The purpose of this postmortem is to:
- Provide an explanation of how the event happened, as the organisation best understands it.
- Produce artifacts (recommendations, remediations) for prevention and improvement of detection and response approaches for handling similar future events.
Only by coming to an mutually agreeable explanation together, can we start to produce recommendations and remediations that help all of us in the future.
Whenever we talk about events that happened in the past, we need to be aware of two key cognitive biases that taint our perception of events:
- Hindsight bias: Inclination to see an event as predictable. "Knew it all along" effect. Memory distortion.
- Outcome bias: Knowledge of outcome taints perception of actions. "Bad outcome means all actions leading up to the outcome were bad"
These two biases have trigger phrases:
- “They shouldn’t have…”
- “They could have…”
- “They failed to…”
- “If only they had…!”
If a trigger phrase is used, the moderator will help rephrase it, e.g:
- “What about this made sense?”
- “What information were they acting upon?”
This post-mortem is voluntary and non-punitive. You will not be punished for voicing frank opinions. This is not a free pass to attack others.
We're going to construct a timeline. A timeline is a simple way for us to represent the event.
The timeline is lossy. The world is not linear, and events during this incident unfolded non-linearly. We will lose some detail, but we will do our absolute best to capture as much detail as possible, as accurately as possible.
Starting questions:
- When did the event start?
- What was our first indication something abnormal was happening?
- What happened next?
Coaching questions:
- What happened next?
- What did you feel?
- What actions were taken?
- What effects were observed?
- What expectations were had?
- What assumptions were made?
Avoid questions like:
- Why did you do this? ("why" implies blame)
- Who did this? (drags us towards Fundamental Attribution Error)
From the Retrospectives Handbook:
- What did we do well, that if we don’t discuss we might forget?
- What did we learn?
- What should we do differently next time?
- What still puzzles us?