How we run incident reviews in the open

The review is for the system

An incident review is not a courtroom and not a performance of regret. It is a structured attempt to understand how a reasonable set of people, tools, and assumptions produced an unexpected result.

We run reviews in the open because the lesson should travel farther than the people who happened to be on call. Visibility turns one incident into shared operational knowledge, provided the process protects curiosity and avoids hindsight judgment.

Write the timeline before the story

We begin with timestamps: the first signal, the first customer impact, the first investigation, each mitigation, and the point at which service returned to normal. Events come from logs, deploy records, alerts, and participant notes.

Only after the timeline is stable do we discuss narrative. This separation matters. Stories are efficient, but they often compress uncertainty and assign causality too early. A timeline gives the team something concrete to examine together.

Describe impact in customer terms

Technical symptoms are necessary but not sufficient. We record which customers were affected, what they experienced, how long the impact lasted, and what work became impossible or unreliable.

This prevents the review from optimizing for internal cleanliness. A green service check does not erase a confusing report, delayed export, or misleading dashboard. Customer impact is the measure that keeps the review connected to the product.

Separate causes from conditions

Most incidents have a triggering event and a surrounding set of conditions. A configuration change may trigger an outage, while limited test coverage, ambiguous ownership, and a noisy alerting path make the outage more likely or harder to contain.

We document both. Stopping at the trigger leads to narrow fixes. Listing every condition without prioritization creates an intimidating backlog. The useful middle is a small set of contributing factors that the team can act on.

Keep the room psychologically safe

Blameless does not mean consequence-free or vague. It means we examine decisions in context rather than treating the outcome as proof that someone should have known more than they did.

Participants should be able to say “I was unsure,” “I missed that signal,” or “the runbook was hard to follow” without turning the admission into a personal liability. Honest details are the raw material of reliable improvements.

Choose fewer, stronger actions

A review that produces twenty action items usually produces very little follow-through. We prioritize changes that reduce the chance of recurrence, shorten detection, limit blast radius, or make recovery easier.

Each action has an owner, a due date, and a definition of done. We also label whether it is a code change, an operational change, a product change, or a decision to accept residual risk.

Publish the uncertainty

Not every question is resolved in the review. When evidence is incomplete, we say so. A documented hypothesis with a follow-up experiment is more useful than false precision.

This habit improves future investigations. Engineers can see which assumptions were provisional, what evidence changed the team’s mind, and where monitoring should become more informative.

Follow-through is the real review

The meeting creates understanding; the work afterward creates reliability. We revisit open actions during planning, link them to the relevant service or product area, and close the loop with the people who experienced the impact.

A review is successful when the next incident is easier to detect, easier to explain, or less damaging—not when the document is polished.

Open by default, careful by design

We share the learning broadly while protecting sensitive customer details and avoiding unnecessary operational exposure. The standard is useful transparency: enough context for others to learn, enough care to keep trust intact.

Incidents are part of operating complex systems. The culture we want is not one that pretends they will disappear, but one that makes each failure a durable investment in the system and the people who operate it.