Lesson 4.56: Blameless post-incident reviews
After an incident, 'human error' is the most common root cause in reports and the least useful. People make mistakes in every system; the question is why the system let that mistake cause harm and why it took so long to notice. Blameless reviews, a practice from safety engineering and site reliability engineering, look for contributing factors and fix them with owned, dated actions. In the lab you rewrite a draft review that blames a developer, find the real contributing factors and check whether actions from earlier reviews were ever finished.
18 min
You will learn to
- Build an incident timeline and exposure window
- Recognise 'human error' as a starting point, not a cause
- List contributing factors by category
- Write owned, dated actions
- Track overdue actions across reviews
Key terms
- Blameless review
- A review that looks for system causes and assumes people acted reasonably with what they knew.
- Contributing factor
- A condition that made the incident possible, worse or slower to detect.
- Exposure window
- The time between the start of harm and its end.
- Action item
- A specific change with one owner and a due date.
- Just culture
- People aren't punished for honest mistakes, while reckless behaviour is still addressed.
← Running a security champions programme · All lessons · A skills matrix and a hiring plan →