Rule #1: Start with a timeline of Slack messages. It makes the incident look more like a soap opera. Anyways, the system logs won’t show anything as nobody detected the issue until someone started this thread.
Rule #2: Ask someone who was not there to do the write-up. The best postmortems come from someone who wasn’t there and has no context. This is called knowledge sharing. Next time, everybody will join the incident call.
Rule #3: Repeat “we’re blameless”. Say it at least three times, so leaders know you’re well integrated into the company culture. Be careful not to add a subtle “but if…”.
Rule #4: Reward participation. If someone speaks up about what they did, nod politely, write it down, and immortalize their name in Confluence. It’s necessary to create visibility (unless it’s you).
Rule #5: The more clueless you are, the longer the report. Nobody will read the post-mortem once they see it has more than two pages. So, if you have no idea what happened, add a lengthy section about your last holidays in the middle. Nobody will notice.
Rule #6: Add action items no one owns. “Improve monitoring,” “review IAM,” “fix documentation.”. Great, it looks like you know what the next steps are, even though nobody will ever close these tasks.
Rule #7: Schedule the meeting as soon as possible. Do not let time for anyone to find out you were the one who misclicked a button.
Rule #8: Root cause: human error. You are unlikely to get it wrong. Someone probably made a mistake at some point. Nobody will get fired anyway. Not in a blameless culture, right?
Rule #9: Archive and forget. Once the document is uploaded to an obscure folder and published, the work is done. Until the same incident happens again next month. But hopefully, people would have forgotten.
Rule #10: Build relationships. Nobody wants their name tagged in a postmortem. Don’t forget to cash in those favors at the next incident.