Incident memo template
A memo structure for documenting an incident: its timeline, its impact, and the remediation the institution commits to.
When to use
Document incidents with a shared structure.
Write one after any material harm, breach, or escalation, so follow-up work can be traced and audited.
- Attach the memo to incident tickets, postmortems, and audit logs.
- Publish a redacted version if external transparency is required.
- Link to mechanism evidence and diagnostics outputs for remediation.
Structure
Cover impact, root cause, and remediation.
Keep each section short and factual, and link each claim to its evidence.
- Lead with a one-paragraph summary and the affected population.
- Use a timestamped timeline to remove ambiguity about actions taken.
- Close with remediation owners and deadlines to enforce accountability.
Template
Copy and adapt this memo.
Replace the prompts with incident-specific details and link to receipts or logs where possible.
Incident memo (Template) 1) Executive summary - One-paragraph summary of the incident and outcome. - Date(s) and affected systems. - Primary impact on people, partners, or operations. 2) Timeline (UTC) - T0: Trigger detected (signal/alert/source). - T1: Triage decision + owner. - T2: Mitigation steps deployed. - T3: Incident resolved or stabilized. 3) Impact summary - Who was impacted, how, and for how long. - Scope metrics (counts, regions, cohorts). - Residual harm or unresolved exposure. 4) Root cause + contributing factors - Primary failure mode. - Contributing governance gaps. - Missing safeguards or controls. 5) Governance breakdowns - Decision or escalation failures. - Missing accountability artifacts. - Policy or mechanism gaps. 6) Remediation plan - Immediate fixes (with owners + due dates). - Medium-term prevention work. - Long-term governance upgrades. 7) Evidence + artifacts - Links to decision logs, validator outputs, receipts. - Incident-specific data snapshots and charts. - Audit-ready documentation references. 8) Follow-up commitments - Next review date. - Owner for validation. - Comms or transparency commitments.
Workflow path
Run the incident workflow in one progression
Follow a fixed sequence so handoffs remain auditable from first report to final evidence packet.
- Explainer: Incident memo workflow for shared response framing.
- Mechanism template: Failure postmortem template to route triage and stabilization responsibilities.
- Downloadable artifact: Open the prompt packs for shareable readouts and response evidence.
- Clinic/signup: Contact the clinic for live response coaching and evidence review.
Citations
Reference this template.
Cite the canonical permalink and version in incident documentation.
Copy citation (APA/BibTeX)
Cite this page Formats: APA, MLA, Chicago, BibTeX, RIS
APA
Ethotechnics Governance Council. (2026). Incident memo template. Ethotechnics Institute. https://ethotechnics.org/standards/incident-memo
MLA
Ethotechnics Governance Council. "Incident memo template." Ethotechnics Institute, 2026, https://ethotechnics.org/standards/incident-memo.
Chicago
Ethotechnics Governance Council. "Incident memo template." Ethotechnics Institute. Mar 1, 2026. https://ethotechnics.org/standards/incident-memo.
BibTeX
@misc{ethotechnics_standards_incident_memo,
title={Incident memo template},
author={Ethotechnics Governance Council},
year={2026},
howpublished={Ethotechnics Institute},
url={https://ethotechnics.org/standards/incident-memo},
version={v0.1.0}
}
RIS
TY - WEB TI - Incident memo template AU - Ethotechnics Governance Council PY - 2026 UR - https://ethotechnics.org/standards/incident-memo ER -