The Workshop: Event Storming a Domain

This is the first of three posts on running Event Storming. Brandolini presents the technique starting from here — Big Picture, the widest zoom — because it’s the session you usually reach for first when you step into an unfamiliar domain. The other two posts zoom in:

Event Storming a Process — the default, smaller session you’ll run most often. Holds the full four-colour palette and the shape of a standard three-hour session.
Event Storming an Architecture — zooms further in, turning a Process Level map into a software design. Coming soon.

For the technique in action inside a small startup, see Event Storming: Building Shared Understanding.

About Event Storming

Event Storming is a workshop technique invented by Alberto Brandolini around 2013. You gather everyone who touches a domain in front of a long wall; each person grabs a pad of orange sticky notes and writes things that happened on them — in past tense, one fact per note — and sticks them up. “Order Placed.” “Payment Captured.” “Parcel Delivered.” The wall becomes the shared surface; the sticky notes become the forcing function; and the arguments that break out over where a note belongs become the thing you came for.

Three features make it work. First, it’s bottom-up: you don’t start with a model, you start with a wall of facts. Second, it’s physical: the notes, the markers, the act of reaching up to move a note you disagree with. Third, it’s democratic by design: everyone writes before anyone talks, and the most junior person in the room gets to place the first note.

Brandolini teaches three levels, in increasing precision. Big Picture (this post — whole domain, many people, days of work), Process Level (one flow, small team, three hours), and Software Design (one flow’s code boundaries, developers in the room, three hours). You usually run them in that order when you run them at all. Big Picture is the entry point; the other two posts zoom in further as you need more precision.

Intent

Build one shared picture of a whole domain — a product, a platform, a business line, a customer experience — with everyone who owns a piece of it in the same room, so the organisation can see itself end-to-end and pick the hotspots worth investigating.

The output isn’t a design, a roadmap, or a plan. It’s a long wall of orange stickies the room agrees on, pink notes marking the places that hurt, and a prioritised shortlist of follow-up sessions.

When to use it

Reach for Big Picture when:

A major initiative is starting and several teams need one picture before anyone commits
You’re new to an organisation and nobody can describe the domain end-to-end without stopping three times to ask someone else
An incident crossed six services and the timeline lives in Slack, git history, and people’s heads
Two companies are integrating and both sides need to see each other’s domains
You’re a consultant and the client has asked for “help with architecture” but you don’t yet know what help means

Don’t reach for Big Picture when:

You know which specific flow you need to work on — run Process Level on that flow
You’re ready to design code — run Event Storming an Architecture
You can’t get the right people in the room for most of a day
Leadership will sit in and correct people — you’ll get political theatre, not discovery
The scope is one team, one product, one well-understood flow — it’s too much machine for the job

Scope — the hardest decision before the session

The single most common way Big Picture sessions go wrong is the scope being wrong. Not too ambitious; wrong-shaped. Two failure modes to avoid:

Too big. “Map the whole enterprise.” An enterprise with five product lines, three channels, and two regulatory contexts is five or six separate Big Pictures, not one. If you find yourself asking “whose slice do we even start with?”, split.

Too small. “Map the deployment pipeline.” That’s a single process — it’ll fit comfortably in a Process Level session and won’t need twelve people in a room for a day.

The sweet spot. Something you can describe in one short phrase that (a) spans 3–6 teams, (b) is coherent enough to fit on one wall over a day, and (c) nobody in the organisation currently owns end-to-end. “The billing platform.” “Customer onboarding.” “Our order-to-cash.” “The claims lifecycle.” If several different people in the organisation each own a piece and none owns the whole, you’re on.

Participants

Facilitator(s). Two for groups above ten, always. One watches the wall; one watches the room. Big Picture is harder to facilitate than Process Level because the group is bigger and the failure modes are more political. Don’t run your first one alone.

Domain experts from every part of the domain. The rule: if a slice isn’t represented in the room, it’ll be missing from the wall. For an e-commerce business that means product, engineering, operations, support, finance, logistics, maybe marketing. For a bank it means front office, back office, compliance, risk, IT. Two people per slice — one with deep domain knowledge, one with freshest-to-the-job eyes.

Developers and architects. Not to design — to listen, write, and discover where the business model and the code model have quietly diverged.

Operations and frontline support. Where the surprises live. If the leadership team says the product works one way and the support team sees something different, Big Picture is where both of those truths land on the same wall. Don’t tuck them in as afterthoughts.

Sometimes leadership — with care. A sponsor who opens the session and then leaves is useful. A leader who sits in and corrects every event they disagree with kills the session. Brief them before; if they can’t hold the discipline, run without them.

Group size: 8–20. Below 8 and you’re not spanning enough of the domain; above 20 and the conversations fragment and some voices stop contributing.

Before the session

The single biggest lever on outcome quality isn’t what happens in the room — it’s the week before. Meet the sponsor and agree four things:

Scope, in one short phrase. If you can’t both say it the same way, don’t schedule the session yet.
The guest list. Every slice represented by one or two names; no political attendees.
The sponsor’s role during the session. Ideally: open, leave, come back for the wrap-up. Explicitly negotiate this. If they won’t hold it, reschedule.
The question the output has to answer. Not “do a Big Picture” — that’s the method, not the outcome. “Give us a prioritised list of cross-team investigations worth running next.” “Give us one shared picture we can point at when we disagree later.”

Without this, you’re flipping coins. With it, you’ve done half the facilitation before the first sticky goes up.

Materials and timing

Phase	Duration	Materials	Key question
Sponsor opens; ground rules	15–20 min	—	“Why are we here?”
Chaotic exploration	60–90 min	Orange notes	“What happens in this domain?”
Enforce the timeline	45–60 min	Orange notes, pink notes	“What order? What’s contested?”
Reverse narrative	20–30 min	Orange, pink	“What had to be true for this?”
Break	30–60 min	—	—
Explicit walkthrough	60–120 min	A walker, listeners	“Does this match what you know?”
Pain and systems	60 min	Pink, yellow	“Where does this hurt?”
Dot-voting	20–30 min	Sticky dots	“Which hotspots matter most?”
Wrap-up, owners, next steps	20–30 min	—	“Who does what next?”
Buffer	30–60 min	—	—
Total	Plan for a full day, minimum. Two days is common. Three for complex domains.

Big Picture is the most expensive of the three Event Storming levels by a wide margin, and the easiest to do badly. It isn’t something you cram into an afternoon.

A note on note colours

At Big Picture, you deliberately use fewer colours than you would at Process Level. Brandolini’s rule: you’re looking for shape, not precision. The palette:

Orange — domain events, in past tense. The backbone of the wall. “Order Placed.” “Parcel Delivered.”
Pink — hotspots, painpoints, disagreements, questions, places where the room stops agreeing. Every pink note is a candidate for follow-up.
Yellow — systems and people, loosely. “Stripe.” “Our warehouse.” “The customer.” Don’t worry about the person/system distinction at this level; stick it on the wall and let Process Level sort it out.
Red (or a tall vertical line) — pivotal events. The four to eight key moments where the state of the domain fundamentally changes. They emerge during the timeline phase and divide the wall into phases.

That’s the whole palette. No blue commands. No purple policies. No green read models. Those belong at Process Level. If you reach for them here, you’re on the wrong level.

Facilitator playbook

The exact phase structure varies by practitioner. Here’s a shape that works for a one-day session on a medium-sized domain (8–15 people). Scale the timings up for two-day sessions.

Phase 1 — Chaotic exploration (60–90 min)

Set the safety out loud:

“Every note is valid. Duplicates are fine. Things that might be wrong are fine — that’s exactly the kind of note this session lives on. If you’re not sure whether something counts as an event, stick it up anyway and we’ll sort it out later. Silent writing for the next hour. No talking; the wall does the talking.”

Set the granularity with a mix of examples from across the domain:

“These are events — things that happened, past tense. Order Placed. Adjuster Assigned. Complaint Filed. Integration Deployed. Account Suspended. Write at the level a domain expert would say it out loud — not a database-row level, not a strategy level.”

Name the most junior or most frontline person in the room and ask them to stick up the first note. The pattern you’re setting: this is a working session, not an executive meeting, and the least senior person writes first.

Then silence. Set a visible timer for sixty minutes; if the wall isn’t full at the hour mark, run it to ninety.

By the end you should have somewhere between 150 and 400 notes, depending on the domain. If you have fewer than 100, either the scope was wrong, the guest list was wrong, or the room hasn’t yet believed you that writing is the job.

What to watch for:

Talking instead of writing. “Get it on a note. We’ll talk during the timeline.” Repeat as needed.
Whole departments not writing. If everyone from support has three notes between them and sales has forty, something is off. Move the facilitator over. Make eye contact. Invite specific events: “What’s the first thing you see when a customer calls in?”
Executive-only events. “Strategy Agreed.” “Board Met.” If the wall is all leadership verbs, the frontline isn’t contributing yet. Something is blocking them — usually whoever is standing at the other end of the room.
People writing wishes, not events. “That sounds like what we’d like to happen. What actually happens?”

Phase 2 — Enforce the timeline (45–60 min)

Everyone talks. The job is to arrange the notes left-to-right in rough chronological order, spreading vertically into parallel tracks wherever the flow genuinely forks. It will be messy. That’s the point.

Open it:

“Put these in order. Don’t aim for perfection — rough chronology is enough. Parallel things go in parallel. If you disagree about where something goes, put a pink note on it and move on.”

Walk the room. Prompt clusters to form around parts of the domain: “discovery over here, money in the middle, fulfilment to the right.” Accept that the timeline will have several overlapping tracks.

About thirty minutes in, pause and find the pivotal events. This is the single most productive move in timeline construction, and first-time facilitators almost always skip it.

“What are the 4–8 most important events on this wall? The moments where the state of the customer, the product, or the business fundamentally changes? Call them out.”

Mark each with a tall red dashed line or a big dashed box around it. Once the pivotals are visible, the rest of the timeline organises itself into the phases between them. Teams that skip this step spend another twenty minutes arguing about whether Card Expired goes before or after Renewal Notice Sent; teams that do it first stop caring, because both events belong to the same phase.

What to watch for:

One department dominating the timeline. Pair people from different departments and give them sections.
No pink notes appearing at all. Disagreements are hidden, not absent. Prompt: “Is anything on this wall surprising you?”
Rabbit holes into policy debates. “Great policy conversation — park it. We’re looking for rough chronology.”
People trying to make it tidy too early. “It’s supposed to be messy. Tidy comes at Process Level, not here.”
Duplicates proliferating. Leave ambiguous ones — if two notes might be the same event, that’s a pink note, not a merge.
No pivotal events getting called out. The team may be too deep in the weeds. Name two you think are obvious and ask which other ones they’d add. Then let them disagree.

Phase 3 — Reverse narrative (20–30 min)

Walk the wall backwards once. This is a Brandolini move that sounds strange and is the single most effective way to find missing events.

Start at the rightmost event and ask: “What had to be true for this to happen? What had to happen just before it?” Work right to left.

“Going forwards, we tell a story we already believe. Going backwards, we discover the bits we’ve been handwaving. Every ‘we don’t know’ is a pink note. Every ‘oh wait, it must be…’ is a new orange sticky.”

Expect 20–40 new events on the reverse pass, most of them on the left-hand side of the wall where the early steps got skipped because nobody in the room owns them. The reverse narrative is where the cross-team gaps become undeniable: three teams each discover they don’t know how something actually starts, and the answer almost always involves a team that isn’t in the room.

Phase 4 — Explicit walkthrough (60–120 min)

This is what Big Picture is for. Everything before was preparation.

One person — ideally someone who thinks they know the whole flow — walks the wall end to end, out loud, narrating each event in order as if explaining it to a newcomer. Everyone else’s job is to listen and interrupt when something doesn’t match what they know.

“One of us is about to walk this wall start to finish, out loud. Their job is to narrate what happens at each event. Your job is to interrupt when it doesn’t match what you know. Interruptions are the point of this phase — hold nothing back.”

Pick the walker carefully. Not the most senior person. Not someone who’ll perform. Someone who knows a lot but not everything, who’ll narrate what they think is happening and be genuinely surprised when corrected.

The walker moves slowly — ten seconds per event, minimum. For a 300-event wall that’s 50 minutes without interruptions, and with real interruptions it’ll run 90–180. Budget double the no-interruption time.

Every interruption is precious. Pink note the disagreement, stick it on the event, and move on; don’t try to resolve during the walkthrough.

What to watch for:

The walker turning it into a lecture. “Keep moving — the interruptions are the output.”
Nobody interrupting. Either the walker is genuinely correct (rare) or the room has stopped listening. Pause; ask a specific person by name: “From where you sit in support, does this match what you hear on the phones?”
Interruptions becoming arguments. “Pink note it. Keep walking.”
The walker skipping sections. “Good — stop there. Who knows what happens next?” Let someone else take over for that stretch.
The room running out of energy. Break into 45-minute segments with stretches between.

This phase is what people remember for years. Protect it.

Phase 5 — Pain and systems (60 min)

Now add the pink notes deliberately. You already have some from the timeline and the walkthrough; add more. Also add yellow notes for the systems and people that keep reappearing across the wall.

Prompt:

“Where does this hurt? Where do people work around the system? Where is information lost? Where does a decision get made with the wrong context? Every pain point is a pink note.”

Don’t try to solve anything — just surface it. The wall should look dense with pink by the end.

Phase 6 — Dot-voting (20–30 min)

There will be too many pinks. That’s normal. Dot-voting turns the wall into a prioritised shortlist.

Give everyone five or six coloured dots and let them place them on the pinks that matter most to them. Frame it:

“We’re not fixing anything in this room. We’re picking the top 3 to 5 places worth digging into next — the places where a Process Level session will be most valuable. Put your dots where you’d most want to zoom in.”

Count. The clusters with the most dots become the candidates for follow-up Process Level work.

What to watch for:

Leadership dots dominating. If leadership votes first, the result is their priorities with a veneer. Ask the frontline to vote first, or do it anonymously.
Dots concentrating on one department. That department’s pinks may genuinely be the worst, or the voting has been political. Worth a one-minute conversation about the distribution.
Pinks with zero dots. Don’t throw them away — photograph them. They survive in the record.

Worked example — Pagebound, online indie bookshop

Imagine Pagebound, a mid-sized online independent bookshop: about 200,000 customers, six warehouses, a handful of physical partner shops, an engineering team of thirty split across product, commerce, fulfilment, and data, plus a customer support operation that fields returns and refunds.

The sponsor is the CTO. The reason for the session: “We keep hearing that things go wrong in order-to-delivery but no two teams describe the problem the same way. Before we commit to a big migration we want everyone in one room looking at the same wall.”

The scope, in one phrase: the whole Pagebound customer experience, from the moment someone first hears about a book through to the day they either recommend it to a friend or decline a repeat purchase. That’s wider than order-to-delivery on purpose — the CTO believes the real problems sit at the edges (discovery, returns, loyalty), not the middle.

Fourteen people in the room: a product lead, two engineers, a data analyst, the warehouse manager, a fulfilment team lead, a customer-success lead, a support agent who volunteered, a finance analyst, a marketing lead, a buyer (the person who decides which books Pagebound stocks), and the SRE on call that week. The CTO opens, then leaves.

By the end of the day the wall looks something like this — simplified from several hundred events to around thirty key ones grouped into six phases, with four pink hotspots and two pivotal events marked:

The moment this wall earns its cost is during the explicit walkthrough, when the customer-success lead stops the walker at Return Requested and says: “Wait — our returns logic treats a reviewed book as non-returnable because we assume the customer has opened it. Is that actually in the terms?” The finance analyst checks; it isn’t in the terms. The warehouse manager says his team has been refusing those returns for eighteen months. The support lead says she’s been authorising them case-by-case because customers complain.

Three people in a corridor would have argued about that for a month. On the wall, with marketing and commerce watching, it takes ninety seconds to surface and a pink note to capture.

That’s the thing Big Picture is for: the mismatches that only become visible when the whole wall is on view.

The four dot-voted hotspots become the candidates for follow-up work. The one with the most dots — the stock-reservation timing question — is what the Process Level post uses as its own running example.

What can go wrong

Named failure modes. Each has a symptom, a recovery move, and a threshold where you stop rather than limp through.

Nobody will commit to the whole day. Half the room drifts in and out. Recovery: Stop and reset. Rebook with people who’ll commit. Stop if: Two hours in and half the room is still on their laptops. Apologise, reschedule.

Political theatre. A senior is in the room, corrects every event they disagree with, and the frontline has stopped writing. Recovery: Name it carefully. “We need the frontline view right now. Let’s hear from support and operations first.” Stop if: The dynamic doesn’t shift. Photograph the wall, thank everyone, reschedule without the leader.

The wall of one department. 90% of notes come from engineering, or 90% from sales. Recovery: Pause writing. Give each under-represented department 20 minutes with a facilitator at their shoulder, adding events from their slice. Stop if: A department genuinely has nothing to add. Either they shouldn’t be here, or the scope is wrong.

Hotspot overwhelm. Eighty pinks and nobody knows what to do with them. Recovery: Cluster into themes before voting. Vote on themes, not individual notes. Stop if: The themes don’t cohere. Photograph everything; make the follow-up “sort offline” rather than “decide now”.

Leadership sidebar. Two or three senior people cluster together and start having their own meeting. Recovery: Interrupt it, politely, out loud. “Sidebar forming — can we bring that into the room?” Most sidebars collapse when named. Stop if: The sidebar absorbs the session. Two rooms isn’t a workshop.

Outputs

Within 24 hours of the session ending:

Panoramic high-resolution photographs of the wall, overlapping so it can be reassembled digitally. One per metre for a very long wall.
A transcribed event list, system list, and hotspot list, organised by rough zone.
A short summary message to participants: “Here’s what we found, here are the dot-voted hotspots, here’s what happens next.” Send within 24 hours, while the energy is fresh.
A schedule of 3–5 follow-up Process Level sessions, one per top hotspot. Book them within two weeks — momentum dies fast.

In the weeks after:

Pin the vocabulary that emerged. The words that kept reappearing on the wall are the start of the organisation’s shared language. Circulate a glossary.
Walk the wall with anyone who couldn’t attend. Especially peers of the attendees — their reactions tell you whether the picture lands outside the room.
Don’t try to keep the wall “current”. It’s a snapshot of a moment, not a live document. Run another Big Picture when the snapshot is stale enough to mislead — usually six to twelve months later.

Where to go next

Event Storming a Process — the natural follow-up. Big Picture finds the hotspots; Process Level zooms into one and maps it precisely. In the Pagebound example, the stock-reservation hotspot is the candidate.
Event Storming an Architecture — two zooms further in, turning a Process Level map into a software design.
Event Storming: Building Shared Understanding — the narrative post showing a smaller team running their first session.