We were really curious about what happens after a company resolves an incident. How long does it take for them to document, review, learn from it, finish clean-up tasks, and complete any other follow-up actions? We work with all kinds of companies, from small start-ups to big Enterprises, and we wanted to find out where they spend their time post-incident.
Follow-ups are crucial. They help prevent the same issue from happening again, improve products, and make resolving future incidents quicker. We analyzed 14,000 follow-ups from real incidents and discovered that, on average, it takes 7 days to complete them. Smaller companies are slightly faster, with those under 100 employees taking around 5 days. The quickest 25% complete follow-ups in under a day, while the slowest 25% take about 3 weeks. Interestingly, medium-sized companies (250-500 employees) are the slowest at completing follow-ups.
Post-incident tasks, like creating postmortem documents and ensuring accurate timestamps, are also important. We looked at 13,000 real incidents and found that, on average, these tasks take less than a day to complete. However, the time spent on each task varies – reviewing follow-up action items takes about 3 hours, creating a postmortem document takes under 2 hours, and completing and sharing the postmortem document takes around 4 days. The fastest 25% complete postmortems within 24 hours, while the slowest 25% take over a week.
It’s essential to get the right people together for a debrief meeting to discuss postmortem learnings. On average, folks schedule this meeting within a day. We’re constantly working on ways to make this process faster and more efficient, like exploring AI-generated learnings.
In conclusion, the post-incident phase is crucial for learning and improvement. By analyzing where companies spend their time during this phase, we aim to help organizations learn from their incidents more quickly and effectively.
