Schedule three short checks. At 30 days confirm the urgent actions are done. At 60 days verify they work. At 90 days confirm they still hold and close the postmortem. Put the dates on the calendar when the document is published, not later.
Why follow up at all
A postmortem is only useful if its actions happen. SRE guidance says to set priorities for the resulting fixes and to review postmortems regularly, noting that an unreviewed postmortem might as well never have existed. The same is true of unreviewed actions.
Day 30: done?
Check every action with a due date in the first month. For each one, record done, in progress with a new date, or dropped with a reason. Dropping is allowed. Silently ignoring is not.
Typical day 30 items: rotated credentials confirmed, bad versions blocked everywhere, replacement artifacts deployed, inventory gaps closed.
Day 60: does it work?
Done is not the same as effective. Test each control.
| Action | Test |
|---|---|
| Waiting period for new versions | Try to add a brand new version and confirm it is held |
| Pinned build steps | Search workflows for unpinned references |
| Narrower build secrets | Check which secrets each job can now read |
| Inventory per build | Pick a past build and retrieve its inventory |
| Alert on advisory source | Send a test item and see who is notified |
Record the test, date and result. A control you have never tested is an assumption.
Day 90: still true?
Controls drift. A new repository skips the template, an exception becomes permanent, a pinned step is bumped carelessly. At 90 days sample a few projects, review the exception list, and ask whether the incident's lessons are visible in daily work.
Then close the postmortem with a note: what was done, what was accepted as risk, and what remains open with an owner.
Run it in ten minutes
Keep the meeting short and the agenda fixed.
- List actions and statuses.
- Look at any test results.
- Decide on slipped items: rescope, reassign or drop.
- Record outcomes in the postmortem.
Invite the action owners and one person from leadership if possible. Visible interest keeps actions moving.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a regularly repeated check surfaces drift that a one time review would miss.
What to do with drift
When the 90 day check finds drift, treat it as a small finding, not a failure. Note which control slipped, why it was easy to slip, and whether a default or template would stop it happening again. The best fix is often to make the safe setting the starting point for new projects, so nobody has to remember it.
Quick check
What if an action is no longer needed?
Drop it explicitly, with a reason and an approver. Do not leave it open.
Who should chair the follow up?
The postmortem owner, with the action owners present. Keep it short and fixed in format.
Sources
Last reviewed: 19 October 2026.
