A postmortem is the full written record of an incident and what you will change. A root cause analysis is a method for finding why it happened. An after action report reviews how the response went. They overlap, and many teams use the words loosely. Pick definitions and write them down.
Definitions
Postmortem. Google's SRE book defines it as a written record of an incident, its impact, the actions taken to mitigate or resolve it, the root causes and the follow up actions to prevent recurrence.
Root cause analysis (RCA). A technique, or a section of a postmortem, aimed at finding the underlying causes. The same chapter notes that teams use a variety of root cause techniques and choose the one that suits the service. Some customers use "RCA" to mean a document they want you to send.
After action report. Common in emergency management and the military. It reviews what was planned, what happened, what went well and what to improve, with the focus on response and coordination rather than technical cause.
Side by side
| Postmortem | RCA | After action report | |
|---|---|---|---|
| Main question | What happened and what changes? | Why did it happen? | How did the response go? |
| Scope | Whole incident | Causes | Response and coordination |
| Output | Document with actions | Causal analysis | Findings and improvement list |
| Typical reader | Team and leaders | Engineers | Response leaders |
Where each fits in a supply chain incident
- Postmortem: the full document, from impact to actions.
- RCA: the causes section. For example why a new version entered builds unreviewed.
- After action report: the response review. For example how long it took to find an owner, whether the runbook worked, whether communication was timely.
You can fold all three into one document. For a small incident, a single page is enough.
Which one to use when
- A routine incident with a clear fix: postmortem, short.
- A recurring issue with unclear cause: add a deeper RCA.
- A large multi team response, drill or exercise: add an after action review.
- A customer asks for "an RCA": send a tailored summary, not the internal file.
Avoid label fights
Do not spend meetings arguing over terms. Agree on a template with named sections and call the whole thing whatever your organisation already uses. What matters is that impact, causes, response and actions each have a place.
Watch for the single root cause trap
Complex incidents seldom have one cause. SRE guidance speaks of contributing root causes in the plural. If your RCA ends with one name or one mistake, go deeper.
Quick check
Is a postmortem the same as a blame review?
No. Blameless writing assumes everyone acted in good faith with the information they had, and looks for system causes.
Do we need all three documents?
No. Use one document with sections for impact, causes, response and actions, scaled to the incident.
Sources
Last reviewed: 19 October 2026.
