About Incident Management

an incident is defined by itil as any break in the standard operation of a service that causes or might cause an interruption or reduction in the quality of that service the goal of incident management is to restore normal services as quickly as possible when an it service has been disrupted, and to make sure that business operations function normally the definition of normal service is agreed to in service level agreements with the customers of your organization incident management reduces or eliminates the effects of potential disruptions on it services, so that end users can get back to work as soon as possible to achieve this, the system records, classifies, assigns to specialists, and monitors the progress of incidents until they are resolved and closed service level agreements and escalations (in the absence of service level agreements) ensure that incidents are responded to and resolved on time with satisfactory resolution rates incident control is the process of identifying, recording, classifying, and monitoring incidents until the impacted services are restored follows these key processes of incident management as defined by itil incident detection and recording users can submit an incident by using the self service portal a user creates an incident from the portal and the system notifies the who assigns the incident to a contacting the service desk by phone or email a user calls or emails the a then creates an incident sending an email the email listener allows a user to create an incident directly from an email calling if your application uses voice, a user can create an incident from a phone call the application automatically assigns a unique reference number (called a recid) and date time stamp ( createddatetime ) to each incident s can effectively capture key information about the incident from the incident workspace end users and s can search the knowledge base for solutions during incident recording if a resolution exists in the knowledge base, the resolves the incident without further action the incident workspace helps you to manage your time and work efficiently while creating or working on incidents by providing the following features quick actions quick actions enable you to perform an action with a single click from the incident workspace, you can select an incident and perform a quick action on it without opening the incident directly open new tabs additional tabs can be opened to work on new issues or to view other modules while keeping your current sessions active classification and initial support classifying and initially supporting an incident is accomplished by the following in the incident workspace, the application classifies incidents by service and category when a service is selected from the drop down list, the category menu is populated and filtered with options from the service that you selected categorizing incidents allows the application to appropriately assign them to specialists by matching categories with skills for example, an incident with a category of desktop hardware could be assigned to the desktop hardware group categorizing incidents not only identify services that failed, but also configuration items that encountered failures this allows the application to identify trends in failures of similar services or categories categorization is also useful for reporting purposes default service level agreements are attached to some services if an incident matches a service with a configured service level agreement, the incident should be resolved according to the terms of the service level agreement as defined for the organizational unit of the incident customer refer to default priority values docid\ koal84k5cxnaejkoha1z resolution and recovery when a fixes an incident, they set the status to resolved the application tracks escalations, as configured by service level agreements (or the escalation engine in the absence of an service level agreement) of active incidents an incident is considered breached if a t does not respond to and resolve it within a certain amount of time during the initial classification of an incident, you can match the incident to another incident, a problem, or a knowledge base article by searching on the keywords in the summary field of the incident if the application finds a resolution or workaround, you can bypass the investigation and diagnosis process and resolve the incident incidents can be resolved during the initial contact with the , thus ensuring a quicker restoration of normal service for the end user the objective of incident management during an incident is to restore normal service as quickly as possible the objective is not to make an application perfect if service can be restored by a temporary workaround quicker than by correcting the underlying root cause of the issue, then that is acceptable correction of underlying root causes is done after service is restored by the problem management team by a process called root cause analysis if the cause of the incident is actually a problem, the can work with the problem management process by linking an incident to a problem or by creating a problem to link to an incident incident closure by default, the application automatically closes an incident that is in the resolved status after a few days by default, the system closes incidents after one day if there is no further communication from the user s close incidents through the escalation engine service the user or a can reopen incidents that are in the resolved state if the resolution is not satisfactory after the incident is set to closed, a or can review all of the information for the incident and update its details the system sends a link to a survey to the user, giving them an opportunity to rate the effectiveness of the in resolving the incident ownership, monitoring, tracking, and communication the application tracks and monitors incidents throughout their lifecycle until closure throughout the incident management process, the application notifies users when there is a change in the status of the incident, for example, when the incident is set to resolved users can provide feedback through a survey to rate their satisfaction with the resolution and can reopen the incident if the resolution is not satisfactory the application notifies the when a user creates an incident, and notifies the incident owner (the who the incident is assigned to) when the incident is assigned the application notifies the appropriate users, such as the user, the incident owner, or the whenever the status or priority of the incident changes, or when other conditions are met has default notification business rules but the administrator can configure new business rules to better manage incidents in your organization when an incident is closed, it remains in the application and can be viewed for reporting and analytic purposes s can view and generate dashboards and reports to determine how the performed against service level agreements (or escalations in the absence of default service level agreements) s can also view the cost of the incident while it is being worked on, and get a final cost associated with the incident when it is resolved or closed survey feedback from customers provides valuable metrics on the effectiveness and timeliness of the in resolving incidents as well as helps s track the performance of the s other process owners can also view dashboards and generate reports from incidents to aid their processes for example, a can view trends in incidents and determine if incidents are actually problems; a can view configuration items that were reported as failures