Postmortem Template

Blameless means we fix systems, not people. We assume everyone acted reasonably with the information they had; the failure is in the process, not the person. Required for Sev1 and Sev2 only.

When a postmortem happens

flowchart LR
  Res["Incident resolved"] --> Sev{"Sev1 or Sev2?"}
  Sev -- Yes --> PM["Write postmortem<br/>within 5 business days"]
  Sev -- No --> Close["Close on board<br/>no postmortem"]
  PM --> Act["Track action items<br/>to done"]

The template

Copy into the incident work item — that is its only home, so there is one record per incident and no second copy to drift. Fill every <placeholder>. Action items leave the postmortem as their own work items on the board.

# Postmortem — <incident title>

- Severity: <Sev1 / Sev2>
- Date / duration: <start> → <end> (<total impact time>)
- Author: <name>  |  Reviewed by: <team lead / CTO>

## Impact
- Who / what was affected: <clients, users, systems>
- Scale: <requests failed, users hit, data affected>

## Timeline
| Time | Event |
| --- | --- |
| <t0> | <detection> |
| <t1> | <declared, severity set> |
| <t2> | <mitigation> |
| <t3> | <resolved> |

## Root cause
- What actually caused it: <the system/process cause, not a name>
- Why it wasn't caught earlier: <gap in tests, review, monitoring>

## What went well
- <detection, response, comms that worked>

## What went wrong
- <delays, gaps, confusion>

## Action items
| Action | Owner | Due date |
| --- | --- | --- |
| <preventive change> | <name> | <YYYY-MM-DD> |
| <detection/monitoring improvement> | <name> | <YYYY-MM-DD> |

Note

Every action item needs a named owner and a due date, tracked as work items to done. A postmortem with no tracked actions changed nothing.

See Incident Response for how incidents are run.