English
Menu

What is Incident management?

The process whose goal is to restore an IT service to normal operation as quickly as possible, using workarounds where needed, when the service stops or degrades because of a failure or similar event (an incident), so that the impact on the business is kept small. It proceeds through logging, categorization and prioritization, investigation and resolution, escalation where needed, and confirmation with the user and closure. Identifying the root cause and preventing recurrence is the role of problem management.

Japanese name: インシデント管理

Incident management appears in 3 practice questions across 2 topics, including IT Service Management and Systems Audit, Software Development and Project Management.

Field: IT Service Management and Systems Audit

How an incident is handled

Incidents are detected through contacts to the service desk or alerts from monitoring. They are first logged, categorized and given a priority based on impact and urgency. If a workaround is recorded for a known error, it is used so that work can resume immediately. Incidents the service desk cannot resolve are handed to a specialist technical team (functional escalation), and when the target time is about to be exceeded or the impact is large, they are reported to higher management (hierarchical escalation). After resolution, the incident is closed once the user has confirmed that the service is back.

Setting the priority

Priority is usually set by combining impact, the scope of users and business affected, with urgency, how quickly the incident must be resolved. For example, a failure that stops order processing for the whole company is high in both impact and urgency and gets the highest priority. A display problem on one user's screen that does not stop their work gets a low priority. Priority is not decided by the order in which incidents arrive or by the job title of the person who reported them.

Why the records matter

An incident record keeps the times of occurrence and resolution, the scope of the impact, the workaround used and the related configuration items. Aggregating these records makes it possible to report whether the resolution times promised in the SLA are being met and to analyze whether incidents with the same cause keep recurring. Recurring ones are registered as problems, and problem management investigates their root cause.

Try it: questions about Incident management

The service desk received a call from a user saying, "In the expense reimbursement system, the submit button does not respond when I attach an image of a receipt." The same symptom is registered as a known error, with the recorded workaround "the image can be submitted if it is first registered from a separate registration screen." Which of the following is the most appropriate action in incident management?

  1. AAsk the user to hold off on submitting expenses until the root cause is found and a permanent fix is completed
  2. BHave the service desk staff member guess the cause and fix the program in the production environment on the spot to prevent recurrence
  3. CTell the user about the recorded workaround so that they can continue working, and log the incident and link it to the known error
Show answer and explanation

Answer: C. Tell the user about the recorded workaround so that they can continue working, and log the incident and link it to the known error

The goal of incident management is to return the service to normal as quickly as possible and keep the effect on the business small. If a workaround is recorded for a known error, it is passed on so that the user can continue working. Logging the incident and linking it to the known error shows how often it occurs and provides input for judging the priority of a permanent fix. Resolving the root cause is done by problem management, and changes to the production environment go through change management.

FAQ

How does incident management differ from problem management?

Incident management aims to restore the service from a current failure as quickly as possible and gets work going again with a workaround even if the cause is unknown. Problem management aims to find the root cause of incidents and prevent recurrence with a permanent fix. The urgent activity of restoring service and the slower activity of removing causes are managed separately.

Is it related to information security incident response?

Information security incidents, such as unauthorized access or malware infection, are also events that damage the quality or safety of IT services, and the ideas are shared. Because they involve specific steps such as preserving evidence and reporting to outside bodies, many organizations have a specialist team such as a CSIRT handle them, linked with the incident management process.

Incident management in the explanations

Questions that mention Incident management (3)

  1. The service desk received a call from a user saying, "In the expense reimbursement system, the submit button does not respond when I attach an image of a receipt." The same symptom is registered as a known error, with the recorded workaround "the image can be submitted if it is first registered from a separate registration screen." Which of the following is the most appropriate action in incident management?
  2. In IT service management, which process mainly aims to investigate the root cause of recurring failures and prevent them from happening again through permanent fixes?
  3. Which of the following is an appropriate way to decide the priority for handling incidents?

Books on IT Service Management and Systems Audit Ad

As an Amazon Associate I earn from qualifying purchases.

Related terms

Problem management Change management Service desk Audit trail BCP (business continuity plan) CAAT (computer-assisted audit techniques) Configuration management Escalation Internal control IT governance

Back to the glossary