ITIL in practice: Incident vs. Problem Management

If you have ever looked for a job on a Service Desk (or in the entire ITSM industry), an abbreviation ITIL appeared in 90% of the job ads.

ITIL (Information Technology Infrastructure Library) is (in a simplified shortcut) a set of recommendations, procedures, and “best practices” on how to deliver IT services so that the company benefits from them and doesn’t get a headache. And although ITIL consists of a large number of modules, let’s analyze the two best-known and mutually competing ones: Incident and Problem management.

An example from the Service Desk

What you encounter daily is Incident Management. A user “Carl” reports that the Wi-Fi on the third floor of building A is not working.

What is your absolute primary goal at that moment? To restore the user’s work. How? Sometimes elegantly by restarting a specific switch, sometimes rather “crudely” by giving him a long cable, stretching it to the nearest network socket, making him a wired user, and closing the Incident - fix done, work is possible.

graph TD
    A[User Carl calls, Wifi is down] --> B(Log to Ticket - Incident)
    
    B --> C{Can we give him a temporary cable?}
    C -- No --> E[Try restarting the switch - Wifi restored - Close Incident as OK]
    C -- Yes --> D[User is online via cable - Work restored - Close Incident]
    
    E -. "The outage repeats the next day for Jane" .-> A
    D -. "Another dozen people from the floor call about wifi outage" .-> A

We gave him a temporary cable and brushed him off. But five other colleagues don’t have anything to connect it to, and the switch drops every day around noon. You have a large and recurring incident, a so-called Problem.

Problem Management: How to find the real cause

Here enters the detective (Problem Manager). He is no longer interested in the user (he got a cable from the Service Desk). Problem Management is not trying to restore functionality right now; it is trying to find the Root Cause (RCA - Root Cause Analysis). Why is that switch dropping? Is it too old? Is it losing power? Was the setting not performed after the last firmware update?

When the Problem manager identifies it, he orders the creation of a Change Request (replacement with better and more expensive hardware), it gets tested, and after a maintenance window, it is implemented into production.

In conclusion: L1 and the Service Desk (Incident Management) put out the fire on the table. L2/L3 and the Problem Manager investigate and repair the stove with a broken gas detector so that a fire will never have to start in the future. Both departments need each other equally.