Incident Retro Template

Template Type: Retro

Agenda Outline:

1. Timeline (10 minutes): Document what happened, when it happened, and who responded.
2. Impact (5 minutes): Discuss how the incident affected users and SLA breaches.
3. Root Cause (10 minutes): Use the 5 Whys technique to determine the underlying cause.
4. Fixes (10 minutes): Identify immediate, short-term, and long-term remediation actions and assign owners.
5. Learnings (5 minutes): Identify process improvements, monitoring gaps, and updates to runbooks.

Timeboxes: 45 minutes total (10/5/10/10/5)

Prompts / Questions: What triggered the incident? Which alerts and monitoring tools worked or failed? Were communication channels effective? What documentation or runbooks were missing or outdated?

Definition of Ready/Done tie-ins: All long-term action items must be captured in the backlog with clear acceptance criteria, assigned owners, and due dates.

Copy-Paste Block:

• Timeline: what happened and when
• Impact: user/SLA effects
• Root Cause: 5 Whys
• Fixes: immediate and long-term actions
• Learnings: process improvements