Guide
How to write up a tech wreck
A good incident report lets someone who was not there understand what happened, what it cost and what changes now. Here is the method TechWreck follows, step by step.
Write it within a day or two
Memory fades fast and chat messages scroll away. Start the report while people still remember the order of events. A report counts as open until you fill in "Back to normal" (when the service or the data was back); the fixes are tracked separately as action items.
Build the timeline first
Collect times from wherever they were left: chat messages, emails, error messages, device and server logs, phone call history. Paste them in; TechWreck turns each line that carries a time in a common log or chat format (the editor lists them) into an entry and sorts them. Email headers such as "Sent: Tuesday, October 13" are not read, so type those times in. Then mark the key moments: when it was noticed, what people did, who was told, and when it was fixed.
Measure the impact honestly
Count the people and customers affected, and say plainly whether any data was lost or exposed, including "not known yet". The cost estimate is people time (people × hours × cost of an hour) plus lost sales, outside help and parts. It is an estimate; say what you assumed.
Ask "why?" until you reach something you can change
The five whys technique, made famous by Toyota's production system, asks why the problem happened, then why that happened, and so on. Answer each with a fact. Five is a guide, not a rule: stop when the answer is something you can change.
Keep it blameless
"Pat deleted the folder" ends the inquiry. "The shared folder could be deleted with one click and no confirmation" starts a fix. People make mistakes; a report should find the conditions that made the mistake easy or its damage large. TechWreck's Report Check flags blame words such as "human error" or "careless".
Turn causes into action items
For each cause, write at least one change. Mark it Prevent (it cannot happen again), Detect (you will know sooner) or Respond (you will fix it faster). Give every item an owner, written as a role, and a due date. A report whose action items are all "Respond" usually means the cause is still there.
Share it and follow the fixes
Print the report or save it as a PDF and share it with the people affected. Before you print, untick "Headers and footers" in the print window: otherwise the browser prints the page address, which is your desk's private link, at the foot of every page. The report shows "Back to normal" once the service is back; the action items stay open until each is marked done, and the Desk Pass Action Board keeps the open ones in view across all your reports.