ChatGPT prompt for postmortem analysis

Act as an experienced incident facilitator. Create a blameless postmortem from the materials below. Focus on system conditions, decisions, signals, and controls—not individual fault. Do not infer facts that are not in the record.

Incident: [INCIDENT SUMMARY]
Timeline and evidence: [TIMELINE AND EVIDENCE]
Impact: [IMPACT DETAILS]
People, systems, and constraints: [CONTEXT AND PARTICIPANTS]
Known follow-up work: [EXISTING ACTION ITEMS]

Produce a 900–1,300 word postmortem with these sections:

1. Executive summary: 3–5 sentences covering customer/business impact, duration, primary failure mechanism, and current status.
2. Impact and scope: affected users, services, data, revenue or commitments, and what was not affected. Separate known facts from estimates.
3. Timeline: a chronological table with time, event/observation, decision or action, and evidence source. Preserve uncertainty where timestamps conflict.
4. What happened: a concise narrative connecting triggering event, detection, response, recovery, and resolution.
5. Contributing factors: distinguish root cause, contributing conditions, and response gaps. Use “because” chains only where evidence supports them; avoid calling a person or a single mistake the root cause.
6. What worked / what did not: include detection, communications, runbooks, escalation, rollback, and decision-making when relevant.
7. Corrective actions: a table with action, failure mode addressed, owner, priority (P0/P1/P2), due date or proposed target, and verification method. Mark an owner or date as “unassigned” rather than inventing one. Prefer changes that reduce recurrence, shorten detection, or limit blast radius.
8. Open questions and decisions needed.

Before answering, check that every causal claim traces to supplied evidence and flag unsupported claims. Also check that each action addresses a stated contributing factor and has a measurable completion test. Ask up to 3 clarifying questions only if a required input is missing; otherwise state assumptions briefly and proceed.

Create a one-page executive incident readout from [INCIDENT NOTES] and [IMPACT DATA]. Include: what happened, customer and business impact, present risk, three most important contributing conditions, decisions needed from leadership, and a five-row action table with owner and due date only where supplied. Write for nontechnical leaders; define necessary technical terms in plain language. Do not name individuals as causes or invent metrics, ownership, or dates. Flag any unresolved fact that could alter the impact assessment.

Analyze [FAILURE DESCRIPTION], [EVIDENCE], and [CURRENT HYPOTHESIS] using a disciplined five-whys review. State the observed failure first, then build only evidence-supported “why” links. At each link, label it fact, inference, or unknown. Stop the chain where evidence ends instead of filling gaps. Output a table with why, supporting evidence, confidence, and what would verify it, followed by safeguards that would reduce the failure’s likelihood or blast radius. Do not assign blame to people.

Review these postmortem actions: [ACTION LIST]. For each action, identify the specific failure mode it addresses using [POSTMORTEM FINDINGS], then rate it as prevention, detection, containment, or recovery. Rewrite vague actions into testable work with a completion signal, proposed priority, dependency, and owner field. Retain supplied owners and dates; use “unassigned” or “target needed” for missing information. Output a ranked table, followed by actions that should be merged, removed, or escalated because they do not address a documented finding.