Move from optimism to visible risks, controls, tests, and release decision.
A prioritized risk backlog with controls, tests, and go/no-go criteria.
You can decide whether a release or initiative is ready, which risks are accepted, and which must be mitigated first.
Own top risks, perform controls or tests, and check go/no-go criteria before the decision.
Which plausible reasons could make this initiative fail at the assumed point, and how will we detect or reduce them?
Pre-Mortem allows the team to anticipate failure and speak risks without loss of face.
The risk list is then ranked by likelihood and impact.
Which risks exceed our tolerance in the agreed horizon, and which response reduces them credibly?
Risk Matrix makes risks visible and creates shared language for urgency.
Top risks are then examined as concrete failure paths and controls.
Which credible failure paths threaten a critical service, how will we detect and limit them, and which residual uncertainty needs rehearsal?
Failure Scenario Analysis checks how risks occur, get detected, and be responded to.
Scenarios are then translated into ROAM status for control and ownership.
How will each relevant risk be treated, and what must happen before the next review?
ROAM Board sorts risks by Resolved, Owned, Accepted, and Mitigated and makes ownership visible.
ROAM status flows into release decision, follow-up, and communication.
Artifacts stay collapsed until you actually need them.
Set subject, evidence, roles, flow, and review.
# Failure Scenario Analysis: Worksheet
## Question
To be confirmed
## Desired outcome
To be confirmed
## Scope
Complete run
Time: 90–180 minutes per system area; add technical validation and drills.
Complete this worksheet on paper or in your own document during the work.
## Preparation for this scope
### Method setup
- **Materials:** System boundary, critical services, architecture/dependencies, scenario cards, signals, protections, and drill plan
- **Roles:** Service owner · reliability/safety · architecture · operations · affected domain perspectives · action owners
- **Advance information:** Set critical service, operating state, guardrails, and horizon; prepare incidents and architecture.
- **Overall time needed:** 90–180 minutes per system area; add technical validation and drills.
- **Setup:** Prepare a workspace with Service · Scenarios · Paths · Protection · Exercise; separate example from live data.
### Prepare for the work steps
#### Service: Protected outcome
- Set critical service, operating state, guardrails, and horizon; prepare incidents and architecture.
- System boundary, critical services, architecture/dependencies, scenario cards, signals, protections, and drill plan
#### Scenarios: Scenario space
- Protected outcome
#### Paths: Failure paths
- Scenario space
#### Protection: Protection matrix
- Failure paths
#### Exercise: Drill plan
- Protection matrix
## Failure Scenario Analysis · working structure
| Scenario | Trigger | Failure path | Impact | Detection | Protection | Recovery | Exercise |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Pool exhaustion | | | | | | | |
| Warehouse network down | | | | | | | |
- **Pool exhaustion:** Add evidence and rationale.
- **Warehouse network down:** Add evidence and rationale.
The blank worksheet contains prompts only.
[Reference · original teaching example](https://sre.google/sre-book/emergency-response/)
## Service: Protected outcome
Expected artifact: Protected outcome
Define critical service, success criterion, and unacceptable impacts.
Entry:
...
- [ ] Is it clear what must be preserved under which conditions?
## Scenarios: Scenario space
Expected artifact: Scenario space
Collect credible triggers from architecture, history, and environment; include compound cases.
Entry:
...
- [ ] Are scenarios concrete, plausible, and distinguishable?
## Paths: Failure paths
Expected artifact: Failure paths
Model trigger through intermediate states to impact; mark assumptions and escalation points.
Entry:
...
- [ ] Is each connection mechanistic and time-aware?
## Protection: Protection matrix
Expected artifact: Protection matrix
Check detection, prevention, mitigation, and recovery per path; mark single points and blind spots.
Entry:
...
- [ ] Does each control have signal, owner, and known limit?
## Exercise: Drill plan
Expected artifact: Drill plan
Run prioritised scenarios as tabletop, GameDay, or technical test with stop rules.
Entry:
...
- [ ] Does drill test detection, decision, recovery, and communication?
## Open questions and next steps
...
Method guide: https://methodatlas.meierhoff-systems.de/en/methods/failure-scenario-analysis/run-sheet