Incidents

An incident records a summary, priority, affected service and asset, assigned person, status and response dates. The Service Manager can identify the responsible person and see whether work is open, acknowledged, under investigation, resolved or closed. The asset link gives the team a more precise place to look when equipment is involved.

Incident updates provide the chronology. Each update has an author, occurrence date and text. For example, a service technician may record that a reported outage affects one assigned asset, then add a later update after checking the service. The incident status expresses the current state; the update records what happened and who observed it.

• Assignment. Link the incident to a person, service and affected asset.
• Priority. Mark low, medium, high or critical so the manager can order response work.
• Chronology. Add dated, authored updates as investigation proceeds.

Agree how the team chooses priority and who may change the assigned person. Define when an incident should be acknowledged and when it can be marked resolved or closed. The opened, acknowledged and resolved dates should reflect the actual events. A status change should not stand in for a response timestamp or a written update.

The manager and technician should also decide when a recurring incident deserves a separate problem record. A problem has its own owner, statement, root cause and status. Keep the incident focused on response to the interruption, then use the problem record for investigation of the underlying cause.

Create an incident for an active service and link an asset. Set its priority and assign it to a technician. The Service Manager records the actual acknowledgment date. The technician adds a dated update explaining what they checked. As the work progresses, the technician adds another update and the Service Manager moves the status to investigating. When service is restored, the manager records the resolved date and changes the incident status to resolved.

Ask the manager to read the incident without a separate verbal briefing. They should be able to name the affected service, asset, assignee and current state, then reconstruct the response from the update dates and authors. A later close decision should leave the earlier chronology intact. If the same cause appears again, the team can relate the service to a problem investigation without rewriting the incident.

• Open incidents — Active interruptions with priority, service, assignee and status.
• Assigned incidents — Work linked to the person responsible for response.
• Incident chronology — Dated updates with their authors and parent incident.

See incident response and change control.