Postmortem Action Item Verification Workflow
Track action items with owners and dates, verify they actually reduce the risk, test that they work, and close them only with evidence.
Objective
Ensure postmortem action items are completed and effective, not just marked done.
Environment
- An action item tracker
- A way to test or verify each preventive change
Steps
1. Record each item with an owner,
Record each item with an owner, date, and the risk it addresses.
Expected state: Items are accountable and specific.
2. Verify the change actually reduces
Verify the change actually reduces the risk it targets.
Expected state: Fixes are effective, not cosmetic.
3. Test that the item works
Test that the item works when triggered.
Expected state: The control functions in practice.
4. Close only with evidence and review
Close only with evidence and review overdue items.
Expected state: The loop actually closes.
Decision points
Close when code merges or when verified?
- When verified
- When merged
Close when verified and tested; merged code is not evidence of effectiveness.
What if an item is not worth doing?
- Close with a rationale
- Leave open forever
Close with a documented rationale; an open item forever provides no protection and hides real gaps.
Expected outcome
Action items closed with evidence that they reduce the targeted risk, and overdue items escalated.
Verification
Confirm each closed item has attached evidence and that at least one similar incident did not recur or the control triggered.
Cleanup
Archive the evidence and update the incident record.
Overview
Ensure postmortem action items are completed and effective, not just marked done. Confirm each closed item has attached evidence and that at least one similar incident did not recur or the control triggered.
Steps
- Record each item with an owner, date, and the risk it addresses. Expected state: Items are accountable and specific.
- Verify the change actually reduces the risk it targets. Expected state: Fixes are effective, not cosmetic.
- Test that the item works when triggered. Expected state: The control functions in practice.
- Close only with evidence and review overdue items. Expected state: The loop actually closes.
# verify the alert actually fires
exit 0 # placeholder for a real control test
# attach evidence link to the action item before closing
Verification
- Action items closed with evidence that they reduce the targeted risk, and overdue items escalated.
Decision points
- Close when code merges or when verified? Options: When verified; When merged. Recommended: Close when verified and tested; merged code is not evidence of effectiveness.
- What if an item is not worth doing? Options: Close with a rationale; Leave open forever. Recommended: Close with a documented rationale; an open item forever provides no protection and hides real gaps.