Blameless Postmortem
An incident review that seeks the systemic conditions that made a failure possible, explicitly excluding individual fault.
The premise is that people act reasonably given the information and tools they have, so an incident caused by "human error" is an incident whose real cause is a system that permitted the error — an ambiguous runbook, a dangerous default, a deploy tool with no confirmation, an alert that fires so often it is ignored.
Blamelessness is not politeness. It is the condition under which people describe what actually happened, including the parts that make them look bad, which is the only way the real chain becomes visible.
The output that matters is a small number of assigned, dated actions. A postmortem whose actions are never completed is a document, not a control.