Incident vs Postmortem

Different artifacts.

Overview

The incident record and the postmortem are distinct artifacts that serve different audiences at different times. The incident record is the real-time operational truth captured during the incident: Slack channel, status page updates, ticket. The postmortem is the analytical document produced days later: timeline, root cause and contributing factors, action items. Conflating them produces postmortems that read like Slack archeology and incident records that try to be analyses too soon.

• Incident record: real-time. Slack thread, ticket, status updates as the incident unfolds; operational truth captured live.
• Postmortem: analytical. Timeline, root cause and contributing factors, action items; analytical document produced days later.
• Different audiences. Incident record for the response team; postmortem for engineering and leadership.
• Different timing plus rigor. Incident record is now and fast; postmortem is days later and thorough.

The approach

The practical approach is to keep the incident record during the incident (Slack channel auto-created, status page updates, ticket tracked), produce the postmortem within seven days of incident close, link the two artifacts so the postmortem references the incident record for traceability, use different templates for each artifact, and document the per-team workflow so new on-callers know which artifact to produce when.

• Incident record during. Slack channel, status page, ticket; the operational truth captured as the incident unfolds.
• Postmortem after. Within seven days of incident close; the analytical document with the team perspective the immediate response cannot have.
• Link them. Postmortem references incident record; the traceability supports later investigation.
• Different templates plus documented workflow. Each artifact has its own structure; per-team workflow committed for new on-callers.

Why this compounds

The distinction compounds across incidents. Each incident record supports active response without trying to be an analysis; each postmortem produces analytical depth without being slowed by real-time constraints; the team builds vocabulary for both surfaces that pays off in every incident.

• Incident response. Real-time record supports active response; the team coordinates around current state, not analysis.
• Learning. Analytical postmortem supports root-cause analysis; the document has the perspective the live incident lacked.
• Audit trail. Both artifacts together produce complete history; the response and the analysis are both preserved.
• Operational culture. Distinct artifacts signal that both matter; the team treats response and analysis as separate engineering work.

The incident-vs-postmortem distinction is an operational discipline that pays off across years. Nova AI Ops integrates with incident telemetry, surfaces both surfaces, and supports the team’s incident management discipline.