The Safety Check Before A Post-Incident Retro

I send one question before a post-incident retrospective. Twenty-four hours before the retro, everyone invited gets one question, anonymous, closing a couple hours before we meet:

On a scale of 1 to 5, how confident are you that you can say what you actually think in Thursday's retro?

And one optional free text box: What would need to be true for that number to be higher?

That is the whole thing. It takes seconds to answer and it tells me more about whether the meeting will work than any amount of prep on the timeline.

Why this has to be a survey

A topic column asks people to name the uncomfortable thing in public, often with their name on it, before they know how the room will react. That is the exact act they are already unwilling to perform. Dot voting is worse: it only works on topics that someone has already been brave enough to write down, so it measures agreement with what was sayable, not what is true.

The safety check asks about the room instead of the incident. Nobody has to accuse anyone of anything to answer it. A 2 is not an allegation, and that is why people will give you a 2.

What I actually do with the number

I have a rule I set before I look: if anyone answers 1 or 2, I do not run the retro as planned. Not a softer tone, not a reminder about blamelessness. A structural change.

For the payments incident, two people answered 2 and one free text box said "depends who's in the room." So I did three things. I asked the VP to skip it and offered him a written summary instead, which he took without argument once I told him why. I moved the first fifteen minutes to silent written timeline contributions in a shared doc that I read aloud without attribution. And I opened by saying the runbook was the first thing we were going to examine, which took the target off the engineer who ran it.

The runbook problem came out in minute eleven. The action items were a runbook audit and a change to how we flag stale docs. If I had run the meeting I originally planned, I would have left with "be more careful on Tuesday deploys" and the same outage would have found us again in the spring.

The part people get wrong

You get one chance to honour this. If you send the question, see a 2, and run the meeting exactly as you were always going to, you have taught everyone that the survey is theatre. The next one comes back all 4s and you have lost the instrument permanently.

So say out loud what you changed and why, without identifying anyone. "Some of the pre-retro responses said the format wouldn't work with a large group, so we're starting in writing." That is enough. People recognise their own answer in it and learn that answering honestly moved something.

Also: do not read free text verbatim if there is any chance of identifying the author. In an eight-person team, phrasing is a fingerprint. Summarise, generalise, and if a comment is too specific to anonymise, act on it privately instead of reporting it.

The cost of skipping it

The cost is a retro that produces an agreed-upon story everyone already believed walking in. It feels fine. It takes an hour. It leaves the actual failure untouched and standing, and the next person to hit it will be blamed for that one too.