Incident and Postmortem Templates

How to choose

Pick by how much you already know.

• After an outage or a customer-facing incident, use the Incident Review. It walks through what happened in order, how you found out, how you responded and what contributed, then ends with follow-ups. Give it the full hour.
• When the symptom is clear but the cause isn't, use the 5 Whys. It works best on one problem at a time, such as "the release was rolled back twice".
• When many things could have caused it, use the Fishbone. Its people, process, tools, environment and measurement columns stop the team from fixing only the most obvious cause.
• When the issue is small, Problem, Root Cause, Prevention covers the same ground in 30 minutes, without a full review.
• When nobody agrees on what happened yet, What? So What? Now What? separates facts from meaning before anyone proposes a fix. It suits a confusing sprint better than a single failure.
• When the problem built up over weeks, a Timeline lays out early, middle and late events so you can see where things started to slip.
• When a whole project missed its goals, the Project Post-Mortem compares the goals with what was delivered.

Keep it blameless

People only describe what really happened if they're sure it won't be used against them. Say at the start that the review is about the system: the checks, alerts, docs and handoffs that let a mistake reach users. "Why did Sam deploy on Friday?" becomes "Why did our process allow an untested deploy on a Friday?"

Some practical rules:

• Build the timeline from records, not memory. Use logs, alerts and the incident channel. Retro Rabbit doesn't import these, so paste the key timestamps into notes before the meeting.
• Offer notes without names. Anyone can turn off Show Name in their settings, which helps the person closest to the incident say what they saw.
• Stop at causes the team can change. "The vendor had an outage" is a fact. "We had no fallback when the vendor went down" is something to fix.
• Make the follow-ups stick. Assign every follow-up to a named person in the Action Items panel. Open items reappear in later retros under Old / Unresolved Items, so a prevention task doesn't vanish once the incident feels over.

For writing follow-ups that get done, see retrospective action items. For questions to ask after an incident, see sprint retrospective questions.