Incident Tasks vs. Parent/Child Incidents: Knowing When to Use Each

[sgrison]

Over the years, I’ve seen many ServiceNow teams blur the line between incident tasks and parent/child incidents — using them interchangeably and creating confusion in the process. The truth is, they solve completely different problems.

Incident tasks are for collaboration. When a single incident needs multiple teams to contribute — like network, database, and server groups all helping to restore one system — you stay within one master ticket and assign tasks to each group. Everyone works toward a shared resolution, and communication stays centralized.
Parent/child incidents, on the other hand, are for scale. When hundreds of users report the same issue — “VPN down” or “email offline” — you link all those child incidents to one parent. The parent drives communication, resolution, and closure, while children inherit updates automatically.
In short:

• Use incident tasks when one issue needs multiple resolvers.
• Use parent/child incidents when one issue affects multiple reporters.

Mixing the two clutters communication and weakens reporting. When you use them correctly, collaboration feels clean, visibility improves, and major incident coordination finally makes sense.