Assigning the most technically skilled person as incident commander during a major incident seems logical, and yet this practice often slows down resolution: the incident commander role is a coordination role, not a debugging one, and mixing the two into a single person almost always loses efficiency on both fronts.
What an incident commander actually does
The incident commander coordinates the incident response without necessarily touching the code or infrastructure themselves: they maintain an overview of who’s working on what, communicate status to stakeholders (customer support, leadership), decide when to escalate to more people, and above all arbitrate between competing resolution paths when the technical team is split.
Why mixing the two roles slows everything down
Someone deeply debugging a complex problem (analyzing logs, testing hypotheses) no longer has the mental bandwidth to answer status questions, decide on escalation, or arbitrate between two competing approaches proposed by the team: every interruption for a coordination task takes time and focus away from the debugging task, and conversely, every minute spent debugging leaves coordination with nobody at the helm.
The trap of technical hierarchy
Automatically assigning the most senior or technically experienced person as incident commander starts from a good intention (this person understands the system), but ignores that technical skill and coordination skill are two different skills: the best person to debug isn’t necessarily the best person to manage communications and priorities during the same crisis, and forcing both roles onto one person often deprives the incident of its best technical resource by distracting them from what they do best.
What this means in practice
An effective incident commander can be someone who doesn’t understand the finest technical details of the broken system, as long as they know how to ask the right questions, synthesize answers, and make prioritization decisions. This explicit role split is what allows a blameless postmortem to honestly reconstruct an incident’s timeline: when everyone knows precisely which role they held, fact reconstruction becomes clearer, with no confusion between who was coordinating and who was actually fixing things.
Takeaway
The incident commander coordinates the incident response (status, escalation, arbitrating between competing paths), a role distinct from deep technical debugging. Assigning both roles to the same person, even the most technically skilled, almost always slows down resolution by forcing a constant choice between debugging and coordinating. Technical skill and coordination skill are two different skills: the best person to debug isn’t necessarily the best person to hold both roles at once during the same crisis.