Blameless Postmortems in a Blame-Rewarding Bank
Meridian Retail Bank has 300 engineers split across four business units and a separate operations group that controls production access. Changes pass through a change advisory board with a 10-day average approval lead time. After a payment outage, the CEO publicly blamed a junior engineer in an all-hands email and demanded 'zero incidents.' The new DevOps center of excellence has four people and a mandate to introduce blameless postmortems and cross-functional product teams. The operations manager, who has run production for 18 years, says: 'I support learning, but someone must own the mistake. If we remove blame, people will be careless.' Engineers are reluctant to raise risks because the last person who reported a near miss was moved off the payment project. The CoE has scheduled a postmortem training session for 40 managers and drafted a template that asks 'who caused the incident?' The HR performance system rewards teams for zero outages and penalizes repeat incidents.
1. Will the planned blameless postmortem training and template produce learning? Diagnose the conditions that undermine it.
Read the worked answer
No. The training and template are artifacts, but the surrounding system still punishes disclosure. The CEO blamed an individual publicly, HR rewards zero outages, the template asks who caused the incident, and a near-miss reporter was moved off a project. People will rationally withhold information. A blameless postmortem is not a meeting format; it is a safety condition in which people can describe error without retribution. That does not mean no accountability. A just culture distinguishes human error from reckless behavior and system design, and it holds people accountable for hiding information, not for being part of a failure. The template itself signals blame by asking 'who.' Replace it with questions about what information people had, what made the action seem reasonable, and which defenses failed. The CoE should also address the CEO's email directly; otherwise the training will be seen as hypocritical. Finally, cross-functional teams need production access and shared ownership, or the operations group will remain the only route to production and the same handoff failures will recur.
2. Design a first 90-day pilot that could make blameless postmortems credible. Include scope, roles, and measures.
Read the worked answer
Choose one payment-adjacent service with a known recent incident and a willing product manager and operations lead. Form a joint team with development, operations, and security, and give it production access with guardrails such as peer review and automated rollback. The first postmortem should be facilitated by someone outside the service team and opened by a senior leader stating that the purpose is learning and that no one will be punished for honest disclosure. Rewrite the template to ask about timeline, contributing conditions, detection, response, and action owners. Every action must have one owner, a due date, and a review at 30 days; the team must also identify one action it will not take and why. Publish a short learning note, not a 40-page document. Measure near-miss reports, on-time action closure, repeat incidents for the same cause, time to restore, and a short psychological-safety pulse survey before and after. Do not measure zero incidents. If reports rise and repeat causes fall, the pilot is working. If reports stay flat, the leader behavior or HR incentives have not changed enough.
3. The operations manager opposes removing blame but controls production access. How should the CoE engage him, and what should change in incentives?
Read the worked answer
Treat him as a co-owner of reliability, not an obstacle. His concern is legitimate: removing blame can sound like removing accountability for production. Clarify the distinction between accountability for learning and accountability for reckless action. Ask him to define the guardrails for production access, rollback, and change approval in the pilot. Give him a visible role in the postmortem review and in coaching the joint team. In parallel, change the HR metric. Rewarding zero outages encourages hiding and slows recovery; it also conflicts with the CEO's zero-incident demand. Replace it with availability against an agreed SLO, time to restore, repeat-incident rate, and quality of near-miss reporting. Ask the CEO to correct the public blame in a follow-up communication and to model learning. Measure adoption through behavior, not training attendance: who speaks in postmortems, how many near misses are reported, whether action items close, and whether people volunteer for on-call. Without these changes, the CoE's four people will run postmortems that engineers do not trust.