A written review after an incident that asks why the system allowed the failure, not who erred, and ends in concrete action items.