The IC cannot do everything alone. Two supporting roles handle critical tasks that would otherwise consume the IC's attention and degrade the quality of the response.
The Scribe (The Historian)
In the heat of an incident, it is easy to forget what happened when. Engineers try things, abandon them, try them again. Decisions get made verbally and then forgotten. Without a record, the post-incident review becomes a reconstruction exercise based on faulty memory.
The Scribe is responsible for keeping an accurate, real-time record of the incident as it unfolds.
Responsibilities:
- Documenting a timestamped timeline of key events (e.g., "14:32 UTC — deployment rolled back to v2.1.4")
- Recording decisions made and the reasoning behind them
- Tracking which tasks are assigned to whom and their current status
- Noting when the incident was declared, escalated, and resolved
Why it matters: This timeline is invaluable during the resolution phase (it tells you what you've already tried) and is the primary input for the post-incident review (post-mortem). A good scribe's notes can turn a 3-hour post-mortem into a 45-minute one.
What the Scribe is not: The Scribe is not a passive note-taker. They should actively flag to the IC if they notice a task has been assigned but has no update for an extended period, or if the same action is being proposed that was already tried and failed.
The Liaison (The Spokesperson)
During a major incident, stakeholders outside the technical team — executives, customer support, legal, PR, sales — will desperately want updates. If they are allowed to contact engineers directly, the result is constant interruption at exactly the moment when engineers need to concentrate most.
The Liaison acts as the "human API" between the incident response team and the rest of the organization.
Responsibilities:
- Handling all inbound communication from stakeholders (so engineers don't have to)
- Providing regular, structured status updates to stakeholders on a defined cadence (e.g., every 15 minutes)
- Translating technical status into business-impact language ("The checkout service is unavailable, affecting approximately 40% of users in the EU region")
- Escalating to the IC only when a stakeholder has information that is genuinely relevant to the response
Why it matters: Every minute an engineer spends answering "what's the ETA?" is a minute not spent fixing the problem. The Liaison creates a protected space for the technical team to focus.