Key Pages: ITIL | Recent Changes
Incident Management
ITIL Incident Management

'Real World' definition of Incident Management: IM is the way that the Service Desk puts out the 'daily fires'.

An 'Incident' is any event which is not part of the standard operation of the service and which causes, or may cause, an interruption or a reduction of the quality of the service.

The objective of Incident Management is to restore normal operations as quickly as possible with the least possible impact on either the business or the user, at a cost-effective price.

Inputs for Incident Management mostly come from users, but can have other sources as well like management Information or Detection Systems. The outputs of the process are RFC’s (Requests for Changes), resolved and closed Incidents, management information and communication to the customer.

Activities of the Incident Management process:

Incident detection and recording
Classification and initial support
Investigation and diagnosis
Resolution and recovery
Incident closure
Incident ownership, monitoring, tracking and communication

These elements provides a baseline for management review.

Incident Management Quick Overview

Mission Statement
Restore normal state IT service operations as quickly as possible to minimize the adverse impact on business operations.

Process Goal Achieve the process mission by implementing:
• ITIL-aligned Incident Management Policies, Processes and Procedures
• Incident escalation standards
• Dedicated Incident Management Process Owner
• Incident classification categories
• Incident reports
• Incident communications and education for IT staff

Critical Success Factors (CSFs)
The Critical Success Factors are:
• Maintaining IT Service Quality
• Maintaining Customer Satisfaction
• Resolving Incidents Within Established Service Times

Key Activities The key activities for this process are:
• Detect and record incidents
• Classify incidents
• Provide initial incident support
• Prioritize incidents based on impact and urgency
• Investigate and diagnose incidents
• Resolve incidents and recover service per agreed service levels
• Close incidents
• Maintain ownership, monitoring, tracking and communications about incidents
• Provide management information about Incident Management quality and operations

Key Performance Indicators (KPIs) Examples of Key Process Performance Indicators (KPIs) are shown in the list below. Each one is mapped to a Critical Success Factor (CSF).

Maintaining IT Service Quality

• Number of Severity 1 incidents (total and by category)
• Number of Severity 2 incidents (total and by category)
• Number of other incidents (total and by category)
• Number of incidents incorrectly categorized
• Number of incidents incorrectly escalated
• Number of incidents bypassing Service Desk
• Number of incidents not closed/resolved with workarounds
• Number of incidents resolved before customers notice
• Number of incidents reopened

Maintaining Customer Satisfaction

• Number of User/Customer surveys sent
• Number of User/Customer surveys responded to
• Average User/Customer survey score (total and by question category)
• Average queue time waiting for Incident response

Resolving Incidents Within Established Service Times

• Number of incidents logged
• Number of incidents resolved by Service Desk
• Number of incidents escalated by Service Desk
• Average time to restore service from point of first call
• Average time to restore Severity 1 incidents
• Average time to restore Severity 2 incidents

The Difference Between Incident Management And Problem Management

Incidents and Service Requests are formally managed through a staged process to conclusion. This process is referred to as the "Incident Management Lifecycle". The objective of the Incident Management Lifecycle is to restore the service as quickly as possible to meet Service Level Agreements. The process is primarily aimed at the user level.

Problem Management deals with resolving the underlying cause of one or more Incidents. The focus of Problem Management is to resolve the root cause of errors and to find permanent solutions. Although every effort will be made to resolve the problem as quickly as possible this process is focused on the resolution of the problem rather than the speed of the resolution. This process deals at the enterprise level.

Page locked. Please contact us if you wish to edit.

Recently Viewed:
Incident Management


This is an Open and Public Site for ITIL professionals and students. It is maintained by the ITIL community itself. Please feel free to contribute.


The ITIL volumes themselves are supplied worldwide via the publishers, TSO Books.


To interact directly on ITIL related issues, the major user forums are the ITIL Community and the ITIL Yahoo Group