Incident Post-Mortem Checklist

A post-mortem has one job: make the next incident less likely, or less expensive. Everything that does not serve that — assigning fault, performing thoroughness, producing a document nobody reads — is overhead.

This checklist is five steps because a post-mortem that takes half a day will not be run for a medium-sized incident, and medium-sized incidents are where most of the learning is.

It is deliberately blameless. Not out of politeness: teams that attribute incidents to individuals get fewer reported incidents, not fewer incidents.

Write the timeline before the analysis

Reconstruct what happened and when, from logs and messages rather than memory, before anyone proposes a cause. Memory reorganises itself around whatever explanation is offered first, and once a plausible story exists the timeline gets read to confirm it.

Include detection time explicitly. The gap between when something broke and when anyone noticed is often the most actionable number in the whole document, and it disappears if you only record when the fix shipped.

Root cause is usually a chain, not a thing

The honest answer is rarely one item. A bad deploy went out because a test did not cover that path, because that path was added under time pressure, because the deadline was set without the work being scoped.

Stop when you reach something you can actually change. Following the chain to "the company should plan better" produces an insight nobody can act on, which is the same as no insight.

Separate the fix from the prevention

These are two different steps on the list because they have completely different lifetimes. The immediate fix is already done — it is what ended the incident. The preventive action has not happened yet, and will not unless someone owns it with a date.

A post-mortem whose action items have no owner is a document, not a process. If the item is not worth assigning, it is not worth writing down.

Sharing is what compounds

The team involved learns from the incident whether or not it is written up. The value of the document is entirely in reaching people who were not there — which means it has to be readable by them, and it has to actually be sent.

This is also the step that makes blamelessness real rather than stated. People write honest timelines when they expect the document to be read charitably, and defensive ones when they don't.