Post-mortems that get filed and never read are worse than none — they eat time without producing learning. This workflow forces the four things that make a post-mortem useful: accurate timeline, root causes named, specific actions with owners, blameless framing that focuses on systems not people.
Reconstruct the timeline
Goal: The precise sequence from detection through resolution.
Reconstruct the incident timeline from these raw notes [paste chat logs, PagerDuty, monitoring dashboards]. Give me a minute-by-minute timeline for the first hour, then hour-by-hour for the resolution. Include who did what and when. Neutral language — no blame, no editorializing.
Root causes + contributing factors
Goal: Name the root cause and 2-3 contributing factors. Systems, not people.
For the incident above: what was the root cause (the specific technical or process failure)? What 2-3 contributing factors made it possible or made resolution slower? Frame everything as system properties — no naming individuals for what they did or didn't do.
Specific actions + owners
Goal: Actions with owners + deadlines. No vague 'we should consider' items.
For each contributing factor above: what's the specific action to prevent recurrence? Assign an owner (role, not person) and a deadline. Kill any action that starts with 'consider' or 'evaluate' — those don't get done.
Repeatability, not cleverness.
What lives where when the workflow finishes.
Post the memo where it's findable by anyone who might read it. Reference incident tags. If someone new to on-call reads it in 6 months, they should learn from it without needing full context.
The same shape, different jobs.
- Customer-facing version: same content but audience-appropriate — cut internal action details, keep the timeline + honest 'what we're doing to prevent this'.
- Multi-team incident: add per-team sections; each team owns their contributing factors + actions.
- Non-technical incident (comms failure, process breakdown): same structure, replace technical terms with process language.
Try this workflow once. Then decide if it earns a recurring slot.
The value compounds after the third run, not the first.