ITIL: Incident vs Problem

IT specialist and author of ITIL trainings Michael Scarborough emphasizes that the following relationship has been established between the terms: problem - cause, incident - effect.

ITIL: Incident vs Problem

The second difference, according to Michael, is that the incident can only be resolved for a certain amount of time. When we say “resolved the incident,” it means that we have temporarily restored some service (for 10 years or only for 1 minute). That is, it is very likely that a similar situation will happen again in the future.

ITIL 4 Complete Certification Kit PDF
ITIL4 Foundation Complete Certification Kit Publisher: Axelos The ITIL 4 Foundation certification was designed as an introduction to ITIL 4

The problem, however, is the cause of incidents. ITSM expert Professor P. Ross S. Wise believes that the first sign of a problem is the "why" question you ask yourself.

Incident and problem

Let's take a look at the examples provided by Hornbill Marketing Director Peter Summers.

Incident: The user calls the support service and reports that he cannot print the document. The technician who accepts the call discovers that the specified file caused an error in the print queue. To continue working, the specialist suggests the user to temporarily use the printer in the neighboring office.

Problem: A printer incident is a symptom of a global problem. This user is the first of many to call support today. Let's say it was possible to establish that the cause of the incidents was the update of the office software last night. If the update bugs are fixed, the problem will be resolved and there will be no more print failures for this reason.

For clarity, let's take a more mundane example. You are driving a car and its wheel burst. This is an incident because the puncture ruined your plans: you have to stop to change the wheel. In this case, the incident is settled. But now you have a problem - you are driving a spare wheel. To fix the problem, you need to patch the tire.

Another example: you are riding bald tires - this is a problem. If you continue to ignore it, the likelihood of an accident will increase, the tire will probably burst.

To make it easier to differentiate between the two terms, Philip Yuson, CEO of Concept Solutions Corporation, recommends asking the following questions:

Service is unavailable?Has the quality of services deteriorated?Have business processes been affected?Has the quality of the service been affected?

If you answered yes to one of these questions, you are most likely experiencing an incident.

Incident in ITIL

An incident is an unplanned interruption or degradation of the quality of an IT service. A CI failure that has not yet affected the service is also an incident, such as the failure of one disk from a mirroring array.

In some cases, an incident can go unnoticed by users, while in others it can have a significant financial, reputational and other negative impact on the business. If the incident did occur, then it is necessary to minimize its negative impact.

How can I do this? In one case - to "fix" as quickly as possible, in the other - to restore the most important functions in the shortest possible time, in the third - to apply a workaround, etc.

Workaround - Reducing or eliminating the impact of an incident or problem for which full resolution is not currently available.

As a rule, the activities of IT departments related to resolving incidents have a significant impact on the perception of IT by users in general. In order to effectively manage these activities, an appropriate course of action must be defined. In accordance with ITIL recommendations, an incident management process should be built for this.

Incident Management is the process responsible for managing the lifecycle of all incidents. Incident management ensures that the business impact is minimized and the service is restored to normal operation in the fastest possible way.