Incident management in the wider service value system
Domain 5 tests how incident management fits the service value system: the service value chain, the four dimensions, governance, guiding principles, other practices and continual improvement.
Placement in the SVS
- Service value chain: incident management mainly supports Deliver and Support; Engage for user and stakeholder communication; Improve for post-incident review; Design and Transition for early-life incidents; Obtain/Build for supplier-caused incidents. Plan sets policy.
- Four dimensions: organizations and people (roles, culture, blameless reviews); information and technology (tools and data); partners and suppliers (contracts, shared escalation); value streams and processes (integrated workflow).
- Governance: approved policies, risk appetite, escalation thresholds and major incident criteria, with an audit trail.
- Guiding principles: focus on value by restoring the business service, not just a component; collaborate and promote visibility; think and work holistically; keep it simple and practical; optimize and automate.
Interfaces and outcomes
Problem management handles root cause and post-incident review actions. Change enablement authorizes emergency changes. Service level management sets targets and reports. Service desk, service request management, knowledge management, availability, capacity and business continuity all interact with incident management. Supplier and relationship management matter when partners deliver parts of the service.
Incident management creates value through faster restoration, reduced business loss, improved user confidence, compliance evidence and input to improvement. Post-incident reviews should be blameless and action-oriented.
Worked example
A retailer's checkout fails on Black Friday. Incident management restores service through failover while Engage keeps stores informed. Problem management identifies a capacity limit; capacity management and change enablement implement a fix before the next peak; service level management reports against the peak-period target; continual improvement updates the major incident playbook. Reasoning: restoration is only one outcome; learning and prevention across the SVS create the wider value.
Traps that cost marks
- Treating incident management as an isolated IT process.
- Skipping post-incident review.
- Blaming individuals, which suppresses reporting.
- Ignoring the supplier dimension.
- Confusing business continuity or disaster recovery with incident management.
- Measuring success only by speed, not by business outcome.