Incident management concepts and definitions
Domain 1 tests precision with ITIL 4 definitions and the relationships between incidents, events, service requests, problems, known errors, workarounds, impact, urgency, priority, and major incidents. Expect classification questions and priority-matrix reasoning.
Core definitions
- Incident: an unplanned interruption to a service or a reduction in the quality of a service.
- Incident management purpose: to minimize the negative impact of incidents by restoring normal service operation as quickly as possible.
- Event: any change of state that has significance for the management of a service or other configuration item. An event may lead to an incident but is not itself one.
- Service request: a user-initiated request for a normal, agreed service action, such as a password reset or information. It is handled by service request management, not incident management.
- Problem: a cause, or potential cause, of one or more incidents. A known error is a problem with a documented root cause and workaround.
- Workaround: a solution that reduces or eliminates impact when full resolution is not yet available. It resolves the incident, not the problem.
- Major incident: an incident with significant business impact, declared using organization-defined criteria.
Impact, urgency and priority
Impact is the extent of damage to the organization, customers and stakeholders. Urgency is how long resolution can be delayed without further damage. Priority is derived from impact and urgency, not from volume or seniority of the reporter.
Worked example
A payroll clerk cannot log in on payday. The affected service is payroll, impact is high because the payroll run is at risk, and urgency is high because the deadline is today; priority is therefore P1. Diagnosis shows an authentication service rejecting a subset of accounts. A local token reset restores access, so the incident is resolved and closed. A problem record is opened because the root cause is unknown. Reasoning: this is an incident, not a service request; a workaround can resolve the incident while problem management pursues the cause.
Traps that cost marks
- Classifying a standard password reset as an incident.
- Treating closure as proof that the root cause is fixed.
- Setting priority from impact alone.
- Calling every monitoring alert an incident.