Mega2580.Solutions
July 2023

What a good incident postmortem actually looks like

By D. Reyes · 5 min read

"Blameless postmortem" gets used as a synonym for "we won't ask hard questions," and that's a misreading. Blameless means the person who pushed the change isn't the focus. The system that let that change reach production without being caught is the focus, and that deserves real scrutiny.

The structure we use: a factual timeline first, agreed on before anyone discusses causes. Then contributing factors, plural — almost no real incident has a single root cause, and treating it like it does just means you fix one of three things. Then specific, owned action items with dates, not vague commitments to "improve monitoring."

The test of a good postmortem: could someone outside the incident read it in six months and understand exactly what happened and why, without having to ask anyone. If not, it's not done yet.