Etsy asks the engineer who erred for the account that made sense at the time

A review that opens by naming a culprit teaches the next person to leave the detail out. The room gets a cause. It does not get the sequence that produced the outage.

John Allspaw's note of 30 September 2013 is his account of how Etsy ran that review. He writes that it first appeared on Code as Craft, the company's engineering blog, and that he was reposting it while preparing to teach a postmortem facilitator's course inside Etsy. The page describes the practice as it stood then. It does not count the reviews, and it does not say a later outage fell.

The old response, as he sets it out, is to fire the person, keep them off the dangerous systems or send them on more training. He uses Sidney Dekker's label, the bad apple theory: remove the bad apples and you remove the human error. Etsy, he writes, does not take that view. Blameless postmortems are part of treating mistakes as material for learning.

A just culture, in his words, balances safety and accountability. The inquiry stays on the situation and on the decisions of the people closest to it. From an engineer who contributed, he wants what they did and when, what they saw, what they expected, what they assumed and how the timeline looked at the time. They have to say it without fear of punishment. Someone who expects a reprimand holds back the mechanism, and a repeat becomes likely.

He wants the action understood, not excused. "The action made sense to the person at the time they took it, because if it hadn't made sense to them at the time, they wouldn't have taken the action in the first place." He points to Erik Hollnagel for the same point. Accidents are not people gambling and losing. The person believes what is about to happen is not possible, or that it has no link to what they are doing, or that the result they want is worth the risk.

He calls the deeper account a second story, from the distinction in Behind Human Error. The first story treats human error as the cause and expects "be more careful" to fix it. The second treats the error as the effect of weaknesses further inside the organisation. Saying what someone should have done does not explain why the action made sense.

Engineers are not off the hook. Allspaw says they are on it for making Etsy safer, and they know their own error best, so they belong on the remediation. If punishment is the method, trust drops between the people doing the work and the managers, and the conditions under the next failure stay hidden. Managers have to see how the work is actually done, not how a Gantt chart imagines it. The people at the work say where appropriate behaviour stops. That line is not one the centre can draft alone.

One reaction is to call the cause incompetence. The other, which he argues for, is to learn how the accident happened and treat the engineers with respect. The page gives no outage count.

1. Ask for the account that was true at the time. Actions, effects, expectations, assumptions and the timeline as the person understood it. A verdict on what they should have done does not explain the action.

2. Keep punishment out of the detail. A reprimand, or the fear of one, removes the mechanism. The next outage then belongs to someone who was never told how this one worked.

3. Leave the person who erred on the fix. Blameless, here, is not an acquittal. They teach the rest of the organisation because they hold the error more closely than a chart does.

4. Do not let the centre write the line. The people at the work say where behaviour stops being appropriate. A procedure written away from the work describes a day someone hopes is happening.

A psychological safety session is a place to take one incident the team already has and ask for that account, with the person closest to it in the room and the person who would otherwise open by asking who is at fault.