Business & Productivity

Write a Blameless Post-Incident Review

Turns incident notes and a timeline into a blameless postmortem with causes, impact and action items that have owners and dates.

Designed for general-purpose AI assistantsPublished November 2026

Customize

Fill in the fields and the prompt updates. What you type stays in this page and is never saved or sent.

Preview

Write a blameless post-incident review from the material below. The goal is to learn how the system allowed this to happen, not to find someone to blame.

Incident title: {{incident title}}
Date and duration: {{date and duration}}
Severity and who was affected: {{severity and impact}}
Timeline notes (times, alerts, messages, actions, in any order): {{timeline notes}}
What we found about the cause so far: {{findings}}
What fixed it: {{resolution}}
Audience: engineering and customer support leads

Write the document with these sections:
1. Summary: three sentences covering what happened, the impact and the current state.
2. Impact: who was affected, for how long, and what it cost. Use only numbers I gave you. Write "unknown" where I did not.
3. Timeline: a clean chronological table with time, event and source. Mark any time you are unsure of with a question mark. Do not fill gaps in the timeline with guesses.
4. Detection and response: how we found out, how long that took, and what slowed the response.
5. Causes: the contributing factors, in system terms (process, tooling, monitoring, design, unclear ownership). Describe actions as decisions made with the information available at the time. Never write sentences that blame a named person.
6. What went well.
7. What was lucky: things that could have made it worse but did not.
8. Action items: a table with the action, the type (prevent, detect, mitigate), an owner marked [owner?] if I gave none, a due date marked [date?] if I gave none, and the cause it addresses.
9. Open questions we could not answer from the notes.

Rules: do not invent causes, times, metrics or owners. If my notes point to a person's mistake, rewrite it as the gap in process or tooling that made the mistake easy. Distinguish clearly between confirmed causes and hypotheses.

6 required fields are empty and will stay as a {{placeholder}} in the copied text.

How to use it

  1. Paste raw chat logs, alert text and timeline fragments; you do not have to sort them first. The prompt builds the timeline.
  2. Check every time and number against the original logs. These are the details that cannot be guessed, and the prompt marks those it is unsure of.
  3. Fill in each [owner?] and [date?] in the meeting where you review the document. An action item without both rarely gets done.
  4. Share the draft with the people involved before it is final, so the account of what they knew at the time is accurate.

Example output

Illustrative only. Real answers depend on your input and the assistant you use.

Summary: On March 3 the checkout page failed for about 47 minutes because an expired certificate on the payment service was not renewed. Roughly 120 orders failed; support has contacted affected customers.

Timeline
| Time (UTC) | Event | Source |
|---|---|---|
| 14:02 | First customer report in support chat | Support log |
| 14:10? | Alert fired, acknowledged | Pager history |
| 14:31 | Cause identified as expired certificate | Incident channel |
| 14:49 | New certificate deployed, checkout recovers | Deploy log |

Causes (contributing factors)
- Certificate expiry was tracked in one person's calendar, not in monitoring.
- The alert fired on the error rate but did not mention certificates, which lengthened diagnosis.

What was lucky: the incident happened mid-week; a weekend failure would have been found later.

Action items
| Action | Type | Owner | Due | Addresses |
|---|---|---|---|---|
| Add certificate-expiry monitoring | Detect | [owner?] | [date?] | Calendar-only tracking |

Open question: why did the automatic renewal job not run?

Tips

The rewrite of anything that sounds like blame into a process gap is the heart of this prompt. "Alex forgot" becomes "renewal depended on one person remembering".

The "what was lucky" section often finds the most valuable lessons, because near-misses point to risks you have not addressed yet.

If you have a company post-incident template, paste it and ask the assistant to use that structure while keeping the blameless rules.

  • Business & Productivity

    Turn Meeting Notes into Action Items

    Converts raw meeting notes into action items with owners and dates, decisions, loose ends and a short summary to share.

    Customizable fields
    4 fields
  • Business & Productivity

    Write a Weekly Status Update

    Turns your rough weekly notes into a short status update with progress, risks and the decisions you need, ready to send to stakeholders.

    Customizable fields
    8 fields
  • Coding & Software

    Write a Reproducible Bug Report

    Turns messy observations into a bug report with exact steps, expected and actual behavior, environment and what is still unknown.

    Customizable fields
    8 fields