Blameless does not mean nobody is responsible. It means the review looks for contributing causes in systems and decisions instead of punishing a person. Accountability moves from who to blame to who owns each fix. That is a stricter standard, not a looser one.
Myth: blameless means nobody is held to account
Fact. Google's postmortem chapter says the goal is to identify contributing causes without indicting any individual or team. It also demands a written action plan with prioritised fixes and follow-up. Someone owns every item, with a date.
Myth: it assumes everyone is perfect
Fact. The assumption is good intent, not perfection. The chapter says to assume everyone involved did the right thing with the information they had. That prompts the useful question: why did the available information lead there?
Myth: you cannot name who did what
Fact. Timelines still record actions and who took them. Writing "an engineer ran the command" hides facts. What changes is the tone and the conclusion. The document says what was done and what the system allowed, not what a person should be ashamed of.
Myth: repeated mistakes are ignored
Fact. If the same action causes trouble twice, that points to a system that makes the mistake easy. Fix the system. If someone repeatedly acts in bad faith or ignores agreed process, that is a conduct issue handled separately from the postmortem.
Myth: blameless reviews are soft
Fact. They are harder to run. It is easy to stop at "human error". It takes work to find why a reasonable person made that choice.
How to keep both
- Separate the learning review from any performance process.
- State at the start that the review is about systems.
- Assign owners and dates to every action item.
- Check at the next meeting whether actions were done.
Why it matters for security
People who fear blame hide near misses, delay reporting, and tidy up evidence. Those behaviours make the next incident worse. A culture where reporting is safe finds problems sooner.
Phrases that help
Language shapes the room. Swap "why did you" for "what made that look like the right call". Swap "who missed it" for "what would have made it visible". Swap "human error" for "the interface allowed it".
These are small changes, but they signal that the review is about learning. Leaders can model them first. When the most senior person in the meeting asks a blame free question, everyone else follows, and the quality of the information that comes out of the review improves.
Quick check
Who decides if conduct was a problem?
A manager or HR process, separately from the postmortem. Keeping those two channels apart is what keeps the review honest.
Sources
Last reviewed: 19 October 2026.
