When Is an Incident Prevention Action Complete?

After an incident I shared a query improvement with the service team. Duplicate query results were increasing the amount of data sent by the database.

After the service team applied the change, we compared database outbound traffic before and after deployment. It had decreased. The work required both completing the deployment and checking whether the data-transfer load had fallen.

Comparing the numbers also requires checking traffic and query conditions. If request volume fell or another change was deployed at the same time, the decrease cannot be attributed entirely to the query change.

The scope of verification needs to be recorded as well. In this case, we verified lower outbound traffic after the improvement. That did not establish that the incident could not recur under every load condition. Checking for similar queries elsewhere also remained separate work.

Closing a prevention task should record both the change and the load it reduced. Here, completion meant deploying the query change and verifying lower database outbound traffic. Untested conditions and reviews of other queries need to remain separate follow-up work, so a completed deployment is not mistaken for eliminating every recurrence risk.