Postmortem Template

Overview

Every incident is a learning opportunity. This template ensures your team captures the full timeline, root causes, and actionable follow-ups without finger-pointing. Run it as a collaborative doc within 24 hours of resolution.

Sections

1. Summary — One paragraph. What broke, impact, duration.
2. Timeline — UTC timestamps. Detection → escalation → mitigation → resolution.
3. Root Cause — The “five whys” chain. No blame, just mechanism.
4. Impact — Users affected, revenue loss, data exposure, SLA breach.
5. What Went Well — Detection speed, communication, rollback smoothness.
6. What Went Wrong — Gaps in monitoring, unclear ownership, slow escalation.
7. Action Items — Concrete tickets with owners and deadlines. No vague “investigate” items.

Golden Rules

• Assume good intent — every decision made sense at the time.
• Focus on systems and processes, not individuals.
• Every action item must have a single owner and a due date.
• Share the finished postmortem broadly — transparency builds trust.