Post-Mortem / Incident Review

Blameless incident review. Timeline first, conclusions second.

The source

74 lines of Markdown, with nothing to install. Copy it, or open the template inside Gnomon and render it as it is.

# Post-Mortem: <Incident title>

- **Date of incident:** YYYY-MM-DD
- **Severity:** SEV1 | SEV2 | SEV3
- **Duration:** Xh Ym (HH:MM UTC – HH:MM UTC)
- **Author:** <name>
- **Reviewers:** <names>
- **Status:** Draft | Reviewed | Action items in progress | Closed

## Summary

2–3 sentences: what happened, what was the user impact, how it was resolved.
Blameless tone — describe systems and decisions, not individuals.

## Impact

- **Users affected:** <count or %>
- **Requests affected:** <count or %>
- **Revenue impact:** <if applicable>
- **Data loss / corruption:** <yes/no — describe>
- **SLO budget consumed:** <…>

## Timeline

All times in UTC.

| Time   | Event                                                                |
|--------|----------------------------------------------------------------------|
| HH:MM  | Deploy of `<commit>` to production                                   |
| HH:MM  | First customer report in #support                                    |
| HH:MM  | Alert `HighErrorRate` fires                                          |
| HH:MM  | On-call ack and incident channel opened                              |
| HH:MM  | Hypothesis: <…>                                                      |
| HH:MM  | Mitigation attempted: <…>                                            |
| HH:MM  | Rollback initiated                                                   |
| HH:MM  | Errors return to baseline                                            |
| HH:MM  | Incident closed                                                      |

## Root Cause

The single technical cause that, if absent, would have prevented the incident.
Be specific: name the change, the assumption it broke, and why it wasn't caught.

## Contributing Factors

The conditions that allowed the root cause to escalate or go undetected.

- **Detection:** how long until we knew? Why not sooner?
- **Diagnosis:** how long until we understood? Why not sooner?
- **Mitigation:** how long until we stopped the bleed? Why not sooner?
- **Communication:** internal / external — what worked, what didn't?

## What Went Well

- …

## What Went Poorly

- …

## Action Items

| #  | Action                                          | Owner   | Type         | Due       | Ticket  |
|----|-------------------------------------------------|---------|--------------|-----------|---------|
| 1  | Add alert for <…>                               | <name>  | Detection    | YYYY-MM-DD| <link>  |
| 2  | Backfill chaos test for <…>                     | <name>  | Prevention   | YYYY-MM-DD| <link>  |
| 3  | Document <…> in runbook                         | <name>  | Process      | YYYY-MM-DD| <link>  |
| 4  | Refactor <…> to remove footgun                  | <name>  | Prevention   | YYYY-MM-DD| <link>  |

Type: Detection | Mitigation | Prevention | Process | Communication.

## Lessons Learned

The 1–2 transferable insights you'd want every other team to know.

Render this offline

This template ships in Gnomon and renders on your machine, with no account and nothing sent to a server. The browser editor is free and needs no install.

Get GnomonOpen the browser editor

Others in Architecture document templates