Postincidentanalys

Postincidentanalys (commonly written as post-incident analysis) is a systematic review conducted after an incident to determine what happened, why it happened, and how to prevent recurrence. It is used to learn from failures without assigning blame, with the goal of improving resilience, safety, and incident response.

The process typically begins with data collection and event reconstruction, gathering logs, alerts, witness accounts, and timeline details. Analysts identify direct causes and contributing factors, often using root cause analysis methods such as the 5 whys, fishbone diagrams, fault tree analysis, or failure mode and effects analysis. Organizational and human factors, process gaps, and tool limitations are considered alongside technical faults.

Outputs include an incident report or postincident report, a documented root cause, an action plan with corrective and preventive measures, and updated runbooks, training, or design changes. The analysis informs risk reduction, policy updates, and may trigger changes in controls, incident response playbooks, or software deployments. It is typically conducted in a blameless environment and may involve multiple stakeholders from operations, engineering, security, and safety.

Challenges include incomplete data, bias, coordinating across teams, and ensuring timely completion. Benefits include reduced recurrence, stronger detection and response, and improved organizational learning. Related concepts include postmortems in IT, after-action reviews in the military, and safety investigations.