Incident review
Definition
A structured meeting conducted after a production incident — such as an outage, data loss event, or security breach — to reconstruct the timeline, identify root causes and contributing factors, and produce action items to prevent recurrence.
Incident reviews are the operational equivalent of a project post-mortem. Where post-mortems evaluate strategic or product outcomes, incident reviews focus on the technical and operational breakdown: what happened in production, when, why, and what would have caught it sooner.
When to run one: Any incident classified as P0 or P1 should trigger an incident review. Some organizations run reviews for all P2 incidents as well, or for any incident with customer impact above a defined threshold.
Incident review structure:
- Timeline: Chronological sequence of events — when was the incident detected, what happened, when was it resolved?
- Impact: How many users were affected, for how long, and what was the business impact?
- Root cause: The underlying cause, not just the proximate trigger.
- Contributing factors: What made the root cause possible? What missed the issue?
- Action items: Specific changes with owners and deadlines.
- What went well: Detection, response, and communication wins worth reinforcing.
Relationship to blameless postmortem: Incident reviews should be blameless. The same principles apply: people make mistakes because systems allow them to; fix the systems.
The whiteboard at incident review: The timeline is almost always drawn on a whiteboard — chronological events on a horizontal axis with markers for detection, response decisions, and resolution. Snap it with BoardSnap to capture the timeline before the meeting ends.
Examples
- A payments platform runs an incident review after a 23-minute outage, producing five action items: two for monitoring improvements and three for process changes.
- An engineering team builds an incident review template and practices it quarterly on simulated incidents — so the real process is familiar when it matters.
- A startup publishes sanitized incident reviews on its status page as a transparency practice, building customer trust over time.
- A team member uses the BoardSnap summary of the incident review whiteboard as the first draft of the formal incident report.
Snap a incident review. Ship its actions.
BoardSnap turns any whiteboard — including this one — into a summary and action plan.