Write Blameless Postmortems

Provides a comprehensive guide to writing effective, blameless postmortems that drive organizational learning and prevent incident recurrence, covering full and quick templates, 5 Whys root cause analysis, and meeting facilitation.

Use this skill when conducting a post-incident review, writing a postmortem document, facilitating a blameless postmortem meeting, identifying root causes and contributing factors, or creating actionable follow-up items. Postmortem triggers include SEV1/SEV2 incidents, customer-facing outages over 15 minutes, data loss or security incidents, near-misses that could have been severe, novel failure modes, and incidents requiring unusual intervention. Not a fit for tasks unrelated to postmortem writing or incident learning culture.

Contrasts blame-focused culture ("who caused this?", punishing individuals, hiding information) against blameless culture ("what conditions allowed this?", improving systems, psychological safety). Defines a postmortem timeline from incident day (draft within 1-2 days, meeting within 3-5 days, finalized document and tickets by day 5-7, action items completed by week 2+, quarterly cross-incident pattern review).

Provides three full templates. The Standard Postmortem template covers executive summary with quantified impact, a UTC timeline table from deployment to resolution, root cause analysis (proximate cause, contributing factors, and a worked 5 Whys chain), a system diagram, detection analysis (what worked/didn't, detection gap timing), response analysis, customer/business/technical impact breakdowns, lessons learned (what went well, what went wrong, where luck helped), a prioritized action items table (priority, action, owner, due date, ticket), and an appendix with supporting data and related incidents. The 5 Whys Analysis template walks through five sequential why-questions each with an answer and supporting evidence, concluding with primary/secondary/tertiary root causes and a systemic improvements table categorized as prevention/detection/mitigation. The Quick Postmortem template compresses this for minor (SEV3) incidents into what happened, timeline, root cause, fix, and lessons in a few lines.

Facilitation guidance structures a 60-minute postmortem meeting into five phases: opening (5 min, reinforcing blameless culture), timeline review (15 min), analysis discussion (20 min, covering what/why/what conditions/what would have prevented), action items (15 min, prioritized by impact and effort with owners and due dates), and closing (5 min). Facilitation tips include keeping discussion on track, redirecting blame to systems, encouraging quiet participants, documenting dissenting views, and time-boxing tangents.

Lists five anti-patterns to avoid (the blame game, shallow analysis, no action items, unrealistic actions, no follow-up) each with the problem it causes and a better approach. Best practices cover starting immediately while memory is fresh, being specific with exact times/errors, including visual graphs, assigning owners to every action item, and sharing widely for organizational learning - alongside explicit don'ts: never name and shame, don't skip small incidents (they reveal patterns), don't turn it into a blame document, don't create busywork, and don't skip verifying follow-up completion.

References Google SRE's postmortem culture practices, Etsy's blameless postmortem approach, and PagerDuty's postmortem guide as external methodology references.

SRE and engineering teams running post-incident reviews who need concrete postmortem templates, a structured 5 Whys root cause method, and meeting facilitation guidance rather than an ad hoc incident write-up.

Why #1: Why did the service fail?
Answer: Database connections were exhausted, causing all new requests to fail.