By Matt Pasquinilli
A school security after-action review should end with a clear record of what happened, what needs to improve, who owns each correction, and how the school will verify that the correction works. Completing a drill is only the beginning.
In A drill is not finished when the alarm stops, I described the need to close the gap between identifying a problem and correcting it. This guide turns that principle into a practical meeting agenda and a copyable action record.
What is a school security after-action review?
An after-action review is a structured discussion of an exercise or incident. The written after-action report preserves the findings. The improvement plan turns those findings into assigned work. A useful review records successful practices as well as weaknesses, so the school knows what to keep doing.
The U.S. Department of Education’s REMS after-action report fact sheet identifies an event overview, analysis, and recommendations as core components. Recommendations include responsible people, necessary resources, and expected completion dates. Use that guidance alongside your school’s approved emergency operations plan and local requirements.
1. Start with the objective and the evidence
Before asking whether a drill went well, state what it was meant to test. An objective might concern staff recognition of an alert, student accountability, or coordination between designated team members. A single exercise does not test every part of a security program.
- What response or capability was being evaluated?
- Which groups and parts of the campus participated?
- What did observers actually see or hear?
- Which conclusions are supported by records, and which still need checking?
Separate observations from assumptions. “The notification did not reach one participating group” is a starting point for investigation. “Nobody pays attention” is a judgment that does not identify a repair.
2. Use a short, focused review agenda
Gather the people who can explain the event and carry out improvements. Include relevant school staff and community partners without sharing sensitive information more widely than necessary.
- Reconstruct: summarize the sequence of events and correct factual disagreements.
- Recognize: identify practices that worked and should be reinforced.
- Examine: compare expected actions with observed actions.
- Assign: give each improvement a responsible owner and a realistic deadline.
- Verify: agree on the evidence required before an item can be closed.
Ask where the process became difficult. Were instructions unclear? Was the correct information unavailable? Did an equipment problem interfere? Did the plan account for the people who were present? Several causes may contribute to the same observation.
3. Copy this corrective action template
Create one record per finding in your school’s approved tracking system. Keeping findings separate prevents a broad item such as “improve communications” from hiding several unfinished tasks.
- Finding ID: a unique reference for follow-up.
- Objective: what the exercise was intended to demonstrate.
- Observation: a factual description and supporting evidence.
- Cause to confirm: what needs investigation before choosing a fix.
- Corrective action: a specific change that addresses the finding.
- Owner: the person accountable for coordinating completion.
- Support and resources: people, training, equipment, or approvals needed.
- Target date: when the work should be ready for review.
- Verification: the check that will demonstrate the intended result.
- Status and reviewer: open, in progress, ready to verify, or closed; include the review date.
4. Make “done” observable
Consider this fictional example: a participating staff group did not receive an exercise notification. Sending another reminder may not address the cause. The assigned owner first checks whether the issue involved the contact list, the delivery method, or the procedure.
The corrective action could then be an updated contact process and a controlled follow-up check with that group. The closure evidence would record whether the intended recipients received and understood the test message. This is an illustration of the process, not a report about any particular school.
A purchase order, revised document, or completed training session may be an important milestone. It is not always evidence that the original problem has been resolved. Define the verification step when assigning the work.
5. Keep leadership involved until closure
Review open findings at a regular leadership meeting. Escalate overdue work and resource decisions to the person with authority to resolve them. If the same issue returns during another exercise, reopen the earlier finding and examine why the correction did not hold.
Share appropriate lessons with the people who need to change their practice. Keep student information, campus vulnerabilities, and operational details in approved internal channels. A public summary can explain that improvements are being made without exposing the underlying security plan.
Before you close the review
- Can someone who missed the meeting understand each finding?
- Does every action have an owner and a target date?
- Is there a defined check for completion?
- Have relevant procedures and training materials been updated?
- Will leadership see unresolved items again?
The value of a review is the improvement it produces. For the broader operating framework, read School Security Readiness: Why Technology Cannot Replace Disciplined Daily Operations.
About the author: Matt Pasquinilli writes about school security, preparedness, martial arts, and self-defense. Learn more about Matt or contact him with a question about these resources.