Postmortems

---

name: postmortems description: Deep blameless postmortem workflow—timeline, impact, root cause vs contributing factors, what went well/poorly, action items with owners, and follow-through. Use after incidents, outages, or near-misses to improve reliability culture.

---

Postmortems (Deep Workflow)

A good postmortem learns without blaming individuals. It produces owned actions that reduce recurrence or improve detection—not a generic “we will communicate better.”

When to Offer This Workflow

Trigger conditions:

SEV incidents, customer-visible outages, data loss scares

Near-miss worth documenting (luck prevented impact)

Blame culture risk—need facilitation structure

Initial offer:

Use six stages: (1) scope & audience, (2) timeline & impact, (3) root cause analysis, (4) what worked / didn’t, (5) action items, (6) communication & follow-up). Confirm internal-only vs customer-facing summary.

---

Stage 1: Scope & Audience

Goal: Readers (exec, eng, CS) and sensitivity (PII, security details redacted).

Practices

Blameless framing in invite and template

Exit condition: Template chosen; owner for final doc.

---

Stage 2: Timeline & Impact

Goal: Minute-resolution timeline with UTC; detection vs start vs mitigation vs resolution.

Impact

Users affected, duration, data integrity if relevant, SLA breach

Exit condition: Customer communication aligned with facts here.

---

Stage 3: Root Cause Analysis

Goal: Five whys or fishbone as tool, not ritual—root cause and contributing factors separate.

Practices

Root: fix that stops recurrence class (with evidence)

Contributors: process, missing tests, alert gaps

Exit condition: No single person named as “root cause.”

---

Stage 4: What Worked / Didn’t

Goal: Reinforce good (runbooks, heroes who followed process) and fix bad (missing dashboards).

---

Stage 5: Action Items

Goal: Specific, tracked tickets with owners and dates; types: prevent, detect, recover, process.

Practices

Avoid vague “add monitoring” without metric names

Exit condition: Action items in issue tracker linked.

---

Stage 6: Communication & Follow-Up

Goal: Share summary with org; review completion in 30/60 days.

Practices

External postmortem if customer promise requires

---

Final Review Checklist

[ ] Blameless tone; facts and timeline clear

[ ] Impact quantified where possible

[ ] Root cause and contributing factors distinguished

[ ] Action items owned, dated, and tracked

[ ] Follow-up review scheduled

Tips for Effective Guidance

Severity should match depth of postmortem (lightweight for small incidents).

Link to metrics and traces in appendix for engineers.

Psychological safety enables honesty—leadership must model it.

Handling Deviations

Security incident: coordinate with legal before public detail.

Repeated same failure: escalate to architecture or SLO review.