ITIL 4 IM study guide
ITIL 4 IM · Work through your exam, one topic at a time.
The ITIL 4 Specialist: Incident Management certification is a PeopleCert ITIL 4 qualification aimed at practitioners who already hold ITIL 4 Foundation and want to specialise in restoring normal service operation quickly and effectively. It suits incident managers, service desk and support team leads, major incident coordinators, problem and change practitioners who work alongside incident teams, and service owners accountable for reliability. The ITIL 4 IM study guide has 5 sections and about 2,042 words.
01Incident management concepts and definitions
Domain 1 tests precision with ITIL 4 definitions and the relationships between incidents, events, service requests, problems, known errors, workarounds, impact, urgency, priority, and major incidents. Expect classification questions and priority-matrix reasoning.
425 words, about 2 min02Incident management roles, responsibilities and value streams
Domain 2 tests who owns and coordinates incidents, how ownership differs from assignment and resolution, and where incident management sits in end-to-end value streams. Incident owner: accountable for the incident throughout its lifecycle; maintains the record, coordinates progress, communicates and ensures closure.
405 words, about 2 min03Incident management processes and practices
Domain 3 tests the activity flow of the incident management practice, how priority and escalation work, how major incidents are handled, and how incident management interfaces with problem, change and knowledge management. ITIL 4 does not mandate a rigid process, but expects these activities to be designed into value streams.
417 words, about 2 min04Incident management information, tools and technology
Domain 4 tests what information an incident record must hold, how tools support detection through closure, and how CMDB, knowledge, monitoring, automation and reporting contribute to effective incident management. A useful record includes a unique ID; timestamps for detection, resolution and closure; reporter and affected users; affected services and configuration items; symptoms; impact, urgency and priority; category; status; assignment group and owner; workaround and resolution; closure code; linked problem, known error, change and major incident flag; and a communication log.
392 words, about 2 min05Incident management in the wider service value system
Domain 5 tests how incident management fits the service value system: the service value chain, the four dimensions, governance, guiding principles, other practices and continual improvement. Service value chain: incident management mainly supports Deliver and Support; Engage for user and stakeholder communication; Improve for post-incident review; Design and Transition for early-life incidents; Obtain/Build for supplier-caused incidents.
403 words, about 2 min