Negotiating Priorities Around Incident Investigations

Incident investigations and reports present numerous challenges, particularly when balancing time pressures, stakeholder expectations, and the types of investigations required. Inspired by Sidney Dekker's framework, investigations can serve moral, existential, preventative, and epistemological roles, often creating tensions when different approaches clash. Rapid analyses, often demanded by customers for public relations, may compromise the depth and learning potential of an investigation. At Honeycomb, the strategy involves producing multiple reports tailored to various audiences, such as status updates, preliminary reports, in-depth internal reviews, and redacted public reports, to maximize learning while addressing public and internal needs. This approach prioritizes learning from anomalies and large incidents, choosing depth over breadth in reviews, and adapting strategies as the company grows. Engaging with stakeholders and the broader community through platforms like Slack encourages continuous improvement and dialogue on incident management practices.