Blameless Post-Mortem
Definition
A cultural approach to post-incident review, popularised in site reliability engineering, in which the analysis focuses on systemic and process failures rather than individual error. The framing assumes that skilled people make mistakes when systems and processes create conditions for failure, and that honest reporting improves when individuals are not penalised for their involvement.
- Origin
- Site reliability engineering practice
- Focus
- Systemic and process failure, not individual blame
- Assumption
- Skilled people err when conditions enable failure
- Field
- Post-incident review, incident response
Common questions
How does a blameless post-mortem improve the quality of incident reporting?+
When individuals are not penalised for their role in an incident, they are more likely to disclose the full sequence of actions and decisions honestly, which gives investigators a more complete and accurate picture of what actually happened rather than a defensive, partial account.
Does blameless mean no individual accountability exists at all?+
No. It separates the incident analysis, which stays focused on process and system causes, from any separate personnel or disciplinary matters, which are handled through different channels rather than being conflated with the technical review.
Related terms
- Action Item
- A specific, time-bound improvement task generated by a post-incident finding. An action item has a named owner, a target completion date, a...
- Lessons-Learned Register
- A persistent record, maintained by the security programme, that links each post-incident action item to the originating incident, tracks its status, and...
- Post-Incident Activity
- The NIST SP 800-61 label for the final phase of the incident response lifecycle. It encompasses evidence retention, lessons-learned meetings, and the...
- Root-Cause Analysis (RCA)
- A structured method for identifying the underlying systemic cause of a failure rather than its immediate trigger. Common techniques in incident review...
- Timeline Reconstruction
- The process of ordering digital events from multiple sources into a single chronological account. Requires normalising all timestamps to a common reference...