ITSM - Major incident process and handling child incidents

[Peter102]

Hi Everyone,

First time posting on these boards but I am hoping you may be able to help. Our organization is quite large, we have 100,000 staff spread out across a very large geographical location. We have many different teams who manage IT for our organization. 

For our major incident process, our Service Desk manager (can be any fulfiller but Service Desk manager is usually the one) will propose a major incident through the incident form in ServiceNow, we usually use the first incident ticket that is proposed to coordinate the major incident (Parent ticket), if multiple tickets are proposed at around the same time, we will select the most detailed ticket. All subsequent tickets for this major incident are linked as child incidents to the parent incident as a parent-child relationship.

Currently our process is that the parent incident is assigned to the major incident manager who will create incident tasks and assign them to the relevant teams (this could mean 1 or 20 incident tasks depending on the service). This process works well for us but due to the size of the organization, a major incident has the potential to generate hundreds of child tickets. The current process is that our Service Desk will assign these tickets to the Incident management assignment group that the Major incident manager monitors, but this can quickly lead to this assignment group becoming unwieldy.

What are your recommendations on where child incidents should be placed? The issues with our current practice are:

• Due to the number of tickets, if a major incident is closed off, all the child tickets are automatically resolved but if a customer replies to say that the issue still exists then this may be missed.
• The queue cannot be used for other ticket types as an unrelated low priority incident or request will quickly be lost.
• Our service desk and service owners don’t want us to leave the tickets in their queue for the same reason.
• hundreds of child incidents can generate an enormous number of notifications.

My question is, how do you manage child incidents for a major incident in your organization? Do they stay with the Service Desk, go to the team who owns the specific Service? or do you have an assignment group specifically for holding child incidents? 

[Jonah Piascik]

Hi @Peter102,

We are currently implementing MIM in ServiceNow and going through a similar process.  How did you end up implementing Incident Tasks for MIM (vs. Child Incidents)? 

[Peter102 · Accepted solution]

Hi Jonah,

Not entirely sure what you mean. We use incident tasks as a way to assign work to another team to assist with the major incident. i.e Our app team has a major application down, they require the network teams help so they assign them an incident task to document their work. We've configured the worknotes of incident tasks to roll up to the main incident.

Child incidents are other incidents reported by customers/staff. i.e the above app scenario might receive 50 incidents logged to the Service Desk by customers/staff so they get linked to the main "Parent" incident so we can track it centrally and it gives us an indication of the impact. Alos, it means when we send comms from the parent it goes to all child incidents (and their customers).

For anyone who is reading this, we have settled on a process. Our Major Incidents now get assigned to the team responsible for resolving the incident. Any child incidents that get logged also go to that team. This means that if a customer responds for information or responds after the incident is resolved to say they are still having an issue then our resolving teams can respond/help them. I do think child incidents should stay with the Service Desk but ours refuses to do that.

Peter