Postmortem template
Describe what a reasonable person did with the information they had. The system that made that the reasonable thing is what you are trying to fix — naming a person instead guarantees the next person hides the same mistake.
Summary#
Two or three sentences. What broke, who noticed, how long it lasted, and what users could not do.
Impact#
Which users, which actions, how many, over what window — using numbers you can actually support. If you do not know a number, say so rather than estimating in a document people will quote back to you later.
Timeline#
| Time | Event |
|---|---|
| First symptom, taken from logs rather than memory | |
| First human noticed | |
| Responder acknowledged | |
| Cause identified | |
| Mitigation applied | |
| Service confirmed restored |
What happened#
The technical sequence, in plain language. Someone who does not work on this part of docs should be able to follow it without a glossary.
Why it wasn't caught earlier#
Detection is a separate question from cause, and usually the more valuable one. Why did users notice before monitoring did?
What went well#
Real entries only. The runbook that worked, the rollback that was fast, the person who escalated early instead of pushing on alone.
Follow-up actions#
| Action | Owner | By when |
|---|---|---|
Each action must be a specific change with a named owner. "Be more careful" is not an action. "Alert when checkout error rate crosses the agreed threshold" is.