← Xavier Bennet · Playbook · empty template

Post-incident review

PIR. Facts first, summary last. No blame in the room. If there is no owner and no date, it is not an action.

Header

Incident ID

Service / system

Severity

PIR date

Incident commander

Scribe

Attendees

Start / detect / restore (timezone)

1. Incident summary

Write this last. Stand-alone. Who, when, where, how. Discovery, mitigation, what stops a repeat. As if the CEO will only read this paragraph.

Summary

2. Impact

Customers / users affected (number)

Customer impact (what they could not do)

Business / financial impact

SLA / reputation / second-order

Security implications

3. Timeline

UTC. Chronological. Trigger through return to normal. Gaps over 10–15 minutes need an explanation later.

Time	Event	Evidence

4. Metrics

MTTD

MTTI

MTTR

Dashboard / graphs (link or attach)

What monitoring did not show

5. Incident questions

Detection — when did we learn? how? how do we cut time-to-detect?

Diagnosis — underlying cause? change window? how do we cut time-to-diagnose?

Mitigation — how did we restore? how did we prove it? how do we cut time-to-mitigate?

Prevention — what must be true so this does not recur?

6. Five Whys

Problem statement

Why 1

Why 2

Why 3

Why 4

Why 5

Root cause(s)

7. Action items

No owner and no date = not an action. Prevent, detect, or resolve.

#	Action	Owner	Due	Pri
1
2
3
4
5
6

8. Related items

Related PIRs / tickets / runbooks

9. What went well

10. What we will do differently

11. Communications review

First customer / exec update (time)

Cadence held? Y / N

What was late, missing, or wrong

12. Follow-up

Independent reviewer (not on the bridge)

Next check on open actions