Incident Management is at the heart of the ITIL 4 framework. It is a mature process that requires a well-defined structure and continuous improvement. In this article, we explore the critical elements that are central to proactive process design.
ITIL’s key success factors for Incident Management
Within ITIL 4 and incident management, we work with Practice Success Factors (PSF), which are central to a well-designed incident process. Some of these factors are presented below:
1. Early detection of incidents The
ability to identify and record incidents as soon as they occur minimises the impact on operations.
2. Incident management and solutions
Focuses on effective management and resolution of incidents through structured workflows.
3. Continuous improvement
Requires high-quality data from reports that provide central support for improving the incident process and other ITIL processes such as service requests.
4. Periodic review of incidents
This means that the organisation regularly, for example on a monthly basis, reviews data from reports and key figures to analyse: – Use of specific knowledge
articles – Number of major incidents in support
– Opportunities to improve established process models
Design principles for the incident process
The first step in designing an incident process and model is to follow ITIL’s guideline "Start where you are". This means analysing current incident workflows and understanding the steps taken to resolve cases. The goal is to identify the steps that do not add value to the business or end users.
ITIL’s incident workflow comprises the following phases:
– Early detection of incidents –
Registration –
Classification – Diagnosis
– Closure
Smart workflows allow you to set specific rules for how incidents should be handled when the case is in a certain phase, and SLAs ensure that incidents are resolved within a specific time frame, especially for business-critical systems.
Functional and horizontal escalation: The right expertise at the right time
Functional escalation
When an incident requires specialised knowledge that first-line support lacks, functional escalation comes into play. This involves:
– Identifying when technical expertise is
needed – Quickly directing the
case to the right specialist – Maintaining ownership of the
incident throughout the process – Documenting knowledge transfer for future cases
Horizontal scaling
Horizontal escalation focuses on management level and resource allocation: –
Escalation to
higher decision-making levels – Mobilisation of
additional resources – Communication to business management in the event of
critical disruptions – Coordination between different departments and teams
A well-designed incident process seamlessly integrates both types of escalation, with clear trigger points and areas of responsibility.
Major Incident and Kanban Boards: Visualised Crisis Management
Major incidents require special attention and structured management. Kanban boards offer powerful visualisation for:
Real-time overview
– Backlog: Incoming major incidents
– In progress: Ongoing investigation and resolution
work – Pending: Cases awaiting external input
– Resolved: Closed major incidents
Action plan
– Clear ownership for each incident
– Visualisation of bottlenecks in the
process – Rapid reallocation of resources when needed
– Transparency for all parties involved
The Kanban methodology enables agile management even when issues are critical and ensures that no major incident "falls between the cracks".
Key figures for measuring impact targets
The incident process involves converting inputs into outputs that can be measured using key performance indicators according to the ITIL Maturity Model. The following key performance indicators are central to quantifying and measuring impact targets:
1. Time between incident detection and acceptance for diagnosis
Measures the time from when the case is received to when it is closed with a relevant solution description. Also shows how different solution descriptions are used and whether users accept them or whether support needs to modify and update them regularly.
2. Time of diagnosis
Measures the time before the user receives feedback with a diagnosis. Improving this key performance indicator reduces extra work for support staff and enhances the user experience.
3. Number of reassignments
Measures how often cases are assigned to other agents and the frequency of functional escalation between different support groups.
4. Percentage of waiting time in overall incident handling time
Identifies where in the workflow users have to wait for feedback from support, which is critical for optimising process efficiency.
5. First time resolution rate
Measures the percentage of cases resolved on first contact with support. Clearly shows how effective users perceive the support solutions to be.
6. Meeting the agreed resolution time
Key performance indicator for strengthening feedback to users. With the help of SLAs, it is possible to measure how often the set time for resolving specific issues is met.
7. Customer satisfaction and NKI
Measures user satisfaction with feedback and proposed solutions through customer surveys, which form the basis for customer satisfaction reports.
8. Percentage of incidents resolved automatically
Measures the proportion of incidents that are automatically resolved using case templates that link to specific solution descriptions or knowledge articles.
Conclusion: From reactive to proactive case management
A smartly designed Incident Management process is characterised by:
– Well-defined escalation paths that ensure the right
expertise – Visual tools such as Kanban for effective major incident
management – Data-driven improvement through systematic reporting and key performance indicator
measurement – Automation of routine tasks for increased efficiency
– Continuous evaluation of the process maturity level
By focusing on these areas and following ITIL’s Practice Success Factors, organisations not only create reactive problem solving, but build proactive systems that continuously improve service quality and user experience.
Success lies in combining structured processes with smart automation and continuous measurement – where key performance indicators serve as a compass for continuous improvement of the incident process.
