Workflow Template

Major Incident Review Workflow

Runs the end-to-end post-incident review process for major IT incidents: intake from the review owner, root cause and corrective action capture by the review team, management sign-off with a further-investigation loop, action owner acknowledgement, and final closure once all actions are confirmed complete.

When a major IT incident hits, the scramble to write it up properly often gets pushed to the bottom of the pile — until the next incident happens and nobody can find what changed last time. This workflow takes the post-incident review from initial submission through root cause analysis, management sign-off, a built-in loop back for further investigation if gaps are found, action owner acknowledgement, and final closure. Everyone involved works from the same record, with its reference number and status, so the team lead can see at a glance where any given review stands without chasing people for updates.

Business Outcomes

Helps standardise how root cause and corrective actions are captured across every major incident review
Reduces back-and-forth chasing by keeping the review owner, review team and management working from one record
Supports faster closure by tracking action acknowledgement and completion in a visible status flow
Makes it easier to show a clear timeline of decisions and sign-off for each incident review
Cuts down on manual follow-up emails with built-in acknowledgement and status update messages

Workflow Steps

Steps

1
Create Incident Review Recordcreate record
Registers the submitted post-incident review as a record.
2
Set Status to Openupdate record
Sets the review status to Open on record creation.
3
Email Acknowledgement to Review Ownersend email
Sends the review owner an acknowledgement email with their reference number.
4
Set Status to In Reviewupdate record
Advances the review status to In Review before assigning the review team task.
5
Review Team: Root Cause Analysiscreate task
Review team records the root cause, contributing factors and corrective/preventive actions with owner and due date.
6
Save Root Cause Findings to Recordupdate record
Persists the root cause, contributing factors and corrective actions to the record.
7
Management: Review Findingscreate task
Management reviews the findings and records their decision and any gaps identified.
8
Save Management Review to Recordupdate record
Persists the management decision and identified gaps to the record.
9
Route on Management Decision
Routes to further investigation or to accepted actions based on management's decision.
management_decision: "Further investigation needed"→Set Status to Further Investigation
management_decision: "Accept"→Set Status to Actions In Progress
Default→End
10
Set Status to Further Investigationupdate record
Updates the review status to Further Investigation.
11
Review Team: Further Investigationcreate task
Review team is shown the gaps and records updated findings and actions.
12
Save Updated Findings to Recordupdate record
Persists the updated findings and actions from further investigation to the record.
13
Return to Management Reviewrestart from step
Restarts the workflow from the management review task so management can re-assess the updated findings.
14
Set Status to Actions In Progressupdate record
Updates the review status to Actions In Progress once management accepts the findings.
15
Email Review Owner: Review Approvedsend email
Notifies the review owner that the review has been approved by management.
16
Action Owners: Acknowledge Actionscreate task
Creates a fire-and-forget task for action owners to acknowledge their assigned corrective and preventive actions.
17
Review Owner: Confirm Actions Completecreate task
Review owner confirms all corrective and preventive actions are complete and records completion notes.
18
Save Completion Notes to Recordupdate record
Persists the review owner's completion notes to the record.
19
Set Status to Closedupdate record
Updates the review status to Closed now that all actions are confirmed complete.
20
Email Review Owner: Review Closedsend email
Notifies the review owner that the post-incident review is now closed.

Fields

Show all 20 fields

FormMajor Incident Post-Incident Review Intake

Review Owner Name*· Text
Review Owner Email*· Email
Incident Reference*· Text
Incident Date*· Date
Severity*· Choice
Services Affected*· Long text
Reconstructed Timeline*· Long text
Business Impact*· Long text
Response Taken*· Long text

TaskReview Team: Root Cause Analysis

Root Cause*· Long text
Contributing Factors*· Long text
Corrective and Preventive Actions*· Long text
Actions Owner*· Text
Actions Due Date*· Date

TaskManagement: Review Findings

Management Decision*· Choice
Gaps Identified*· Long text

TaskReview Team: Further Investigation

Updated Findings*· Long text
Updated Corrective and Preventive Actions*· Long text

TaskReview Owner: Confirm Actions Complete

Completion Notes*· Long text

Other fields

Review Status· Choice

Review Owner Name*
Review Owner Email*
Incident Reference*
Incident Date*
Severity*
Services Affected*

Forms

Major Incident Post-Incident Review Intake

9 fields

Data Views

Incident Reviews

incident_reference, incident_date, severity, root_cause +1 more

Dashboard Widgets

Reviews by Review Status

Recommended integrations

Setup the following integrations to extend workflow capability.

Send email in the workflow
AWS SES

major incident reviewpost incident reviewPIRincident postmortemITSM

Similar Workflows

IT Incident Management Workflow IT Problem Management Workflow Root Cause Analysis Workflow

Similar Categories

Information Technology Quality Management

FAQs

Do I need technical skills to set this up for our team?

No — the template is ready to use as soon as your workspace publishes it, with no installation or development project involved. If you want to tweak wording or add a step later, you can describe the change in plain English or edit the steps directly in the workflow editor.

Can my team customise the questions on the intake form?

Yes, the request form fields — like Incident Reference, Severity, Services Affected and Business Impact — can be adjusted through the workflow editor or by describing the change you want. Earlier versions of the workflow are kept, so you can review what changed over time.

Who actually does the work in this process?

The review owner submits the initial request and later confirms actions are complete, the review team carries out root cause analysis and any further investigation, and management reviews findings and makes the accept-or-investigate decision. Action owners get a simple task to acknowledge their assigned corrective actions, all assigned to team members within your workspace.

What happens if management decides more investigation is needed?

The status updates to Further Investigation and the review team gets a task showing the gaps management identified, where they record updated findings and actions. Once that's saved to the record, the workflow returns to the management review task so they can re-assess before the process moves forward.

Does the review owner need an account to take part?

No — the review owner interacts entirely through the public request form and emailed forms, without ever needing to log into anything. They receive an acknowledgement email with their reference number up front, and later an emailed confirmation when the review is approved and again when it's closed.

Is this suitable for smaller IT teams without a formal review board?

Yes — the workflow doesn't assume a large committee; it simply routes root cause findings to whoever is assigned the management review task, which could be one person or a small group. Since tasks and approvals are assigned to team members, it scales down easily for smaller teams while still keeping a documented trail.

How are corrective actions tracked so nothing gets missed?

The review team records each corrective and preventive action along with an owner and due date during root cause analysis, and this is saved on the record. Action owners then get a task to acknowledge their assigned actions, and the review owner later confirms completion with notes before the record moves to Closed.

What does the record show once a review is closed?

Each incident review record keeps its reference number, current status and a full timeline of what happened, including root cause findings, management decisions, any further investigation, and completion notes. Table views and dashboards can show these records grouped by status, so you can see closed versus in-progress reviews at a glance.

Can we notify the review owner by SMS instead of just email?

Email and SMS are both built into the platform, so notification steps like the approval and closure messages can be set up to use either channel. A workspace can also connect its own AWS SES, AWS SNS or Twilio account if it wants to send through its own service.

Ready to use this workflow?

Create a free account and customise this workflow for your business.