Major Incident workbench — the Post Incident Report tab

  • Release version: Yokohama
  • Updated January 30, 2025
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Major Incident workbench — the Post Incident Report tab

    The Post Incident Report tab in the Major Incident workbench is designed to help ServiceNow users document and analyze major incidents by detailing the cause, resolution steps, and team actions. It enables major incident managers to comprehensively assess the incident response and resolution process, facilitating the identification of follow-up actions and lessons learned.

    Show full answer Show less

    The post incident report is mandatory for recording the actions taken, their rationale, and findings. Editing the report is allowed only when the incident is in the Resolved state by users with the majorincidentmanager role.

    Key Features

    • Sections for Detailed Reporting: The report contains Overview (incident summary), Findings (cause and lessons learned), Resolution (steps taken to resolve), and Timeline (all related activity feeds including communication plans and tasks).
    • Related Problem or Change Management: Managers can add or manage related Problem or Change records directly from the report.
    • Timeline Updates: The timeline can be refreshed using the “Regenerate Timeline” button to display the latest incident activities.
    • Integration with Continual Improvement Management (CIM): If CIM plugin (com.sncim) is enabled, related improvement records from inbound CIM integrations are shown in the report.
    • Report Generation and Download: The entire report can be compiled and downloaded as a PDF by clicking “Download Report PDF.”
    • Incident Form Links: - “Regenerate PIR Timeline” link (available in Resolved state for majorincidentmanager role) to update the timeline.
      - “Preview PIR” link (available in Resolved or Closed state for itil role) to preview the report.
    • Incident Response Timeline Calculation: The “Time to Identify” metric is calculated from the earliest related alert or incident creation until the incident is proposed or promoted as a major incident, depending on how the major incident was raised.

    Practical Benefits for ServiceNow Customers

    • Provides a structured process to capture the full lifecycle of a major incident, improving transparency and accountability.
    • Facilitates continuous improvement by documenting lessons learned and linking to improvement initiatives via CIM.
    • Enables clear communication and documentation for audit and review purposes through downloadable PDF reports.
    • Supports role-based access to editing and viewing post incident reports, ensuring appropriate controls.
    • Streamlines coordination between incident, problem, and change management teams by linking related records.

    The Post Incident Report tab helps you to understand the cause of the major incident, and the actions taken by the teams to resolve the incident.

    The teams can assess the incident response and resolution process and determine follow-up action items. The post incident report is required to record the actions performed, the reasons for doing them, and findings.
    Note:
    The major incident manager can edit a report when the incident is in the Resolved state.
    Figure 1. View of the Post Incident Report tab
    Post incident report tab
    The post incident report includes the following sections where a major incident manager can provide required information:
    • Overview: Summary of the incident.
    • Findings: Information on what caused the major incident and any lessons learned in the process.
    • Resolution: Information on the resolution steps taken to resolve the issue. The major incident manager can also add or edit any related Problem or Change information by clicking Add or Manage respectively.
    • Timeline: Information of all the activity feeds, not only of the incident but also of the incident communication plan and incident communication tasks related to the incident. You can update the timeline with the latest activity by clicking Regenerate Timeline.
      Note:
      The information that you provide for Overview, Findings, and Timeline gets updated in the Post Incident Report section on the Incident form.

    If you activate the Continual Improvement Management (CIM) plugin (com.sn_cim), the Related Improvement Records section is displayed in the report. This section displays the Inbound CIM Integrations records.

    When you click View Complete Report, all the information entered by the major incident manager is compiled together and you can download the report in the .PDF format by clicking Download Report PDF.

    The following links appear in the Incident form under the Related Links section:
    • Regenerate PIR Timeline: This link appears when incident is in the Resolved state and the user has the major_incident_manager role.
    • Preview PIR: This link appears when incident is in the Resolved or Closed state and the user has the itil role.
    Note:
    On the downloaded report, under Incident Response Timeline, the time displayed in the timing type Time to Identify is calculated in the following ways:
    • If you propose the incident as a major incident: The time indicates the time from creation of the first related alert for this incident or creation of the incident (in case there is no alert or the Event Management plugin is inactive), whichever occurs first, until the time the incident is first proposed as a major incident.
    • If you create a major incident directly: The time indicates the time from creation of the first related alert for this incident or creation of the incident (in case there is no alert or the Event Management plugin is inactive), whichever occurs first, until the time the incident is promoted as a major incident.