IR-007 recommended post-mortems

Action items tracked to completion

Post-mortems are worthless if action items never get done. Action items must be tracked in a system with clear ownership.

Question to ask

"How many post-mortem action items are still open from last year?"

Pass criteria

  • Action items go into a tracked system (Linear, Jira, GitHub issues)
  • Someone owns following up on completion
  • Most action items actually get done

Fail criteria

  • Action items stay in the post-mortem doc only
  • No ownership of follow-through
  • Pattern of same issues recurring
  • "We'll get to it" culture

Verification guide

Severity: Recommended

Post-mortems are worthless if action items never get done. "We should add monitoring for this" means nothing if it's forgotten by next week.

Check automatically:

  1. Look for action item tracking:
# Check post-mortems for action item sections
grep -riE "action.*item|follow.*up|TODO|task|ticket" postmortems/ post-mortems/ incidents/ docs/postmortems/ --include="*.md" 2>/dev/null

# Look for links to issue trackers
grep -riE "linear\.app|github\.com/.*issues|jira|asana" postmortems/ post-mortems/ incidents/ --include="*.md" 2>/dev/null

Ask user:

  • "Where do post-mortem action items go? (Issue tracker, doc, nowhere)"
  • "Who owns making sure they get done?"
  • "What percentage of action items actually get completed?"

Cross-reference with:

  • IR-006 (post-mortems) - post-mortems generate the action items
  • Section 40 (tech debt tracking) - unfinished action items become tech debt

Pass criteria:

  • Action items from post-mortems go into a tracked system (Linear, Jira, GitHub issues)
  • Someone owns following up on completion
  • Most action items actually get done (not just filed and forgotten)

Fail criteria:

  • Action items stay in the post-mortem doc (never transferred to tracker)
  • No ownership of follow-through
  • Pattern of same issues recurring because action items weren't completed
  • "We'll get to it" culture

Evidence to capture:

  • Where action items are tracked
  • Who owns follow-through
  • Completion rate (if knowable)
  • Whether same issues recur (indicates incomplete follow-through)

Section

35. Incident Response

API & Security