War-game a postmortem template before section order, severity labels, and action-item formats harden into how every incident writeup gets filed.
Postmortem templates fail when the form invents candor the culture never had, when timelines dual-count the same alert as detected and as mitigated, when action items still land without owners, and when leadership cannot show which fixes actually shipped. A neat template PDF is not evidence.
Why this ritual
Teams adopt templates to make writeups comparable. The failure mode is theater: severity labels that invent precision, "customer impact" sections that stay blank under load, and action trackers that dual-count the same ticket as done and as parked. A war game catches that before the template becomes mandatory.
What to attach
State the proposed sections, which roles must fill which fields, who owns follow-through audit, what success looks like after two quarters of completed actions and time-to-writeup, and the kill criteria if blank fields or orphaned actions past a named threshold. Attach sample incidents, current writeups, action trackers, and the measured lag from incident close to published postmortem. If eng, support, and product disagree on whether the template buys learning or just longer meetings, reconcile before seating.
Name the decision you will make if the war game finds nothing new, and the hold criteria if any required field still lacks a named owner or a measured audit path.
Attack surfaces
- On-call engineer. Fear that the form still demands detail the pager never captured.
- Support. Customer impact math that looks clean while tickets cannot show the same window.
- Product. Action items that invent capacity the roadmap will not clear.
- Leadership. Severity claims that still host retired definitions.
- Skeptic. The claim that looks strongest and is least sourced.
How to run it
Feed Pingpong the draft template and three real incident packs. First pass steelmans the sections. Later passes attack from the seats above. Final pass turns surviving objections into clearer owners, a published follow-through SLA, or a hold. Delete invented "teams already write this way" claims and dual-counted completion rates.
Force a day-after narrative: what happens if a board slide quotes learnings the template never captured, if action items never ship, or if a customer screenshots mismatched impact numbers. If those stories are stronger than your mitigation plan, fix the package before you require it. Separate a postmortem template from an incident postmortem review or a status page update so each decision stays testable.
Related: war-game a support escalation ladder, stress-test a security incident response, pretend you are the ops lead, and the war-game decisions hub. Process: how to run a Pingpong.