Incident review
Definition
A structured meeting conducted after a production incident, such as an outage, data loss event, or security breach, to reconstruct the timeline, identify root causes and contributing factors, and produce action items to prevent recurrence.
Incident reviews are the operational equivalent of a project post-mortem. Where post-mortems evaluate strategic or product outcomes, incident reviews focus on the technical and operational breakdown: what happened in production, when, why, and what would have caught it sooner.
When to run one: Any incident classified as P0 or P1 should trigger an incident review. Some organizations run reviews for all P2 incidents as well, or for any incident with customer impact above a defined threshold.
Incident review structure:
- Timeline: Chronological sequence of events, when was the incident detected, what happened, when was it resolved?
- Impact: How many users were affected, for how long, and what was the business impact?
- Root cause: The underlying cause, not just the proximate trigger.
- Contributing factors: What made the root cause possible? What missed the issue?
- Action items: Specific changes with owners and deadlines.
- What went well: Detection, response, and communication wins worth reinforcing.
Relationship to blameless postmortem: Incident reviews should be blameless. The same principles apply: people make mistakes because systems allow them to; fix the systems.
The whiteboard at incident review: The timeline is almost always drawn on a whiteboard, chronological events on a horizontal axis with markers for detection, response decisions, and resolution. Snap it with BoardSnap to capture the timeline before the meeting ends.
Examples
- A payments platform runs an incident review after a 23-minute outage, producing five action items: two for monitoring improvements and three for process changes.
- An engineering team builds an incident review template and practices it quarterly on simulated incidents, so the real process is familiar when it matters.
- A startup publishes sanitized incident reviews on its status page as a transparency practice, building customer trust over time.
- A team member uses the BoardSnap summary of the incident review whiteboard as the first draft of the formal incident report.
Snap a incident review. Ship its actions.
BoardSnap turns any whiteboard, including this one, into a summary and action plan.