ITIL Incident Management

'Real World' definition of Incident Management: IM is the way that the Service Desk
puts out the 'daily fires'.

An 'Incident' is any event which is not part of the standard operation of the
service and which causes, or may cause, an interruption or a reduction of the
quality of the service.

The objective of Incident Management is to restore normal operations as quickly as

possible with the least possible impact on either the business or the user, at a
cost-effective price.

Inputs for Incident Management mostly come from users, but can have other sources
as well like management Information or Detection Systems. The outputs of the
process are RFCs (Requests for Changes), resolved and closed Incidents, management
information and communication to the customer.

Activities of the Incident Management process:

Incident detection and recording

Classification and initial support
Investigation and diagnosis
Resolution and recovery
Incident closure
Incident ownership, monitoring, tracking and communication

These elements provides a baseline for management review.

Incident Management Quick Overview

Mission Statement
Restore normal state IT service operations as quickly as possible to minimize the
adverse impact on business operations.

Process Goal Achieve the process mission by implementing:

ITIL-aligned Incident Management Policies, Processes and Procedures
Incident escalation standards
Dedicated Incident Management Process Owner
Incident classification categories
Incident reports
Incident communications and education for IT staff

Critical Success Factors (CSFs) The Critical Success Factors are:

Maintaining IT Service Quality
Maintaining Customer Satisfaction
Resolving Incidents Within Established Service Times

Key Activities The key activities for this process are:

Detect and record incidents
Classify incidents
Provide initial incident support
Prioritize incidents based on impact and urgency
Investigate and diagnose incidents
Resolve incidents and recover service per agreed service levels
Close incidents
Maintain ownership, monitoring, tracking and communications about incidents
Provide management information about Incident Management quality and operations
Key Performance Indicators (KPIs) Examples of Key Process Performance Indicators
(KPIs) are shown in the list below. Each one is mapped to a Critical Success Factor
(CSF).

Maintaining IT Service Quality

Number of Severity 1 incidents (total and by category)

Number of Severity 2 incidents (total and by category)
Number of other incidents (total and by category)
Number of incidents incorrectly categorized
Number of incidents incorrectly escalated
Number of incidents bypassing Service Desk
Number of incidents not closed/resolved with workarounds
Number of incidents resolved before customers notice
Number of incidents reopened

Maintaining Customer Satisfaction

Number of User/Customer surveys sent

Number of User/Customer surveys responded to
Average User/Customer survey score (total and by question category)
Average queue time waiting for Incident response

Resolving Incidents Within Established Service Times

Number of incidents logged

Number of incidents resolved by Service Desk
Number of incidents escalated by Service Desk
Average time to restore service from point of first call
Average time to restore Severity 1 incidents
Average time to restore Severity 2 incidents
The Difference Between Incident Management And Problem Management

Incidents and Service Requests are formally managed through a staged process to
conclusion. This process is referred to as the "Incident Management Lifecycle". The
objective of the Incident Management Lifecycle is to restore the service as quickly
as possible to meet Service Level Agreements. The process is primarily aimed at the
user level.

Problem Management deals with resolving the underlying cause of one or more
Incidents. The focus of Problem Management is to resolve the root cause of errors
and to find permanent solutions. Although every effort will be made to resolve the
problem as quickly as possible this process is focused on the resolution of the
problem rather than the speed of the resolution. This process deals at the
enterprise level.