Incident management roles, responsibilities and value streams
Domain 2 tests who owns and coordinates incidents, how ownership differs from assignment and resolution, and where incident management sits in end-to-end value streams.
Roles and responsibilities
- Incident owner: accountable for the incident throughout its lifecycle; maintains the record, coordinates progress, communicates and ensures closure. The owner need not be the person who fixes it.
- Service desk: single point of contact; detects and logs incidents, categorizes, prioritizes, attempts first-line resolution, escalates and keeps users informed.
- Support groups: second- and third-line teams that diagnose and resolve; they return the incident to the owner rather than silently closing it.
- Major incident manager: coordinates a major incident, runs the bridge, sets update cadence, escalates and manages stakeholder communication; this is a coordination role, not necessarily a technical one.
- Problem manager: takes recurring or major incidents into root-cause investigation.
- Change enablement: authorizes emergency changes needed for resolution.
- Suppliers and partners: external resolver groups; the incident owner still coordinates the end-to-end flow.
Value streams
Incident management contributes mainly to Deliver and Support, with Engage for user communication and Improve for post-incident review. A typical value stream runs detect → log → categorize → prioritize → diagnose → resolve → close. The incident record is the integrating artifact across service desk, technical teams and suppliers.
Worked example
A payment gateway fails. The service desk logs the incident and assigns a technical team. The major incident manager convenes a bridge, sets 30-minute updates and engages the payment supplier. The problem manager joins to capture data for root cause, and change enablement approves an emergency rollback. Ownership stays with the incident owner throughout. Reasoning: separating coordination from hands-on resolution prevents the resolver from disappearing into fixes and losing stakeholder communication.
Traps that cost marks
- Assuming the incident owner must be the resolver.
- Letting assignment equal ownership, so incidents bounce between queues.
- Escalating only upward and forgetting supplier escalation.
- Having the major incident manager do technical work and neglect updates.
- Confusing problem management's root-cause ownership with incident restoration.