← Back to blog

Incident reviews: four changes that shift team behavior

The postmortem ends with ten actions in a spreadsheet and three still open next quarter. An incident review changes behavior only when the action has an owner, a deadline and a later check. The four adjustments below come from reviews I ran in teams with their own rotation, and each one closes with a number that shows up in the monthly report.

One action with an owner, at a time

If nobody accepts the action, it is not an action. Site Reliability Engineering (Beyer et al., O'Reilly, 2016) describes blameless postmortems with prioritized action items, because an item with no owner turns into prose. Before the meeting closes, ask for the name of whoever takes it and the date. Three accepted actions beat fifteen written ones.

A 30-day deadline and the old list reviewed

The first item of the next review is the previous list. Every meeting opens with the status of actions from the last two incidents. Attention becomes routine when a person knows they will answer in front of the team, and the review surfaces the action that needs a budget. That one leaves on-call and becomes a management decision, with another owner.

System cause, with the person protected

Sidney Dekker, in The Field Guide to Understanding Human Error (Routledge, 2014), shows that punishing a person ends the investigation early and hides the condition that allowed the error. The right question is which combination of alert, code and process made that path possible. Amy Edmondson, in The Fearless Organization (Wiley, 2018), measures how much people speak about errors when they feel safe to speak.

Lessons beyond the team

A five-line note in the company channel. Write what happened, what changed in the system, and what other teams should check. A team that reads someone else's incident learns without living it, and the post-incident chapter of the Google SRE book recommends exactly that habit. Short text is the format people read.

Share of actions closed within 30 days

One line in the monthly reliability report. Track the time between the incident and the first completed action. The DORA State of DevOps Report links learning culture to stability outcomes, and these two numbers show whether the review became team practice or a form filled in afterwards. If the number drops two months in a row, bring the list to the management meeting.

Facing this challenge in your company?

I help CTOs and engineering teams solve problems like this.

Schedule a conversation
Marc Reinan Gomes
Marc Reinan Gomes Staff Engineer & Consultant

14+ years building products, leading teams, and helping companies scale with technical quality.

Share on LinkedIn