The incident handoff that beats “scroll up”

An incident handoff briefing is a short, structured summary that lets a new responder act within a minute of joining. It covers six things: impact, the current hypothesis, what’s been tried, who owns what, open questions, and the next decision. Anything longer gets skimmed. Anything shorter gets “wait, did we already…?”

Why does “scroll up” fail during an incident?

An incident channel is a log of thinking, not a record of conclusions. Hypotheses get proposed, half-tested, and quietly dropped. Rollbacks get mentioned in a thread nobody expanded. Forty minutes in, the channel holds hundreds of messages and only a handful still matter.

Someone joining late has two bad options: read everything and lose ten minutes, or skim and act on a stale picture. The second one is how two people end up restarting the same service, or how a ruled-out cause gets investigated a second time.

What should an incident handoff contain?

1. Impact. Who is affected and how badly, in one line. “Checkout p95 at 4s for ~20% of EU traffic.”
2. Current hypothesis. The best guess right now, and what changed it. Mark old hypotheses as ruled out instead of deleting them.
3. Tried. Actions already taken and their result. This is what prevents duplicate work.
4. Owners. Who is on which thread of investigation, by name.
5. Open questions. What nobody knows yet. This is where the new responder can help.
6. Next decision. The call that’s coming (roll forward, fail over, page another team) and who makes it.

Copy this on-call handoff template

Paste it into the channel, fill each line in a sentence or less, and pin it.

HANDOFF · #inc-<name> · SEV <n> · <time>

Impact:        <who is affected, how badly>
Hypothesis:    <current best guess>  (ruled out: <…>)
Tried:         <action → result>; <action → result>
Owners:        <name · thread>; <name · thread>
Open:          <question nobody can answer yet>
Next decision: <what, by whom, by when>

How do you post a handoff in Slack automatically?

Writing this by hand mid-incident is exactly the work nobody has time for. Incident Context Copilot is a free Slack bot that keeps these fields current as the channel talks, then posts the briefing for you:

• Type /handoff in the incident channel to get a briefing right away.
• When someone new joins the channel, they get one automatically.
• The same fields live in a pinned incident summary that updates every few messages.

It summarizes what responders said. It doesn’t claim a root cause or take action in your systems, so the people in the channel stay in charge of the incident.

Related