postmortem-writing

Focus on system conditions rather than individual actions by asking what allowed the failure instead of who caused it. Include a precise timeline, 5 Whys root cause analysis, impact assessment, and concrete action items with owners and due dates.

A postmortem should include an executive summary, UTC timeline of events, root cause analysis with contributing factors, detection and response review, customer and business impact, lessons learned, and a prioritized action item table.

Write postmortems for SEV1 or SEV2 incidents, customer-facing outages over 15 minutes, data loss or security events, near-misses, and novel failure modes. Start drafting within one to two days while memory is fresh.

Open by restating blameless norms, then walk the timeline chronologically, discuss why the system allowed the failure, and close with prioritized action items. Redirect person-focused comments toward systemic conditions and time-box tangents.

Action items fail when they lack owners, due dates, or tracking in a ticketing system. Assign each item a named owner and deadline, scope tasks to be achievable, and review completion in follow-up meetings.