Institutional Failure Postmortem Template

Standard intent

This template documents institutional failures with enforceable clocks, reversibility analysis, burden allocation, and repair paths. It is designed for governance, compliance, and safety teams who need a cite-ready artifact rather than narrative commentary.

Template structure

Seven required sections keep postmortems consistent and cite-ready.

Incident summary

What failed, scope, and the accountable authority on record.

Time-in-harm clock

Start, detect, halt, restore timestamps with evidence links.

Reversibility analysis

What could not be undone and what harm remains.

Burden allocation

Who paid, how much, and why that allocation was accepted.

Repair paths

Immediate fixes, structural changes, and verification plan.

Prevention

Design-level changes that would have prevented the failure.

Evidence + artifacts

Decision logs, data snapshots, and audit-ready records.

Required primitives

• Time-in-harm clocks with halt and restore timestamps.
• Reversibility analysis for actions that could not be undone.
• Burden allocation by group with quantified impact.
• Repair paths with owners, dates, and verification.

Template + worked example

Copy the template verbatim. The example is hypothetical and included only for structure and tone.

Institutional Failure Postmortem (PM-01 v1.0)

1) Incident summary (what failed, not who)
- System/workflow name:
- Failure mode:
- Impacted population + scope:
- Decision authority on record:

2) Time-in-harm clock (UTC)
- T0 (harm began):
- T_detect (harm detected):
- T_halt (harm stopped):
- T_restore (people restored):
- Total time-in-harm (T_restore - T0):
- Evidence for timestamps:

3) Reversibility analysis
- Actions hard to undo:
- Why reversal was costly or impossible:
- Residual harm remaining:

4) Burden allocation
- Who paid the burden (time, money, legal risk, social cost):
- Quantified burden by group:
- Burdens shifted to affected people (yes/no + description):
- Justification for allocation:

5) Repair paths
- Immediate repairs (owner, due date, proof):
- Structural repairs (policy/mechanism changes):
- Validation plan (who verifies, when):

6) Prevention (design-level)
- System changes that would have prevented the failure:
- Control plane or stop-authority changes:
- Open risks that remain:

7) Evidence + artifacts
- Decision logs, tickets, data snapshots, audit notes, validator outputs.

Worked example (hypothetical, anonymized)

1) Incident summary (what failed, not who)
- System/workflow name: Public benefits eligibility decisioning.
- Failure mode: Automated income match mis-scored seasonal earnings.
- Impacted population + scope: 3,420 applicants in 2 regions; median denial duration 19 days.
- Decision authority on record: Benefits Operations Director, case file BO-7783.

2) Time-in-harm clock (UTC)
- T0 (harm began): 2026-02-03 08:05.
- T_detect (harm detected): 2026-02-12 14:40 (appeals queue spike).
- T_halt (harm stopped): 2026-02-12 20:30 (automation paused, manual review started).
- T_restore (people restored): 2026-02-22 18:00 (benefits reinstated + backpay issued).
- Total time-in-harm (T_restore - T0): 19 days 9 hours 55 minutes.
- Evidence for timestamps: Decision log export DL-3321, ticket INC-2049, payout ledger PL-448.

3) Reversibility analysis
- Actions hard to undo: Rent arrears and missed medication for 118 households.
- Why reversal was costly or impossible: Legal recovery process exceeded benefit value for 37 cases.
- Residual harm remaining: 37 households still in arrears, 14 unresolved eviction filings.

4) Burden allocation
- Who paid the burden: Applicants (time, cash flow, legal risk), frontline staff (overtime), agency (backpay).
- Quantified burden by group: Applicants $428 median shortfall; staff 312 overtime hours; agency $1.2M backpay.
- Burdens shifted to affected people (yes/no + description): Yes — applicants bore proof and appeal effort.
- Justification for allocation: Emergency manual review available but not disclosed in initial denial.

5) Repair paths
- Immediate repairs (owner, due date, proof): Benefits Ops Director; backpay by 2026-02-22; ledger PL-448.
- Structural repairs (policy/mechanism changes): Disable seasonal income auto-denial; require human review.
- Validation plan (who verifies, when): Inspector General audit by 2026-03-15 with public summary.

6) Prevention (design-level)
- System changes that would have prevented the failure: Income match needed a seasonal earnings flag.
- Control plane or stop-authority changes: Auto-pause on appeal spike threshold; applicant-facing halt request.
- Open risks that remain: Manual review staffing ceiling during peak season.

7) Evidence + artifacts
- Decision logs DL-3321, INC-2049 timeline, PL-448 payouts, audit plan IG-2026-03.

Citation

Use the permalink and version below for formal references.

Ethotechnics Standards Council. (2026). PM-01 — Institutional Failure Postmortem Template. Ethotechnics Institute. https://ethotechnics.org/standards/pm-01-failure-postmortem-template

Ethotechnics Standards Council. "PM-01 — Institutional Failure Postmortem Template." Ethotechnics Institute, 2026, https://ethotechnics.org/standards/pm-01-failure-postmortem-template.

Ethotechnics Standards Council. "PM-01 — Institutional Failure Postmortem Template." Ethotechnics Institute. Apr 15, 2026. https://ethotechnics.org/standards/pm-01-failure-postmortem-template.

@misc{ethotechnics_standards_pm_01_failure_postmortem_template,
  title={PM-01 — Institutional Failure Postmortem Template},
  author={Ethotechnics Standards Council},
  year={2026},
  howpublished={Ethotechnics Institute},
  url={https://ethotechnics.org/standards/pm-01-failure-postmortem-template},
  version={v1.0}
}

TY  - WEB
TI  - PM-01 — Institutional Failure Postmortem Template
AU  - Ethotechnics Standards Council
PY  - 2026
UR  - https://ethotechnics.org/standards/pm-01-failure-postmortem-template
ER  -