How to run a blameless post-mortem
The short answer
Hold the post-mortem soon after the incident. Build a factual timeline, look for the contributing causes in systems and processes rather than blaming people, and agree a few actions with owners and dates. Write it up, share it widely and check the actions get done.
Step by step
- 1
Meet soon
Within a few days, while details are fresh.
- 2
Build the timeline
What happened when, from logs and the people involved.
- 3
Find contributing causes
Ask how and why, more than who.
- 4
Agree actions
A few that reduce the chance or impact of a repeat, each with an owner.
- 5
Share and follow up
Publish the write-up and track the actions.
Common mistakes
- Looking for someone to blame.
- Stopping at the first cause found.
- Agreeing actions no one tracks.
Acta's incident post-mortem template writes the timeline, causes and actions from the review itself.
Try Acta free for 15 daysQuestions
What does blameless mean?
The review assumes people acted reasonably with what they knew, and looks for system and process fixes.
Who should attend a post-mortem?
The people involved in the incident and response, plus owners of the affected systems.