Timelines in incident investigations

When it comes to incident reporting, there are generally two widely different goals or target audiences when writing up a timeline.

The first is to give a high-level overview of the incident and to highlight key moments where there were major changes in the situation. Such an overview is meant to augment and support an incident report, serving as an aid to the reader to easily reference/contextualize key points made in a report.

For example, the start and end time of a service outage can be used to determine the duration which could help assess the overall impact of the incident.

Timelines can also be used as an investigative tool to understand events and to gain insights into the decision-making process of the people involved. This however requires a detailed timeline of high resolution because, in order to understand other people’s assessments and actions, you must try to attain the perspective of the people who were there at the time.

Their decisions were based on what they saw on “the inside of the tunnel”, based on potentially insufficient or inaccurate data, and possibly made under high stress or time pressure. ¹

It follows then that a low-resolution, high-level timeline should never be used to explain people’s actions during an incident. There is simply too little data to understand all of the factors involved, which means your view of the event will be very different, and completely non-representative, of the view the people involved in the situation had at the time.