Incident review without blame
During the incident
One incident manager who decides and documents, a single communication channel, and updating customers as early as possible. Recovery precedes investigation: restore service, and collect evidence along the way.
After
Write a factual timeline, impact in numbers, what delayed detection and what delayed the fix. The last two are the important ones — detection time is usually longer than fix time, and that points to monitoring gaps.
Produce two or three actions with an owner and a date. Twenty actions mean zero actions.
Culture
The person who pressed the button is the symptom; the system that allowed it without approval, without a check, and without a way back is the problem. Teams that hunt for blame learn to hide incidents, which is far more dangerous.
Going deeper
Keep the reviews in an accessible place and read them quarterly. Recurring patterns — the same dependency, the same kind of change, the same hour of the week — point to a structural problem no single review reveals.