Due Diligence Report: Incident Response Maturity (MTTR / MTTI)
Assessing whether an organization is actually eliminating failure classes, or just getting faster at repeating them.
Executive Summary
This assessment reviewed twelve months of incident history to determine whether strong recovery-time metrics corresponded to an actual reduction in recurring failure classes.
Findings
Three of the organization's five most severe incident classes recurred at least once within the review period despite strong, improving MTTR figures.
Recommendation: Introduce a formal Mean Time to Insight metric and tie post-incident review completion to release sign-off, not just incident closure.
Post-incident reviews consistently identified proximate causes but rarely traced to the underlying structural or state-transition root cause.
Recommendation: Require root-cause analysis to reach a structural explanation before a post-incident review can be closed.
Distributed tracing coverage was inconsistent across services, and the staging environment did not reliably reproduce production-scale conditions.
Recommendation: Extend tracing coverage to the remaining services and invest in a production-representative staging tier.
Conclusion
The organization's recovery capability is genuinely strong. Its insight capability, measured separately, is not, and that gap is the actual predictor of future recurring incidents, not the recovery-time metric currently being tracked.
Frequently Asked
Can an organization have good MTTR and still have a reliability problem?
Yes. Strong recovery-time metrics can coexist with recurring failure classes if post-incident reviews identify proximate causes without reaching the underlying structural root cause.