postmortem-writing

Start with an executive summary of impact, build a minute-by-minute timeline, then analyze root causes by asking why repeatedly. Focus on system conditions rather than individual mistakes, and close with prioritized action items that have owners and due dates.

A postmortem should include an executive summary, incident timeline, root cause analysis, detection and response review, impact assessment, lessons learned, and action items. Supporting data like graphs and links to related incidents strengthen the analysis.

Write postmortems for SEV1 or SEV2 incidents, customer-facing outages over 15 minutes, data loss or security events, and near-misses. Draft within 1-2 days while memory is fresh, hold the review meeting by day 3-5, and finalize within a week.

Structure a 60-minute meeting with an opening that reinforces blameless norms, a timeline walkthrough, analysis discussion focused on system conditions, action item brainstorming with owners, and a closing summary. Redirect blame toward process improvements.

Common mistakes include blaming individuals, stopping at shallow root causes, creating no action items, assigning unrealistic tasks, and skipping follow-up. Always ask why multiple times and track action items in a ticketing system to ensure completion.