← Xavier Bennet · Playbook · empty template
Post-incident review
PIR. Facts first, summary last. No blame in the room. If there is no owner and no date, it is not an action.
Header
Incident ID
Service / system
Severity
PIR date
Incident commander
Scribe
Attendees
Start / detect / restore (timezone)
1. Incident summary
Write this last. Stand-alone. Who, when, where, how. Discovery, mitigation, what stops a repeat. As if the CEO will only read this paragraph.
Summary
2. Impact
Customers / users affected (number)
Customer impact (what they could not do)
Business / financial impact
SLA / reputation / second-order
Security implications
3. Timeline
UTC. Chronological. Trigger through return to normal. Gaps over 10–15 minutes need an explanation later.
| Time | Event | Evidence |
|---|---|---|
4. Metrics
MTTD
MTTI
MTTR
Dashboard / graphs (link or attach)
What monitoring did not show
5. Incident questions
Detection — when did we learn? how? how do we cut time-to-detect?
Diagnosis — underlying cause? change window? how do we cut time-to-diagnose?
Mitigation — how did we restore? how did we prove it? how do we cut time-to-mitigate?
Prevention — what must be true so this does not recur?
6. Five Whys
Problem statement
Why 1
Why 2
Why 3
Why 4
Why 5
Root cause(s)
7. Action items
No owner and no date = not an action. Prevent, detect, or resolve.
| # | Action | Owner | Due | Pri |
|---|---|---|---|---|
| 1 | ||||
| 2 | ||||
| 3 | ||||
| 4 | ||||
| 5 | ||||
| 6 |
8. Related items
Related PIRs / tickets / runbooks
9. What went well
1
2
3
10. What we will do differently
1
2
3
11. Communications review
First customer / exec update (time)
Cadence held? Y / N
What was late, missing, or wrong
12. Follow-up
Independent reviewer (not on the bridge)
Next check on open actions