Incident Resolution Validation

[Jerel]

We are a large company that is new to Service Now, and our implementation team is so busy they have a hard time responding in a timely fashion. so I thought I would ask this here.

My team reviews data produced by other teams, and when we identify something out of compliance with a policy, we open an Incident and assign it to them to remediate. When they mark it RESOLVED, we must review and validate their remediation. If there are still issues, we reopen the Incident. If it's truly fixed, we close it.

Are Incidents the best way to accomplish this within Service Now? We have been opening Incidents, but the assignee can choose a resolution code that allows him/her to CLOSE the incident, not just resolve it, bypassing our validation step.

Bottom line: We just need to validate the other team's "fix" before the Incident is closed. 

I know Service Now has a great deal of flexibility, but we are such a large company that I know The Powers That Be will not be interested in modifying how Incidents work for the entire company based on the needs of my little team. 

What is the easiest, best, least-impactful way we can accomplish our needs?

Thank you in advance for your time.

Jerel

[Sulabh Garg · Accepted solution]

Hello Jerel,

Are you using GRC (IRM) of ServiceNow to track non-compliance with a policy? If yes, then you can use "Issue" instead of Incident to document compliance issues. As Issue is closely linked with GRC flows and you can track Issues more easily with GRC.

For more info, Please visit - Manage issues

If you tracking non-compliances outside ServiceNow then I think Incident should be the right approach for now.

Please Mark ✅ Correct/helpful, if applicable, Thanks!! 

Regards

Sulabh Garg

[Jerel]

Thank you for your quick response. If we have that module I am not aware of it, but I will certainly check into it. The features seem more appropriate for my use case. In the mean time I will continue to create Incidents, and deal with the fact that we can't be guaranteed the chance to validate the remediation.

Thanks again,

Jerel

[Heather Brand]

Hi,

You probably have an answer by now but when the incident is set to resolved, there is an auto-close feature that sets the resolved incident to closed state after a defined amount of time (I think 7 days is the default). It is normal to receive a notification advising that your incident has been resolved and you are able to set the incident back to 'in progress' state while it is in resolved state if you are not happy with the resolution. Once closed, the incident is read only. Do you have instant auto-close on resolution or is it delayed?  

[Jerel]

Hello Heather,

This is precisely the behavior we are fighting against. We as a small team are not able to dictate how this automatic process is configured, so we are stuck with incidents automatically closing 7 days after they are resolved. As stated above, during those 7 days we must validate the remediation and then either reopen the incident or close it ourselves. If an incident is auto-closed then we have no way of knowing if the remediation is complete and correct. The correct answer is to use the Governance, Risk, and Compliance module of Service Now. I have not been able to get any traction on that yet, but it does seem to be the right answer to this problem.

Thank you,

Jerel