Skip to content

Post-incident review

Review a serious incident without blame: what happened, why, and what will stop it happening again.

Fill it in and preview

Post-incident review

Incident: Checkout unavailable for 47 minutes
Date: 11 October 2027
Severity: High
Incident lead: Hamza Idrissi
Review written by: Anna Berg
Review date: 14 October 2027

This review is blameless. Its aim is to learn and to improve systems and processes, not to blame people.

Summary

On 11 October from 14:03 to 14:50 customers could not pay. A database change filled the disk and the checkout service stopped.

Impact

About 310 failed payment attempts. Estimated lost sales of EUR 9,000. 42 support tickets. No data was lost.

Timeline

14:03 Alert for failed payments
14:08 On-call engineer starts looking
14:21 Cause found: disk full
14:38 Old logs removed, service restarted
14:50 Payments working, incident closed

Causes

Direct cause: the disk reached 100 percent.
Underlying causes: no alert for disk use, log files were never rotated, the change was not tested with real data volumes.

What went well

The payment alert fired in 3 minutes. The team worked together and kept customers informed on the status page.

What went badly or was lucky

Finding the cause took 18 minutes because the dashboard did not show disk use. The runbook was out of date.

Follow-up actions

Action Owner Due date
Add a disk alert at 80 percent Hamza Idrissi 21 October
Set up log rotation Daniel Roche 21 October
Update the runbook Anna Berg 28 October

Lessons for others

All services should have disk alerts and log rotation.

Templates are a careful starting point, not legal advice. Where the law matters, check what applies where you are.

IT and projects

What this template is for

A blameless post-incident review for outages and serious problems. Cover the timeline, impact, causes, what worked, what failed and follow-up actions.

It is free to fill in online, needs no account, and downloads as a Word document or a PDF. See all IT and projects templates

IT and projects

What you fill in

The form asks for 14 details. The document fills itself in as you type.

  • Incident title

    For example: Checkout unavailable for 47 minutes

  • Date of incident

    For example: 11 October 2027

  • Severity

    For example: High

  • Incident lead

    For example: Hamza Idrissi

  • Review written by

    For example: Anna Berg

  • Date of review

    For example: 14 October 2027

  • Summary

    For example: On 11 October from 14:03 to 14:50 customers could not pay. A database change filled the disk and the checkout service stopped.

  • Impact

    For example: About 310 failed payment attempts. Estimated lost sales of EUR 9,000. 42 support tickets. No data was lost.

  • Timeline

    Times with what happened. Facts only.

    For example: 14:03 Alert for failed payments 14:08 On-call engineer starts looking 14:21 Cause found: disk full 14:38 Old logs removed, service restarted 14:50 Payments working, incident closed

  • Causes

    Look for system causes, not a person to blame.

    For example: Direct cause: the disk reached 100 percent. Underlying causes: no alert for disk use, log files were never rotated, the change was not tested with real data volumes.

  • What went well

    For example: The payment alert fired in 3 minutes. The team worked together and kept customers informed on the status page.

  • What went badly or was lucky

    For example: Finding the cause took 18 minutes because the dashboard did not show disk use. The runbook was out of date.

  • Follow-up actions

    One row for each action.

    For example: Add a disk alert at 80 percent | Hamza Idrissi | 21 October Set up log rotation | Daniel Roche | 21 October Update the runbook | Anna Berg | 28 October

  • Lessons for other teamsoptional

    For example: All services should have disk alerts and log rotation.

IT and projects

What is inside

The parts of this document, in order.

  1. 1Summary
  2. 2Impact
  3. 3Timeline
  4. 4Causes
  5. 5What went well
  6. 6What went badly or was lucky
  7. 7Follow-up actions
  8. 8Lessons for others

Templates

How it works

  1. 01

    Fill in

    Type your details in the form. The document fills itself in as you type; click any gap to jump to its field.

  2. 02

    Check

    Read it through. Gaps you have not filled stay marked, so nothing goes out half done.

  3. 03

    Download

    Save it as a Word document to edit further, or as a PDF to send or print.

Make it yours with AI

Open it in the chat and ask for changes: shorter, firmer, another situation, another language.

Adapt it with nerix

IT and projects

Questions people ask

What details does this template ask for?

The form asks for 14 details, starting with Incident title, Date of incident, Severity, Incident lead, Review written by. 1 more are optional.

Can I download this template as Word or PDF?

Yes. When you have filled in the form, save it as a Word document to keep editing, or as a PDF to send or print. It is free and needs no account.

Is what I type sent anywhere?

No. What you type stays in your browser while you fill in the document. It only goes to nerix if you choose to open the template in the chat.

Are these IT and project templates free?

Most are. Fill in and download them for free as Word or PDF, with no account. A few longer documents are premium: free to fill in, paid once to download, and marked with their price.

Does a security policy make us secure?

No document does that alone. A policy helps when it matches what people really do, so keep it short, explain it to your team and review it every year.

Is a project charter only for large projects?

No. A small project benefits too, because one page that names the goal, the limits and the decision maker prevents most arguments later.