# 04 — Incident response

For broken appointments, angry customers, safety issues, or missed SLAs.

## Stabilize (first 15 minutes)

- [ ] Is anyone unsafe? If yes, stop work and secure the site
- [ ] Name the incident owner (one person)
- [ ] Contact the customer with status, not excuses
- [ ] Freeze related schedule changes until impact is known

## Contain

- [ ] What failed: people / process / parts / communication / tool
- [ ] Who is affected now vs later today
- [ ] Temporary workaround if quality stays acceptable
- [ ] Document facts only (timestamps, names, what was promised)

## Recover

- [ ] Offer a concrete recovery action and time
- [ ] Confirm customer acceptance of the recovery plan
- [ ] Complete recovery or escalate to owner/manager
- [ ] Update the schedule for collateral delays

## Learn (same day or next morning)

- [ ] One preventive checklist change
- [ ] One training or template update if needed
- [ ] Close the incident note with outcome

## Honesty rule

Do not invent blame. Prefer “what failed in the system” over “who is bad.”