Postmortem for Beginners: Blameless Incident Review Board, from Timeline to Fixes

Project & Development

Postmortem for Beginners: Blameless Incident Review Board, from Timeline to Fixes

Postmortem for beginners: a blameless incident review board for dev and ops teams, to use within a week after an outage ends. Page 1 confirms the no-blame promises, summarizes the incident, and assigns who brings which evidence; page 2 lines up six timeline steps and writes the impact in numbers; page 3 digs into system causes with 5 Whys and rates fixes by impact and effort; page 4 turns fixes into tasks with owners and due dates and sets the sharing date. The task board has five columns - gathering evidence, in discussion, fixes in progress, checking results, and done - and starts with 4 parent tasks and 12 subtasks. To write the report, copy ②–④ as the summary, ⑦ as the impact, ⑫ as the root cause, ⑰ as the lessons, and ⑭ as the prevention plan. Because the board looks at systems rather than people, the discussion is less likely to turn into blame, and you can write it together with your private team.

0 Likes 0 Copies Author: WeProcess
postmortem incident response blameless review 5 Whys prevent recurrence
Other language versions
Sign up free and use this template

Once you have a free account, you can copy this template from the marketplace

Whiteboard preview

Preview mode Postmortem for Beginners: Blameless Incident Review Board, from Timeline to Fixes
Sign up free and use this template

Whiteboard preview

① Review Promises (start here and rea... ② What happened ③ From when to when ④ Trigger (as far as known) ⑤ Evidence and who brings it (by the ... ⑥ Timeline in time order (line up the... ⑦ Size of the impact (write facts and... ⑧ Still unknown (keep it apart instea... ⑨ What went well (from the timeline ⑥) ⑩ What went badly (from ⑥) ⑪ Where we were lucky (from ⑥) ⑬ Choosing fixes (place fixes that wo... High impact × high effort High impact × low effort Low impact × high effort Low impact × low effort ⑭ Prevention tasks (from the fixes ch... ⑮ Who to share the review with ⑯ Sharing date and how ⑰ Lessons (copy straight into the rep... ⑱ What to check at the next review Postmortem for Be... How to use (4 pag... Decisions and fixes Rules and owners Incident and what... Insights and what... 1/4 Set up a blameles... Ctrl+F / ⌘F : 2/4... → 2/4 2/4 Line up events by... ↙ 3/4 Look at systems, not peopleAsk "why was it easy to get wrong"instead of "who got it wrong" Every decision had a reasonDo not blame with hindsight.e.g. Think with what was visible at the time Separate fact from guessAdd the word "guess" to a guess.e.g. guess: a settings change may be the cause e.g. The order page stopped loading e.g. Customers could not place orders Write the symptoms exactly as seen Leave the cause for now (dig into it on page 3) e.g. Started Oct 6, 14:05 e.g. Ended Oct 6, 15:20 e.g. It is working normally now Check times in the records and use the 24-hour clock e.g. A screen update went live at 14:00 e.g. guess: a setting value was left stale Write "unknown" for what you do not know Add the word "guess" to a guess Evidence to collect Who brings it Due System logs e.g. error logs and traffic graphs Owner: ____ e.g. the day before the review Message history e.g. chat threads and phone notes Owner: ____ e.g. the day before the review Customer feedback e.g. number and content of inquiries Owner: ____ e.g. the day before the review Onset 14:05What happenede.g. The order page stopped loading Detection 14:20Who noticed, and howe.g. The support desk noticed from inquiries Notice 14:30Who was told, and howe.g. Posted in the dev team chat Response 14:40What was donee.g. Started rolling back the 14:00 update Recovery 15:20When it was back to normale.g. The order page opened again Confirmed 16:00How it was confirmede.g. Order counts returned to normal In numbers Record that confi... Certainty People affected e.g. about 120 people could not order e.g. access logs e.g. guess (checking how we counted) Time down e.g. 75 minutes (14:05–15:20) e.g. error logs e.g. fact Inquiries e.g. 8 inquiries e.g. the list of inquiries e.g. fact Work stopped e.g. shipping prep delayed by 1 hour e.g. message from the warehouse e.g. fact What we do not knowe.g. Why no alert arrived between 14:05 and 14:20 Who looks into it, and by whenOwner: ____ / Due: __/__ Where to add it once knowne.g. Add it to the timeline ⑥ and the table ⑦ 3/4 Find the system c... → 4/4 4/4 Assign the follow... e.g. The support desk told the dev team right away e.g. The rollback steps were in the runbook Write why we can act the same way next time e.g. The order page broke after the update e.g. It took 15 minutes to notice Make the event the subject, not a person e.g. It was a quiet time for customers e.g. An expert happened to be at their desk We cannot count on luck, so make it a candidate fix ⑫ 5 Whys: pick on... Why 1 e.g. Why did it stop loading? → A setting value was left stale Why 2 e.g. Why was it stale? → It was not tested in a test environment before release Why 3 e.g. Why was it not tested? → The test step was not in the runbook Why 4 e.g. Why was it missing? → Nobody owns updating the runbook Why 5 e.g. Why does nobody own it? → There is no rule to update the runbook when steps change Root cause e.g. Changing steps and updating the runbook are not connected (a system cause) 縦軸: Impact (top =... Plan it and move ahead in stages. e.g. Build an automatic check before release Do this first. e.g. Add "test before release" to the runbook Skip it this time. Write down why and keep the record Do it when convenient. e.g. Update the contact list What Who By when How to check Fix 1 e.g. Add "test before release" to the runbook Owner: ____ e.g. in 1 week e.g. Check the next release follows the steps Fix 2 e.g. Make a rule to update the runbook when steps change Owner: ____ e.g. in 2 weeks e.g. Read the rule through together as a team Fix 3 e.g. Send an alert when errors increase Owner: ____ e.g. in 2 weeks e.g. Cause a test error and watch the alert arrive Fix 4 e.g. Build an automatic check before release Owner: ____ e.g. in 1 month e.g. Count the problems the check stopped e.g. The support team e.g. Your manager and related departments e.g. Other teams using the same system e.g. 10 minutes at the Oct 10 weekly meeting e.g. Share the report in chat Date: __/__ / Owner: ____ e.g. A test step before release gets skipped unless it is in the runbook e.g. When the support desk reports fast, recovery is fast Write lessons about systems, not people Date to checke.g. the weekly meeting in 1 monthDate: __/__ Numbers to checke.g. How many fixes in ⑭ are donee.g. Has the same incident happened again Who checksOwner: ____Add the result to ⑭ on this board → 2/4 Line up events by... ↙ 3/4 Find the system c... → 4/4 Assign the follow...
100%

Drag to move, scroll to zoom

Task board contents

Gathering evidence 16 items

Set blameless rules
Build the timeline
Find system causes
Assign the fixes
Read rules together
Write the summary
Assign evidence
Fill the 6 steps
Quantify the impact
Separate unknowns
List wins and gaps
Stack five whys
Choose fixes
Make fix tasks
Plan the sharing
Plan the follow-up

In discussion 0 items

Fixes in progress 0 items

Checking results 0 items

Done 0 items

Related templates

← Back to templates