There’s some overlap among the following questions. The intent is to elicit observations and ideas, not to uniquely categorize them.
* What are all the factors that could have prevented the incident?
* What are all the factors that could have detected the issue before production?
* What are all the factors that could have detected the issue sooner when it did occur?
* What are all the factors that could have accelerated mitigation? (Including, especially, changes that could have reduced the risks of mitigations considered too risky to apply.)
* What are all the factors that could have accelerated remediation?
* What could have reduced the scope or impact?
It’s common to come out of this with a laundry list that overfits the last incident and, if applied, would increase the complexity of the system and add risk. We’d typically apply one or two fixes, and stockpile the rest to see if any of them would have addressed any future incident. Usually most of the “solutions” turn out to be specific to the single incident that prompted them.