Resolved VS closed reporting question

[moseth]

From an ITIL perspective, is it a better to report on incidents resolved during a certain period (week or month)... OR.. Report on incidents closed during that same time period?

If one way or the other.. WHY?   Thanks

[Thomas_Davis]

Great question,

Resolved comes before Closed. I think most would tell you that they report on when an Incident for example is Resolved for SLA purposes.  Also based on what your Organization has decided the number of days after an Incident is Resolved, will automatically Close.  The period between Resolved and Closed is there, in case maybe something was not completely resolved and it can be worked on again, without having to open a new Incident.

I would look at what comes OOTB box for Indicators and decided from there which you want to use for what purpose.  But if you are trying to get the time and the Incident has been worked, you would want to go with Resolved.

You may get more feedback on this subject from other Community members as well.

Here is a prior Performance Analytics Academy session, that talks about Reporting Best Practices.

Hope this helps,

[moseth]

Thank you Thomas

[DJL2 · Accepted solution]

Hi Moseth,

You always have to consider the reporting context and in reality, this will change from business to business, ie: there is no right or wrong answer.  Drawing from experience, I defer measuring from Open -> Resolved as 'Resolved' is a volatile State, whereas there is more finality with 'Closed Complete'.

In practice what does this mean?  If your contracts considered volumetric charging ($/ticket) you'd be forever trying to retrospectively true-up, given that a Resolved ticket can be reopened.  If however the basis was declared as 'Closed Complete', this is much more stable and far less likely to change.

All this being said, a commonly used KPI is: Mean Time to Resolve (MTTR)  Simplistically, this is an aggregated average of Open -> Resolved.  The MTTR KPI will give you a much more sensitive measurement of practical resolution, which might be the priority for some business contexts.

As Thomas mentions, there is a state of purgatory between Resolved -> Closed Complete.  This time allowance is adjustable by the business, but generally 48-72hrs.  Of course, if you measure Open -> Closed Complete, you also build this purgatory in - so, some caveating is wise.

Finally, Incident SLA (within the ServiceNOW platform) can capture actual time worked, as these are much more discrete measurements within each Incident.  Again, and returning to my first sentence: it all depends on the reporting context and what question you are trying to answer.

Hope that helps.

Thanks,

DJL