Post-Incident Review and RCA Quality Maturity Assessment

About this assessment

Most organizations hold some kind of review after a major incident, yet the same outages keep coming back. The usual reasons are easy to recognize: reviews happen only when someone senior insists, people hold back what they really did because they fear blame, timelines are rebuilt from memory, the analysis stops at 'human error' or the first technical fault, and actions are vague, never funded or closed without checking that they worked. This assessment examines the whole review practice in the order it has to be built. It starts with governance: a policy, named roles, clear triggers with a light and a full analysis tier, deadlines for each stage, the line between a single incident review and a problem investigation, rules for security, legal and personal data cases, and a register of every external reporting duty with its deadlines. It then tests whether honest reviews are safe, through a blameless commitment agreed with HR, trained facilitators, explaining why actions made sense at the time, checking wording for blame, a simple channel for near misses and good catches, and measuring whether people actually feel safe. The evidence domain tests whether reviews are built from system records rather than memory, including timing from synchronized timestamps, a quantified business impact, automated timelines and AI-drafted content that is traced to evidence and checked by a person. Causal analysis tests the method, taxonomy and multi-causal mapping, a separate look at how well the response itself worked, including automated and agent-based responders, supplier participation, disruptions with external causes such as power, cable, cloud region or regional conflict events, and incidents caused or worsened by AI systems and agents. Action management checks that actions are specific, balanced toward prevention, tracked, prioritized by risk and impact, verified and overseen by leadership. The final domains test whether lessons reach the repository, forums, known error records, onboarding, design reviews, the risk register and control library, whether the organization learns from other organizations' incidents, whether customers and regulators receive complete reports on time, and whether recurrence, trends and review quality are measured and used to improve the process itself. Each question is scored on three separate dimensions: is the practice documented, is it actually done, and does it produce a measurable result. That separation exposes patterns that single scores hide, such as a blameless policy nobody believes, a strong review culture that depends on one experienced facilitator, or a review program that completes every review on time while the same incidents keep recurring.