retro

# Postmortems A good postmortem **learns** without blaming individuals. It produces **owned actions** that reduce recurrence or improve detection—not generic “communicate better” platitudes. ## When to Offer This Workflow **Trigger conditions:** - SEV incidents, customer-visible outages, data-loss scares - Near-misses worth documenting - Need facilitation structure in a blame-prone culture **Initial offer:** Use **six stages**: (1) scope & audience, (2) timeline & impact, (3) root cause analysis, (4) what worked / didn’t, (5) action items, (6) communication & follow-up). Confirm internal-only vs customer-facing summary. --- ## Stage 1: Scope & Audience **Goal:** Define readers (exec, engineering, CS) and redact PII or sensitive security details. ### Practices - Blameless framing in the invite and template **Exit condition:** Template chosen; owner for the final document. --- ## Stage 2: Timeline & Impact **Goal:** Minute-resolution timeline in UTC: detection → onset → mitigation → resolution. ### Impact - Users affected, duration, data integrity if relevant, SLA breach **Exit condition:** Facts align with any external customer communication. --- ## Stage 3: Root Cause Analysis **Goal:** Use five whys or fishbone as tools, not rituals. Separate **root cause** (fix that stops the class of failure) from **contributing factors** (process gaps, missing tests). ### Practices - Do not name an individual as the “root cause” **Exit condition:** Evidence-backed causal chain; contributing factors listed. --- ## Stage 4: What Worked / Didn’t **Goal:** Reinforce positives (runbooks followed, clear comms) and negatives (missing dashboards, slow escalation). --- ## Stage 5: Action Items **Goal:** Specific tickets with owners and dates; categorize prevent / detect / recover / process. ### Practices - Avoid vague “add monitoring”—name metrics or signals **Exit condition:** Items linked in the issue tracker. --- ## Stage 6: Communication & Follow-Up **Goal:** Share summary internally; external postmortem only when policy requires; track completion in 30/60 days. --- ## Final Review Checklist - [ ] Blameless tone; timeline and facts accurate - [ ] Impact quantified where possible - [ ] Root cause vs contributing factors distinguished - [ ] Action items owned, dated, tracked - [ ] Follow-up review scheduled ## Tips for Effective Guidance - Match depth to severity; lightweight retro for minor incidents. - Link traces, metrics, and logs in an appendix for engineers. - Psychological safety enables honesty—leadership models it. ## Handling Deviations - Security incidents: coordinate with legal/infosec before public detail.