ITIL 4 IM study plan
ITIL 4 IM · Give each week a clear focus.
8 weeks · About 6 hours per week
Incident management concepts and definitions
Define incident, major incident, and service request using ITIL 4 terminology and distinguish each with two original examples
Explain the difference between an incident and a problem, and map how incident resolution can trigger problem management
List the three incident types (major, non-major, and security-related) and state the criteria that escalate an incident to major
Describe how incident management contributes to the service value chain, naming at least two value chain activities it touches
Your checkpoint
A one-page glossary of 10 incident-related terms, each with a definition, a distinct example, and a note on how it differs from the nearest similar term, scored against a self-made 5-point accuracy checklist.
Incident management roles, responsibilities and value streams
Identify the incident management practice roles (incident owner, major incident owner, incident team, technical support) and state one accountability for each
Trace a sample incident end-to-end through the value stream, marking handoffs, decision points, and where the incident owner intervenes
Explain how the service desk, technical management, and application management divide responsibilities during a major incident
Describe how incident management interacts with the service desk practice and where the boundary of responsibility sits
Your checkpoint
A swimlane diagram of the incident value stream with at least six steps, three roles, and two decision points, plus a 150-word narrative explaining why each handoff exists.
Incident management concepts and definitions & Incident management processes and practices
Outline the incident management process steps from logging through closure, naming the inputs, outputs, and key decisions at each step
Explain the purpose of prioritization and impact-urgency matrices and apply them to five original scenarios
Describe the major incident process, including declaration, communication cadence, escalation, and review
Compare the incident management practice with the problem management practice and state how they share information
Your checkpoint
A process flow for incident management with at least eight steps, a prioritization matrix applied to five scenarios, and a table showing inputs and outputs per step.
Incident management processes and practices
Explain the purpose of the incident management practice and its scope, including what is explicitly out of scope
Describe how incident management uses the 'optimize and automate' and 'collaborate and promote visibility' guiding principles in practice
Identify at least four key metrics for incident management and explain what each does and does not measure
Apply the concept of swarming to an incident scenario and contrast it with traditional escalation
Your checkpoint
A metrics dashboard sketch with four incident KPIs, their formulas, target thresholds, and a 200-word explanation of the risks of gaming each metric. Score at least 8/10 on a self-made 10-question quiz covering domains 1 and 3.
Incident management information, tools and technology
Identify the data fields an incident record must capture and explain why each supports resolution and reporting
Describe how a knowledge base, known-error database, and AI-assisted triage support incident management, including one limitation of each
Explain how monitoring, event management, and alerting feed incident detection and how false positives should be handled
Describe the role of a configuration management database in incident diagnosis and the risk of stale configuration data
Your checkpoint
A data dictionary for an incident record with at least 10 fields, their purpose, and validation rules, plus a 200-word analysis of one tool category's benefits and failure modes.
Incident management processes and practices & Incident management information, tools and technology
Design a major incident communication plan covering stakeholders, channels, frequency, and escalation triggers
Explain how automation and AI can support incident classification and routing, and state two governance controls needed
Describe how incident records feed continual improvement and problem management, and how to close the loop
Evaluate two incident management tool architectures against a stated set of requirements
Your checkpoint
A communications plan for a major incident plus a short evaluation memo comparing two tool approaches against five requirements, each scored and justified.
Incident management in the wider service value system
Explain how incident management interacts with the service value chain activities and the four dimensions of service management
Describe the relationship between incident management and at least three other practices, such as problem, change enablement, and service level management
Explain how incident management supports the 'focus on value' and 'start where you are' guiding principles in a real service context
Analyze how a poor incident management process affects service level achievement and customer satisfaction
Your checkpoint
A one-page system map linking incident management to five other practices and four dimensions, with a 150-word note on one integration failure and its consequence.
Incident management concepts and definitions & Incident management roles, responsibilities and value streams & Incident management processes and practices & Incident management information, tools and technology & Incident management in the wider service value system
Consolidate all five domains into a personal one-page summary sheet organized by domain
Complete a timed 40-question practice set and score at least 80 percent
Review every missed question, write the correct reasoning, and identify the underlying concept gap
Rehearse explaining one incident scenario end-to-end in under five minutes
Your checkpoint
A timed practice set score of at least 80 percent with a written error log of every missed question and a corrected one-page summary sheet covering all five domains.
Milestones
Week 2: Can define incident, major incident, and service request without notes and correctly classify 10 mixed scenarios with at least 9/10 accuracy.
Week 4: Can draw the incident value stream from memory, naming at least four roles and three process steps, and score at least 8/10 on a self-made quiz covering domains 1 and 3.
Week 6: Can list at least eight incident record fields, explain two tool limitations, and describe a major incident communication plan without reference material.
Week 8: Score at least 80 percent on a timed 40-question practice set and demonstrate a complete error log with corrected reasoning for every missed item.