A timeboxed agenda for running blameless incident review meetings — roles, discussion prompts, and the exit criteria that separate real reviews from ritual readings.
The meeting exists to pressure-test causal claims and commit resources — not to perform the document. Send the draft ahead; hold it within 5 business days of resolution while memory survives.
| Time | Segment | Goal |
|---|---|---|
| 0–3 | Facts recap | Everyone reads metadata + exec summary aloud silently; correct numbers |
| 3–10 | Timeline walk | Gaps become TODO owners, not debate material |
| 10–20 | 5-Whys stress test | "Would this prevent recurrence?" — challenge system-depth of chains |
| 20–27 | Action items | Type/owner/priority assigned live; blockers named |
| 27–30 | Luck + retro-meta | Near-miss capture; one improvement for the process itself |
Done means: every TODO has an owner+date, every action item is typed (prevent/detect/mitigate), root-cause chains reach systemic depth (see 5 Whys guide), and the doc states confidence level honestly. Anything less publishes nice-looking paper trails.
Post to a channel where new hires lurk — public review history teaches architecture cheaper than any onboarding session, and repeat offenders surface naturally when reviewers can grep past postmortems.
Paste your incident timeline and get this exact structure filled out in ~90 seconds.