Postmortems (Deep Workflow)

A good postmortem learns without blaming individuals. It produces owned actions that reduce recurrence or improve detection—not a generic “we will communicate better.”

When to Offer This Workflow

Trigger conditions:

• - SEV incidents, customer-visible outages, data loss scares
• Near-miss worth documenting (luck prevented impact)
• Blame culture risk—need facilitation structure

Initial offer:

Use six stages: (1) scope & audience, (2) timeline & impact, (3) root cause analysis, (4) what worked / didn’t, (5) action items, (6) communication & follow-up). Confirm internal-only vs customer-facing summary.

Stage 1: Scope & Audience

Goal: Readers (exec, eng, CS) and sensitivity (PII, security details redacted).

Practices

• - Blameless framing in invite and template

Exit condition: Template chosen; owner for final doc.

Stage 2: Timeline & Impact

Goal: Minute-resolution timeline with UTC; detection vs start vs mitigation vs resolution.

Impact

• - Users affected, duration, data integrity if relevant, SLA breach

Exit condition: Customer communication aligned with facts here.

Stage 3: Root Cause Analysis

Goal: Five whys or fishbone as tool, not ritual—root cause and contributing factors separate.

Practices

• - Root: fix that stops recurrence class (with evidence)
• Contributors: process, missing tests, alert gaps

Exit condition: No single person named as “root cause.”

Stage 4: What Worked / Didn’t

Goal: Reinforce good (runbooks, heroes who followed process) and fix bad (missing dashboards).

Stage 5: Action Items

Goal: Specific, tracked tickets with owners and dates; types: prevent, detect, recover, process.

Practices

• - Avoid vague “add monitoring” without metric names

Exit condition: Action items in issue tracker linked.

Stage 6: Communication & Follow-Up

Goal: Share summary with org; review completion in 30/60 days.

Practices

• - External postmortem if customer promise requires

Final Review Checklist

• - [ ] Blameless tone; facts and timeline clear
• [ ] Impact quantified where possible
• [ ] Root cause and contributing factors distinguished
• [ ] Action items owned, dated, and tracked
• [ ] Follow-up review scheduled

Tips for Effective Guidance

• - Severity should match depth of postmortem (lightweight for small incidents).
• Link to metrics and traces in appendix for engineers.
• Psychological safety enables honesty—leadership must model it.

Handling Deviations

• - Security incident: coordinate with legal before public detail.
• Repeated same failure: escalate to architecture or SLO review.