Source:
../incident-postmortem.html· Type: Incident postmortem · Audience: Engineering and operations leadership · Mode: Hybrid readout + written report · Time: 15 min + 10 Q&A Fictional case. The deck is the current implementation; this file captures the brief, structure, and acceptance.
Engineering and operations leadership; incident responders.
Intent: Learn, agree actions, and restore trust without assigning blame.
Decision or action: Approve the six actions and owners; accept the residual risk until closed.
Success: The room can explain the trigger, the amplifier, and the systemic gap.
Impact → timeline → root cause → contributing factors → strengths → actions → metrics → lesson.
| # | Slide | Budget | Purpose / speaker cue |
|---|---|---|---|
| 1 | Checkout outage — 47 minutes | 1 | Set the frame: blameless, evidence-first, actions over blame. |
| 2 | Impact | 1 | Lead with impact, not the deploy. |
| 3 | Timeline | 2 | Walk the timeline in 90 seconds. |
| 4 | Root cause | 3 | Separate trigger from amplifier. |
| 5 | Contributing factors | 2 | Four factors, each with a consequence. |
| 6 | What went well | 1 | Name the strengths. |
| 7 | Actions | 3 | Do not read every row. |
| 8 | Detection and response | 1 | The gap is mitigation, not detection. |
| 9 | The lesson | 1 | One lesson, one sentence. |
| 10 | Appendix | 10 | Q&A. |
Timeline, logs, config diff, gateway trace. The incident and numbers are fictional; reconcile with the written report before delivery.
Fact-check gate: confirm names, numbers, dates, and comparisons before layout. A precise number without a date and source is a liability.
Blameless, plain, past tense; separate trigger from amplifier; no euphemism.
Light, red accent, monospace timeline; one timeline and one action table; readable in print. Cover uses a night operations photograph, not a server room.
15 minutes plus 10 Q&A. Must-cut: log detail and individual action rows; protect impact, root cause, and actions. (total budget: 25 minutes)
Q&A: prepare the ten most likely questions and one honest answer for each. Do not improvise a fact.
Risks: Blame framing; actions without owners; hiding a contributing factor.
Open: Replace fictional data; confirm legal and communications review; decide whether to include customer quotes.