Design the first fifteen minutes of a post-incident debrief for six responders, three of whom have already agreed in the incident channel that the cause was a bad config push. What do you ask, in what order, and what must the facilitator not do?

What the first fifteen minutes has to produce

Not a cause. A set of descriptions detailed enough that the places where two people saw different things become visible. Etsy published its Debriefing Facilitation Guide in 2016 - written by John Allspaw, Morgan Evans and Daniel Schauenberg, and released as an open document - on the premise that a group usually arrives with a rationalised story already settled, and that what the session learns depends on the questions the facilitator asks rather than on the data available. One of its sections is titled "Remember to Look for Descriptions, Not Explanations".

The three responders who have already named the config push are not wrong. They are finished, which is the problem: a group that starts from a cause spends the session collecting support for it.

The design

Minutes 0 to 2 - state the output and park the cause. Say that the session produces a description of how each person saw the event, that the config push goes on a visible list, and that the list is returned to at the end. Parking it publicly is what stops it being defended; banning it makes people defend it harder.

Minutes 2 to 12 - one person at a time, in the order they joined the incident. Four questions, all description-shaped:

• What did you see on your screen when you joined?
• What did you do next, and what did you expect that to do?
• What made you think it had worked, or not worked?
• What else were you considering at that moment?

Not "why did you not check the dashboard". A why-question about an action invites a justification, and a justification is a story constructed after the outcome was known. A what-did-you-see question returns the information the person actually had, which is the only thing that generalises.

Minutes 12 to 15 - name the disagreements. Where two accounts conflict about the same minute, write both on the board. A debrief that surfaces no disagreement has reproduced the story the room walked in with and can be ended early.

The hard part

The facilitator cannot be in the responders' management chain and cannot have been on the incident. Both are common and both are fatal to the output: people do not describe a confusing twenty minutes in front of the person who writes their review, and a facilitator who was there supplies the missing pieces from memory instead of eliciting them.

What it costs

Six responders for 90 minutes plus a facilitator is about ten person-hours per incident, and this format reliably produces fewer action items than a cause-first review, because most of the output is understanding rather than tickets. An organisation that measures debriefs by action items created will rate it as a worse meeting.

When this is the wrong answer

When the surprise is low. A certificate expired, nobody was paged, the fix is a renewal alarm: run the fifteen-minute cause-first version and schedule the work. Reserve the full format for incidents where the responders were genuinely confused, because confusion is the signal that the organisation's model of its own system is wrong, and that is the only thing this format finds that a ticket cannot.