Post-Incident Review and RCA Quality Maturity Assessment
A 47-question diagnostic across 7 domains that tests whether post-incident reviews find the real, systemic causes of failure, turn them into changes that stick, meet external reporting duties and stop the same incidents...
Overview
A 47-question diagnostic across 7 domains that tests whether post-incident reviews find the real, systemic causes of failure, turn them into changes that stick, meet external reporting duties and stop the same incidents from coming back. Written for the Head of Service Operations, Problem Manager or SRE Lead who needs to answer: do our reviews tell the truth, reach the causes that matter, and make the next incident less likely?
Detailed Description
Most organizations hold some kind of review after a major incident, yet the same outages keep coming back. The usual reasons are easy to recognize: reviews happen only when someone senior insists, people hold back what they really did because they fear blame, timelines are rebuilt from memory, the analysis stops at 'human error' or the first technical fault, and actions are vague, never funded or closed without checking that they worked. This assessment examines the whole review practice in the order it has to be built. It starts with governance: a policy, named roles, clear triggers with a light and a full analysis tier, deadlines for each stage, the line between a single incident review and a problem investigation, rules for security, legal and personal data cases, and a register of every external reporting duty with its deadlines. It then tests whether honest reviews are safe, through a blameless commitment agreed with HR, trained facilitators, explaining why actions made sense at the time, checking wording for blame, a simple channel for near misses and good catches, and measuring whether people actually feel safe. The evidence domain tests whether reviews are built from system records rather than memory, including timing from synchronized timestamps, a quantified business impact, automated timelines and AI-drafted content that is traced to evidence and checked by a person. Causal analysis tests the method, taxonomy and multi-causal mapping, a separate look at how well the response itself worked, including automated and agent-based responders, supplier participation, disruptions with external causes such as power, cable, cloud region or regional conflict events, and incidents caused or worsened by AI systems and agents. Action management checks that actions are specific, balanced toward prevention, tracked, prioritized by risk and impact, verified and overseen by leadership. The final domains test whether lessons reach the repository, forums, known error records, onboarding, design reviews, the risk register and control library, whether the organization learns from other organizations' incidents, whether customers and regulators receive complete reports on time, and whether recurrence, trends and review quality are measured and used to improve the process itself. Each question is scored on three separate dimensions: is the practice documented, is it actually done, and does it produce a measurable result. That separation exposes patterns that single scores hide, such as a blameless policy nobody believes, a strong review culture that depends on one experienced facilitator, or a review program that completes every review on time while the same incidents keep recurring.
Assessment Details
Audience
Primary: Head of Service Operations / Problem Manager / SRE Lead / post-incident review process owner. Secondary: major incident managers, engineering managers, review facilitators, security incident response, risk, compliance, legal and data protection leads, HR partners, supplier and customer managers, AI platform owners and internal audit.
Purpose
Finds where learning from incidents breaks: reviews skipped or late, blame that suppresses honest accounts, timelines built from memory, impact never quantified, analysis that stops at the first cause or ignores the response, supplier, external and AI factors, actions that are vague or never verified, lessons that never reach the risk register, missed regulatory reporting deadlines, and no measure of whether incidents recur. The result is a prioritized, evidence-based improvement plan tied to named documents and measurable targets.
Effort
Initial assessment: 6-8 hours of facilitated sessions with the review process owner, major incident managers, SRE and engineering leads, review facilitators, security, risk and compliance, supplier managers and HR, plus 1-2 weeks of evidence gathering from the incident platform, review repository, action register, risk register and a sample of 10-15 recent reviews. Reassessment: 3-4 hours.
Cadence
Every 6 months; plus a targeted reassessment of Domains 2 and 4 after any major incident whose review was disputed, late or followed by a recurrence, and of Domain 1 when reporting laws, licenses or major contracts change.
Framework Alignment
KPIs
- Review Timeliness - Share of reviews published within the deadline for their tier. Target: at least 90%.
- Analysis Depth - Share of full-tier reviews passing the depth checklist before publication. Target: at least 95%.
- Action Effectiveness - Share of closed actions with recorded effectiveness evidence. Target: at least 90%.
- Recurrence Rate - Share of closed reviews followed by a recurrence of the same cause within 180 days. Target: under 10%.
- External Reporting Timeliness - Share of external post-incident reports issued within the committed or regulatory deadline. Target: at least 95%.
Dependencies
Assessment Outline
(7 domains · 47 questions)-
1
1 Post-Incident Review Governance
Review policy, roles and accountability, trigger criteria and analysis tiers, lifecycle deadlines, the boundary with problem management, handling of sensitive and security reviews, and external reporting obligations
- 1.1 Post-Incident Review Policy 1 questions
- 1.2 Review Roles and Accountability 1 questions
- 1.3 Trigger Criteria and Analysis Tiers 1 questions
- 1.4 Lifecycle Deadlines 1 questions
- 1.5 Incident and Problem Scope 1 questions
- 1.6 Sensitive and Security Review Handling 1 questions
- 1.7 External Reporting Obligations 1 questions
-
2
2 Blameless and Just Culture
Blameless commitment and just culture boundary, trained facilitators, second-story analysis, blame language checks, near-miss and good catch reporting, and psychological safety measurement
- 2.1 Blameless Commitment and Just Culture Boundary 1 questions
- 2.2 Trained Facilitators 1 questions
- 2.3 Second-Story Analysis 1 questions
- 2.4 Blame Language Review 1 questions
- 2.5 Near-Miss and Good Catch Reporting 1 questions
- 2.6 Psychological Safety Measurement 1 questions
-
3
3 Evidence and Timeline Quality
Evidence standard, capture during the incident, evidence preservation and chain of custody, timing measures from system timestamps, business impact quantification, automated evidence aggregation and AI-assisted drafting with human validation
- 3.1 Evidence-Based Timelines 1 questions
- 3.2 In-Incident Capture 1 questions
- 3.3 Evidence Preservation 1 questions
- 3.4 Timing Measures from System Timestamps 1 questions
- 3.5 Business Impact Quantification 1 questions
- 3.6 Automated Evidence Aggregation 1 questions
- 3.7 AI-Assisted Review Drafting 1 questions
-
4
4 Causal Analysis Rigor
Causal analysis methods, contributing factor taxonomy, multi-causal mapping, review of the response itself, supplier participation, disruptions with external causes, incidents involving AI systems and agents, and the independent depth review before publication
- 4.1 Causal Analysis Method Selection 1 questions
- 4.2 Contributing Factor Taxonomy 1 questions
- 4.3 Multi-Causal Mapping 1 questions
- 4.4 Response Effectiveness Analysis 1 questions
- 4.5 Supplier Participation 1 questions
- 4.6 External and Wide-Area Disruption Reviews 1 questions
- 4.7 AI and Agentic Incident Analysis 1 questions
- 4.8 Independent Depth Review 1 questions
-
5
5 Corrective and Preventive Action Management
Well-formed actions, action type balance, action tracking, prioritization by risk and impact, effectiveness verification and leadership oversight of the action pipeline
- 5.1 Well-Formed Actions 1 questions
- 5.2 Action Type Balance 1 questions
- 5.3 Action Tracking 1 questions
- 5.4 Action Prioritization and Funding 1 questions
- 5.5 Effectiveness Verification 1 questions
- 5.6 Leadership Action Oversight 1 questions
-
6
6 Knowledge Sharing and Learning
Review repository, active dissemination, known errors, onboarding and design review use, feedback into the risk register and controls, learning from other organizations' incidents, and external post-incident reports
- 6.1 Searchable Review Repository 1 questions
- 6.2 Active Dissemination 1 questions
- 6.3 Known Error and Problem Handoff 1 questions
- 6.4 Onboarding and Design Review Use 1 questions
- 6.5 Risk Register and Control Feedback 1 questions
- 6.6 Learning from External and Peer Incidents 1 questions
- 6.7 External Post-Incident Reports 1 questions
-
7
7 Measurement and Process Improvement
Review process measures, recurrence tracking, cross-review trend analysis, review quality audit, process improvement and external benchmarking
- 7.1 Review Process Measures 1 questions
- 7.2 Recurrence Tracking 1 questions
- 7.3 Cross-Review Trend Analysis 1 questions
- 7.4 Retrospective Quality Audit 1 questions
- 7.5 Review Process Improvement 1 questions
- 7.6 External Benchmarking 1 questions
At a Glance
Still have questions? Get in touch
Business Bay, Dubai, UAE
ITSGovernance