the outcome. A reasonable call made with incomplete information that turned out badly is a collection problem or a planning problem, not a judgment failure.
• Everyone talks. The follow vehicle and the advance element see things the detail lead never sees. If only the two most senior people speak, the review is capturing about a third of the movement.

Ask for the near misses explicitly

The highest-value input is the thing that almost went wrong. It is also the least likely to surface on its own, precisely because nothing happened: no incident, no report, no obvious reason to bring it up, and a mild social cost to raising something that turned out fine.

So ask for it by name, every time, as its own question. What almost bit us? The gap you closed by improvising. The door you found locked. The person who got closer than anyone was comfortable with. The follow vehicle that nearly missed the turn. These are the leading indicators of the incident you have not had yet, and they cost nothing to collect.

What to capture, and where it goes

Three buckets, kept short:

• Sustains. What worked and should be repeated. There will be fewer of these than people expect, and that is fine.
• Changes. What the team will do differently, stated concretely enough to act on.
• Open items. Anything that needs work outside the room, each with a name and a date attached. An open item without an owner is a wish.

Then the part that actually determines whether the AAR was worth holding: the durable findings go back into the products that will be reused. Venue and route files. The trauma destination line and the crisis-location list. The comms plan and the PACE. The concern file. The standing advance checklist. A review whose output lives only in the memory of the people who attended is a conversation, not a process, and it degrades to nothing in about three weeks.

Where the value compounds

Recurring venues and recurring routes are where this pays. Most protective work is repetitive: the same residence, the same office, the same three hotels, the same handful of routes between them. The fifth time you work a venue should be visibly better than the first, and it only will be if somebody wrote down what the first four taught. Loading dock access. The freight elevator that requires a badge after 1800. The security director who actually returns calls. The intersection that backs up at school dismissal.

That accumulated file is also what makes a compressed timeline survivable. It feeds the security advance directly, it gives your wargaming real friction points instead of hypotheticals, and it is most of what you have to work with on off-the-record movements, where planning time is minimal by design.

What not to do

Do not let it run an hour. Do not hold it in front of the principal, the client, or anyone the team will not speak freely around. Do not relitigate a judgment call that was reasonable with the information available at the time; the lesson there is about information, not about the person who made the call. And do not let it become a place where the team congratulates itself. A review that produces only sustains is a review nobody is being candid in.

Make it yours

This is one way to do it, not the only way. Some teams run the four questions cold. Some assign a rotating facilitator so the lead can participate as a participant. Some add a two-minute medical and comms check at the end because those are the two things that hurt most when they are wrong. Take the structure, adapt the mechanics to how your team actually operates, and hold the fifteen-minute ceiling.

One boundary is worth keeping firm: the executing team runs its own review. An outside reviewer can add a useful perspective, particularly after a significant event, but the people who ran the movement own the process and own the findings. The moment the AAR belongs to someone else, it stops being a tool the team uses and becomes something done to them.