Incident Phase Review¶
Structured retrospective — instantiates Periodization Frame Design
Segments a single incident into phases by what people could know or do at each stage, so lessons attach to the right moment instead of collapsing into "during the outage."
An Incident Phase Review applies periodization to a single episode by cutting it at the moments when what people could know or do changed. Its segmentation criterion is epistemic and operational, not chronological: a new phase begins when a signal became available, a capability was lost, or the responders' options shifted. That criterion is what separates latent-condition buildup from the trigger, the trigger from detection, detection from mitigation, and mitigation from recovery — precisely so that a lesson lands on the phase where it applies. A fix for "we couldn't see the failure for forty minutes" belongs to the detection phase; a fix for "the failure was inevitable once the config drifted" belongs to the latent phase. The review's discipline is that these boundaries are drawn from the changing knowledge-and-action state, and it pays special attention to the blurry stretches — a detection that dawned gradually — rather than pretending each phase snapped cleanly into the next.
Example¶
A cloud provider suffers a four-hour regional outage and runs an Incident Phase Review rather than a single "what went wrong" writeup. The reviewer marks the latent phase — weeks of quietly accumulating configuration drift that no dashboard surfaced. The trigger is a single deploy that tipped the drifted state over. Then comes the hardest boundary: detection. Alerts fired at 02:14, but on-call dismissed them as noise until 02:51, so the review draws a transitional zone across that 37-minute stretch where the incident was technically visible but not yet believed. Mitigation begins when traffic is shed; recovery when the region is healthy; hardening when the config-drift check ships.
The payoff shows up in where the action items land. Under a flat "during the outage" account, every lesson would pile onto the responders. Segmented, the review sends the alerting fix to the detection phase, the drift-check to the latent phase, and the traffic-shedding runbook to mitigation — and the ambiguous 37 minutes, sitting in a labeled transitional zone, becomes its own question rather than a stick to beat the on-call engineer with.
How it works¶
- Cut at knowledge-and-action changes, not the clock. A boundary is drawn where a signal appeared, a capability was lost, or responders' options shifted — the criterion that makes phase-specific learning possible.
- Anchor each phase on its opening moment. The trigger, the first alert, the mitigation start are named as the concrete moments that open their phases, so the segmentation is auditable against the timeline.
- Draw transitional zones over gradual boundaries. Where a phase dawned rather than snapped — a slow detection, a partial recovery — the review marks a spanned zone instead of forcing a false instant.
- Stress the boundary cases. Events that sit awkwardly between phases are examined directly, since a pile-up of misfit events is the signal that the phase skeleton is wrong for this incident.
Tuning parameters¶
- Phase resolution — a coarse three-phase cut versus a fine seven-phase one; finer phases localize lessons precisely but can fragment a fast incident into meaningless slivers.
- Transitional-zone tolerance — how readily an ambiguous stretch is drawn as a zone rather than a point; generous zones honor gradual reality but blur accountability, sharp points aid decisions but manufacture false certainty.
- Epistemic vs. clock anchoring — how strictly boundaries follow "what could be known" rather than wall-clock milestones; strict epistemic anchoring surfaces the real learning but is harder to reconstruct after the fact.
- Edge-case threshold — how many misfit events trigger a rethink of the phase skeleton before the review commits to it.
When it helps, and when it misleads¶
The review is at its best when phases genuinely change what responders could know or do — its whole value is preventing every lesson from collapsing into one undifferentiated blob and misassigning blame to the visible responders instead of the latent conditions. Its central hazard is hindsight bias: knowing how the incident ended, a reviewer draws the detection boundary as if the signal were obviously actionable at the time, when in the moment it was one alert among hundreds.[n1] The classic misuse is retrofitting the phases to justify a conclusion already reached — sliding the "should have detected" boundary earlier to make negligence look self-evident. The guard is to reconstruct each boundary from contemporaneous knowledge — what was actually on the screens then — and to let a labeled transitional zone hold the ambiguity rather than resolving it into a clean point that hindsight makes look inevitable.
How it implements the components¶
An Incident Phase Review fills the single-episode segmentation slice — the components that cut one incident by its changing knowledge-and-action state:
- turning_point — names the trigger, the first alert, the mitigation start as the concrete moments that open each phase, tested for whether they actually changed the responders' state.
- edge_case_review — examines events that sit awkwardly between phases, treating a pile-up of misfits as evidence the phase skeleton is wrong for this incident.
- transitional_zone — draws a spanned zone across gradual boundaries — a slow detection, a partial recovery — instead of forcing a false instant.
It does not implement periodization_purpose or alternative_periodization — that is Retrospective Period Labeling Session, a facilitated group that negotiates why the phases are being named and generates competing rival labels; the Incident Phase Review is an analyst applying a fixed epistemic phase skeleton to one incident, not a group contesting the naming.
Related¶
- Instantiates: Periodization Frame Design — the review applies the archetype to a single incident, cutting it by changes in what could be known or done.
- Sibling mechanisms: Phase Timeline · Historical Period Map · Boundary Criteria Matrix · Lifecycle Phase Map · Retrospective Period Labeling Session · Regime Timeline · Era Label Review
Editorial Notes¶
Form Classification¶
Form family: Assessment, Review & Assurance
Rationale: Incident Phase Review operates as a bounded evaluation of existing evidence or work that produces a finding or disposition because it segments a single incident into phases by what people could know or do at each stage, so lessons attach to the right moment instead of collapsing into 'during the outage.'
Independent corroboration: The frozen evidence defines Incident Phase Review as 'Segments a single incident into phases by what people could know or do at each stage, so lessons attach to the right moment instead of collapsing into 'during the outage.'', so its operative form is Assessment, Review & Assurance.
Review outcome: Independent reviewer agreement; high confidence.
Origin Attribution¶
Primary origin: Engineering & Design
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Multi-domain
Rationale: Reconstructing what was knowable and actionable at successive incident stages is a safety-engineering after-action method.
Related originating lineages:
- History & Historiography — Periodization provides the explicit segmentation of one history into evidence-justified phases.
- Psychology — Hindsight-bias research supplies the need to recover contemporaneous knowledge boundaries.
Review resolution: Both reviewers independently assign engineering_design as the primary originating domain, so that shared primary is retained. Alternate domains are the union of reviewer-identified formative or independently originating lineages; later application settings alone are excluded. The final form materially composes methods or concepts from more than one formative domain. It has established independent use across several domains, but that does not make it domain-free. The encyclopedia entry makes that composition explicit.
Attribution caveat: The phase-review form is a new synthesis of incident analysis and historiographic periodization.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Reconciled after independent review; medium confidence.
Notes¶
[n1] Hindsight bias — documented by Baruch Fischhoff — is the tendency, once an outcome is known, to see it as having been predictable all along. In a phase review it silently pulls the detection boundary earlier, making a signal that was genuinely ambiguous at the time look like an obvious miss. Reconstructing boundaries from contemporaneous knowledge is the standard corrective. ↩