Chapter 11 of 14 · After any incident
Running a blameless review
- How do we learn from this without blaming someone?
- What does blameless actually mean?
- What if it really was one person’s mistake?
After an incident, someone will ask what went wrong. If the answer is a person’s name, you will learn nothing useful, and people will start hiding the next mistake. A blameless review assumes people acted reasonably given what they knew, and asks why the system made the wrong action easy.
What blameless does not mean
It does not mean nobody is accountable, and it does not mean pretending nothing went wrong. It means the review looks for causes you can fix: missing tests, unclear ownership, confusing tools, time pressure, alerts nobody watched. Deliberate harm is a different process, and rare.
Running the meeting
- Write a timeline first, from logs and notes, and share it before the meeting.
- Invite the people involved, and say plainly that the goal is learning.
- Walk the timeline. At each decision, ask what the person knew and what they saw.
- Ask what made the mistake easy and the right action hard.
- Agree a small number of actions, each with an owner and a date.
The question you might not ask out loud
It really was one engineer who pushed the bad change. Is it not honest to say so?
It is a fact, but it is not the useful one. The useful questions are why one person could push it without review, why no test caught it and why it reached production. Fix those and the next person cannot make the same mistake.
Words that help
- Ask what happened, not why you did it.
- Say the change was deployed rather than naming who deployed it.
- Avoid should have. Hindsight makes every decision look obvious.
- Thank people for being open, out loud, in the meeting.
Rule of thumb:Fewer actions that get done beat a long list that does not. Two or three changes with owners are a good result.
Share the write-up widely, in plain words. Other teams learn from your incident at no cost, and engineers see that security responds to mistakes by improving systems, not by finding someone to blame. That reputation is worth more than any tool you will buy this year.
Come back to the actions a month later. Check which ones were done, which stalled and why. A review whose actions never happen teaches people that reviews are theatre. A review whose actions visibly land teaches them that telling the truth leads to real change, which is the whole point of doing it without blame.