← Incident Manager: coordination, recovery, and learning
09 / 9 · 60 MIN

Recovery, closure, and a command exercise

Validate outcomes, transfer residual work, and practice decisions under changing context.

Validate the affected obligation

Available servers and completed processes are useful observations, but the obligation may include received delivery and reconciled outcomes. If 232 of 240 expected files were validated, eight remain unresolved; that establishes neither permanent loss nor full recovery. In a smaller set, source A/B/C/D and destination A/B/C/X have the same count but different identities. Before retrying, establish whether X is a valid transformation of D or an unexpected result. A timeout does not establish that the destination applied no effects. Nor should five successful reads be extrapolated to writing and export when those capabilities were affected. Request evidence appropriate to recovery criteria with owners and limitations. If manual operation is accepted for a subset, retain that the automatic solution remains unresolved and manual capacity is not unlimited. Report established outcomes separately from work that still needs investigation or explicit acceptance.

Transfer residual work and reduce mobilization

Useful handover identifies residual actions, state, owner, next checkpoint, contacts, and escalation conditions. Sending a link does not establish that someone took ownership. If the receiving team can view the dashboard but cannot execute recovery, resolve access or agree effective coverage before declaring autonomy. When service stabilizes, confirm who remains necessary and how to recall others. Everyone need not remain mobilized until every structural cause is fixed, but coordination should not all close merely because one component turned green. If new evidence contradicts recovery criteria, reassess impact and reactivate the applicable response, linking new state to history. Manual mitigation with an 18:00 review needs an owner until that decision even if the main call ends. The record should allow someone who did not participate to understand what still needs action. Reducing mobilization is a deliberate transition of responsibilities rather than disappearance of the remaining obligations.

Original guide for a facilitated session

This guide has not yet been executed by a group. Use fictional data and send no real commands or messages. Assign coordination, operations, communication, and observation roles; one person may combine roles in an individual session, recording that limitation. At minute zero, present overlapping account lists and the delivery deadline. At minute five, reveal that two workstreams need Sofia and want to change X. At minute ten, state that an option was approved but execution remains unconfirmed. At minute fifteen, present the premature complete-delivery message and four missing files. At minute twenty, request handover to another coordinator after state changed from v7 to v8. At minute twenty-five, offer bounded manual mitigation with a scheduled review. At each phase, the participant records a decision, assumptions, responsible person, and next checkpoint, and may request additional information from the facilitator. The facilitator should distinguish information supplied by the exercise from an assumption invented by the participant.

Review behavior and effectiveness

Reserve fifteen minutes for discussion after the phases. The observer seeks evidence that impact was counted without duplication, dependencies were exposed, execution was distinguished from approval, the incorrect message was corrected, and handover covered v8. Record what happened, what remained unobserved, and an acceptable alternative; this rubric awards no professional certification. Choose one gap and repeat the phase after feedback to observe whether behavior changes. An action to “communicate better” is less verifiable than rehearsing reassignment with notification and acknowledgment from the earlier executor. When analyzing metrics, check definitions and population: the median of 20/25/40/70/90 is forty; removing the two long cases makes it twenty-five without improving any outcome. The earlier laboratory demonstrates that arithmetic and some record rules. It establishes neither human understanding, real authority, channel availability, nor execution of this tabletop. Independent specialist review and facilitated practice remain further work beyond the authored exercise.

Phase | Observed decision | Assumption | Owner | Next checkpoint | Limitation
0: impact and deadline
5: dependency and capacity
10: decision versus execution
15: message correction
20: v8 handover
25: residual work and review
30–45: feedback and repeat one phase
IN PRACTICE

The rubric may record “cadence met; recovery announced before reconciliation.” Retain the positive result and the specific gap, then repeat the communication phase with new evidence.

Common pitfalls

Equal counts treated as reconciliation; reads as evidence of writes; sending as acceptance; lower median as causal improvement; a script as assessment of human understanding.

Related topics: Integrity and reconciliation · Post-incident learning · Coordination exercises

Take this idea with you

Conclude response with validated outcomes and accepted residual work; use the exercise to observe decisions and repeat concrete gaps.

Create account

Reference: Data Integrity: What You Read Is What You Wrote · Google SRE incident guidance; PagerDuty contextual incident model; NIST SP 800-61 Rev. 3 April 2025; editorial review 2026-10-01