Problem Management vs Major Incident Management

[MichaelCreatura]

Hi All,

A question for you in terms of best practice with ServiceNow. 

When we have a Major Incident we take advantage of ServiceNow's Major Incident functionality (Proposing and Promoting an Incident as such) and even make use of the Major Incident Workbench to manage Timeline, Findings, Overview etc. However our question is around further actions, if a root cause of a Major Incident is unknown or there are actions following an Incident (such as improve monitoring etc.) would you use the Major Incident form and create Incident tasks to investigate the root cause or would you Close the Incident and open a Problem record for the RCA (root cause analysis) work to be carried out? 

Intrigued to hear how other SN users are using the system and what the consensus is for best practice.

Thanks! 

[AndersBGS · Accepted solution]

Hi Michael,

According to ITIL an incident is defined as "an unplanned interruption to an IT Service or reduction in the quality of an IT Service", where problem management refers to the underlying cause of the incident. 

So, to answer your question according to ITIL best practices, if a root cause of an incident is unknown, hence a permanent resolution has not been located, the incident should be resolved with the workaround implemented and a problem ticket created. 

If the incident is still ongoing (No workaround located), then off course all investigation should be within the incident until a workaround or a permanent resolution is located.

If my answer has helped you for your question, please mark my answer as helpful or/and if my answer provided a resolution, please mark my answer as correct answer.

Best Regards

Anders

[MichaelCreatura]

Thanks Anders and Mike.

Agreed with the approach and it is what we were thinking to incorporate ITIL best practice. 

Follow up scenario then, if the root cause is known and there are follow up actions (i.e. create a Knowledge Article). Would you action that from an Incident level (Incident Task) or create a Problem to track that further action?

[AndersBGS]

Hi Michael, 

In general if the root cause is known, I would create a knowledge article directly from the incident like when creating a problem ticket. The reason behind is, that the technician working on the incident and have found the resolution, might also be the best part to describe the resolution in a knowledge article.

If my answer has helped you in resolving your requirement, please hit the thumb up button and mark as helpful.

/Anders

[AndersBGS]

Hi Michael,

If the root cause is known and a knowledge article is needed, I would create it directly from the incident record without problem record or/and incident task. But I all comes to the question about which follow up tasks is needed.

If my answer have helped for a resolution, please mark my answer as helpful and give a thumb up.

Best regards

Anders