TL;DR: Correct inaccurate facts when they affect the response or your work record, and keep the immediate focus on safe recovery. Use a verified timeline to establish contributing causes; address repeated personal blame through the appropriate management process.
How to approach it
Explain what was said, what evidence contradicted it and what you knew at that moment. Distinguish a mistaken hypothesis from a personal accusation. You can advocate for yourself without claiming to know the other person's motives.
A strong answer
A false attribution can change recovery decisions, so silence is not always the right response during an incident. If the team is about to reverse your deployment because someone assumes it caused the outage, explain the contradictory evidence promptly. Keep the correction tied to the proposed action: “The first failures precede this deployment in the request logs. Before we roll it back, we should check whether it touched the affected path.”
That timestamp does not prove the deployment is irrelevant. It may have worsened an existing failure, and timestamps from different systems may have clock or collection delays. State the uncertainty and examine the mechanism rather than using one log line as a declaration of innocence.
In a fictional scenario, a bridge-call participant says your cache configuration caused payment timeouts. The initial timeline shows timeouts at 13:58 and your change at 14:05. You supply the change identifier, confirm the clocks being compared and ask the incident commander to assign a parallel check of the cache path. You continue handling your assigned recovery work while another responder investigates a database failover at 13:56.
The later review finds that connection recovery after that failover triggered the timeouts. Your change affected an unrelated read cache. Record both conclusions with their evidence. The useful account explains why the cache change was ruled out, not merely that a different team performed an earlier operation.
If the inaccurate statement appears in a shared incident summary, ask for that summary to be corrected where its readers can see the update. Include the evidence and the corrected wording. There is no universal “correct it only once” rule: if the claim persists in a customer report or performance record, further factual correction and escalation may be necessary.
Keep the postmortem focused on the conditions that allowed the failure and delayed recovery. That can include unclear change visibility or an investigation process that treated the latest deployment as the only hypothesis. Accurate attribution remains part of the timeline, but naming an operator alone does not explain why the system failed.
After the response, discuss the personal interaction privately if that is appropriate. Describe what happened and the change you need: “The attribution was presented as established before the timeline check. Please mark that kind of statement as a hypothesis until we verify it.” You do not need to assume malice, promise reconciliation or accept repeated mistreatment to give a professional answer.
If blame is repeated or affects your employment record, involve the relevant manager or reporting process with the factual record. Preserve confidentiality and avoid distributing sensitive logs more widely just to defend yourself. In the interview, explain what you did and the outcome you know; do not claim that everyone accepted the correction if they did not.
What interviewers probe next
“Would you name who performed the triggering change?” Include accurate actions and owners where the incident record requires them. Explain the contributing conditions and follow-up separately from any management assessment of conduct.
“What if you were partly responsible?” Correct the inaccurate claim while owning the part supported by evidence. A shared failure can involve your change and a pre-existing weakness at the same time.
“Your manager does not correct the record.” Identify the remaining inaccurate document or decision, request a specific correction and use the appropriate escalation path. The next step depends on its consequence, not a fixed number of reminders.
Common mistakes
Calling a timeline “proof” before checking clocks and the affected path can replace one unsupported claim with another.
A story entirely about vindication leaves the recovery contribution unexplained. Include the action you continued to own while the attribution was investigated.
Rehearse a version where the evidence implicates your change after all. Your method should allow you to update the conclusion without hiding the earlier uncertainty.