# Incident postmortem

> A written review of what went wrong in an outage and how to avoid a repeat.

- Level: Intermediate
- Topics: Cloud, Software
- URL: https://tidbit.legios.com.ar/incident-postmortem/
- In Spanish: [Postmortem de incidentes](https://tidbit.legios.com.ar/es/incident-postmortem/)

An **incident postmortem** is the document a team writes after something breaks in production: the site went down, payments failed, data was lost. Once the fire is out, people sit down and reconstruct what happened, minute by minute, so the organization learns from it instead of just moving on.

A typical postmortem has a summary, the **impact** (who was affected and for how long), a **timeline**, the **root cause** and contributing factors, what went well and badly in the response, and a list of **action items** with owners and dates, such as adding an alert, fixing a script or changing a review process. The action items are the point: a postmortem without follow-up is just a story.

The key cultural rule is that it is **blameless**. It assumes people acted reasonably with the information they had and asks why the system let a mistake cause damage, not who to punish. If engineers fear blame, they hide details, and the real causes stay buried. Many companies publish postmortems of big outages so customers can see what happened and what changed.

## An analogy

Like the investigation after a plane incident: the goal is not to fire the pilot but to understand the chain of events, then change the checklist, the training or the instrument so the next crew does not end up in the same spot.

## Keep in mind

- Written after an outage: impact, timeline, root cause, action items.
- Blameless: focuses on systems and processes, not on punishing people.
- Action items with owners are what make it worth doing.
- Big companies often publish theirs to keep customers informed.

## Go deeper

- [Postmortem culture: learning from failure (Google SRE book)](https://sre.google/sre-book/postmortem-culture/)
- [Postmortem documentation on Wikipedia](https://en.wikipedia.org/wiki/Postmortem_documentation)

## Related terms

- [Training and inference](https://tidbit.legios.com.ar/training-and-inference/): Training builds the model once; inference is using it, millions of times a day.