When does it make sense to use a Case instead of going straight to an Incident?

[darrelldjoh]

I’m trying to better understand when an organization would choose the Case route versus going straight to an Incident.

In many DoD/internal support environments I’ve seen, the cleaner and quicker workflow is to open an Incident as soon as a customer calls or reports an issue. That gives the team one record to track the interaction, assignment, troubleshooting, and restoration work. If multiple users are experiencing the same issue, we then open a Problem for RCA and relate the Incidents back to it.

Because of that, I’m trying to understand where Cases really add value in practice.

For organizations using Case management / CSM, when do you decide a Case should be the primary intake record instead of an Incident? What makes that extra step worth it operationally? Is it mainly for customer/account context, entitlements, communication workflows, external customer support, or something else?

I’d be interested in hearing real-world examples of where Case + Incident worked better than just using the Incident-first route.

[AnirudhKumar]

Great question btw.

Here's my opinion on the subject. If you deal with only one client/customer, then it doesn't matter if you send all queries to the Incident bucket. But when you have more than one client, and queries come in from all sides, creating cases adds that extra layer of segregation. And this segregation could be beneficial for a variety of things - like data privacy or offering white-glove service. 

You could argue all of those benefits can also out of Incident Management too. But you might have to custom-build in at least half of those scenarios. Whereas in Case management you get most of those benefits configurable OOB.

Again, there's many layers to this discussion. But I hope you got the gist🙂

[fknell]

Hi @darrelldjoh,

If you're 'just' an internal IT provider, that provides IT services with your own personnel, you're good to go with incidents. When you are servicing external clients with IT services, you might benefit from CSM ootb functions, that are not available in ITSM, or you might have to rebuild.

In case you are providing service to external customers or have products, that e.g., rely on IT systems, you can create a case and once IT is involved, an incident. Another scenario would be using a shared service desk for IT, HR, Facility, etc., but this can also be done with the Universal Request.

Hope this helps!

[yashkamde]

Hello @darrelldjoh ,

If talking in short, If you only care about fixing the thing, stick to Incident. If you care about who is broken, what they are owed by contract, and filtering the communication between tech and customer, Case is the way to go.

Real-World Example: The "Systemic Hardware Failure" :
Imagine a scenario where a specific hardware component (an encrypted router) fails at multiple remote sites.

The Incident First Route: You get 50 Incidents. You link them to a Problem. You are now communicating with 50 individual users via Incident comments. It's noisy and disorganized for the account managers.

The Case + Incident Route :

1. Each site opens a Case.
2. The system identifies these sites all belong to "Regional Command X."
3. A single Incident is spun up for the engineering team to fix the firmware.
4. The Value: The engineers work the Incident (Internal). The Customer Service Agents manage the Cases (External). When the Incident is resolved, it can automatically flow up to resolve the Cases, ensuring the communication is tailored to the customer's specific contract or language, while the fix was purely technical.

If my response helped mark as helpful and accept the solution.