Distribute
Distribute the findings#
Your work shouldn’t be completed to be filed. It should be completed so it can be read and shared across the business even after the learning review has taken place and the corrective actions have been taken.
The findings can be integrated into company newsletters, blog posts, or synopses presented at weekly or regularly scheduled team meetings. It’s important that people in different roles get a chance to learn from the incident as well. While your incident may have primarily involved folks from engineering, everyone can benefit from the knowledge uncovered in an investigation. Also, having it available in different venues creates more opportunities for learning. Unless the report is read and utilized, learning can’t occur; just writing doesn’t guarantee learning across the organization.
Analytics or time-stamped commenting processes can be used to watch how and when the document is utilized long past the initial event. Knowing how (or if) people engage with the items you produce can help inform future reports. It can also give you insight into the things people are seeking to learn.
Tip
Investigation reports can become training documents, inform chaos experiments, serve as professional development and refresher training, and help enable meta-analysis across incidents.
Is it ever done?#
As you can see, there is a lot that goes into incident analysis and infinite learnings to uncover from a single incident. So, how do you know when to end your investigation?
In 1996, Diane Vaughan released a book titled The Challenger Launch Decision: Risk, Technology, and Culture.12 This book centers around the 1986 space shuttle Challenger disaster and the normalization of deviance that led to that fateful decision to launch. Vaughan spent almost nine years researching, writing, and editing what some would call a manifesto; the pinnacle of incident reviews. She realized that a great analysis of an incident can be iterated upon and researched thoroughly over many years. The work is never truly done.
As a practitioner of incident analysis within your organization, you probably won’t have nine years to review your incident (even the one that took your entire web server down for hours!). At some point, you want to complete your investigation. The good news is that you can complete an investigation while letting others continue to contribute to it and learn from it. When closing your investigation and finishing your incident report, you want to ensure that it is read and, if needed, iterated upon in the future. As more people read the document, more information becomes available. Creating “living documents” that can continue to grow and represent new knowledge and experiences will maintain their relevance and value to your organization.