White Paper - itsmcampus.com

1 White PaperIncident Management:A CA IT Service ManagementProcess MapPeter Doherty Senior Consultant, Technical Service, CA, Waterhouse Director, Product Marketing, Business ServiceOptimization, CA 2006 Table of ContentsIntroduction ..3 Incident Management .. 4 Event ..4 Detect ..4 Record ..4 Investigate and Diagnose ..7 Optimizing the Incident Management Journey ..7 Potential Issues with Incident the Authors ..823 IntroductionCA s IT Service Management (ITSM) Process Maps providea clear representation of the itil best practice use the analogy of subway or underground systemtransport maps to illustrate how best to navigate a journeyof continuous IT service improvement. Each map detailseach itil process (track), the itil process activities (stations)that must be navigated to achieve itil process goals (yourdestination), and the integration points (junctions) thatmust be considered for process has developed two maps (Service Support Figure A;and Service Delivery Figure B), since most ITSM discussions are focused around these two critical Service Support journey represents a journey ofimproving day-to-day IT service support processes thatlay the operational foundation needed upon which to buildbusiness value.

2 The Service Delivery journey is moretransformational in nature and shows the processes thatare needed to deliver quality IT examination of the maps shows how a continuousimprovement cycle has become a circle or central line,with each Plan-Do-Check-Act (P-D-C-A) improvementstep becoming a process integration point or junction .These junctions serve as reference points when assessingprocess maturity, and as a means to consider the impli-cations of implementing a process in isolation. Each of theITIL processes are shown as tracks , and are located in aposition most appropriate to how they support the goalof continuous improvement. Notice too, how major itil process activities become the stations en-route towardsa process destination or Paper is part of a series of 10 ITSM Process Mapwhite papers.

3 Each Paper discusses how to navigate aparticular itil process journey, reviewing each processactivity that must be addressed in order to achieve processobjectives. Along each journey careful attention is given tohow technology plays a critical role in both integrating itil processes and automating itil process A. Service B. Service ManagementThe objective of the Incident Management process is toreturn to a normal service level, as defined in a ServiceLevel Agreement, as quickly as possible with minimumdisruption to the business. Incident Management shouldalso keep a record of incidents for reporting, and integratewith other processes to drive continuous places great emphasis on the timely recording,classification, diagnosis, escalation and resolution ofincidents.

4 Within Incident Management the Service Deskplays a key function, acting as the first line of support andactively routing incidents to specialists and subject matterexperts (SMEs). To be fully effective, the Service Desk hasto work in unison with other supporting processes. Forexample, if a number of incidents are recorded at thesame time, the Service Desk analyst needs sufficientinformation to prioritize each incident. Technology can bea key contributing factor by ranking incidents accordingto business impact and urgency. Today many tools enablethe automatic recording of incidents within the ServiceDesk function, but lack the capabilities to correlateincidents and associate them with business service levels. Let s review the Incident Management process journey(see Figure 1), assessing each critical process activity (orstation), and examine how technology can be applied tooptimize the every stage of the journey, ensuring arrivalat the process terminus the efficient restoration ofIT services.

5 Incident Management starts with an event that, accord-ing to itil , isn t not part of the standard operation of aservice and which causes, or may cause an interruption orreduction in service quality. Incidents can include hardwareand software errors, and user service requests which aretypically not associated with IT infrastructure of service requests include functional questionsor requests for information, or a request to have a userpassword first activity along the Incident Manage-ment process journey is the mechanism todetect incidents as they occur within the opera-tional infrastructure and result in deviationsfrom normal service. Users of IT services arethe first to detect service deviations, yet withautomated management, IT can rapidly detectincidents before they adversely affect end-users and ITservices.

6 In some cases IT can use process automationtools to detect errors before they affect IT service levelsand to solve problems quickly before they impact most cases incidents will be recorded by a Service Deskfunction, which should record all incidents to ensure thatcompliance with service level agreements can be reportedcorrectly. The location of an incident will determine whoor what reports it. Naturally, users should have a facility torapidly report incidents, supplying all information to thefront line analyst, but a truly effective reporting functionalso should enable the system itself to automaticallyrecord incidents as they occur. 4 Figure 1. Incident Management Process Service Desk solutions provide self-help andknowledge based capability, but even if users resolve theissue themselves, they should record the incident.

7 This isimportant, since the IT function can proactively use anaccurate base of recorded incidents to facilitate effectiveprocess improvements along other IT Service Managementprocess lines. Also, giving end users the ability to log non-time critical incidents through a web enabled interfacecombined with a knowledge management tool greatlyreduces the number of calls made to the Service Desk. Part of the Incident Management recording functionshould involve the effective classification (to determineincident category) and matching (to determine if a similarincident has occurred previously). Technology can help byproviding front line support with information pertaining tothe configuration items (CI s) supporting the end userwho recorded the incident.

8 During this phase Service Deskanalysts review previous incident activity to understandthe reason for the incident. The analyst should also havethe means to correctly classify the incident using agreedcoding criteria, identifying type of incident ( ITService=degraded), and the Service or CI affected ( Entry Service). Many organizations mistakenlycombine the IT Service / CI into the incident type. Bydoing so, they find that their incident classificationmethodology becomes far too complicated and peopleresort to incorrectly classifying classification, it is important to properly prioritizethe incident. Service Desk solutions can help byautomatically determining the priority based on the typesof incident ( IT Service=Outage), and the businessservices that are affected.

9 The priority may also bedetermined by existing Service Level Agreements. Afterclassification, the analyst should use incident matching tosee whether a similar incident has occurred previously,and whether there is a solution, workaround or knownerror. If there is, then the investigation and diagnosisstages may be bypassed, and resolution and recoveryprocedures initiated. If the incident has high priority and can t be resolvedimmediately, the incident manager should create a linkedproblem record and initiate Problem Management processactivities. Interestingly enough, Problem Management willhave a different focus to Incident Management and couldbe in conflict. Incident Management should restore the ITservice while Problem Management should determine aroot cause and update the status to a known error.

10 In themajority of cases where there is a conflict, IncidentManagement should take priority, since it is more criticalto restore normal service levels, even with continuing along our Incident Managementprocess journey, it is worth considering how the effectivedetection, recording and classification of incidents(achieved thus far) can facilitate an optimum journeyalong other itil process lines. In Figure 2 we can see thatafter the detection and recording activities, the IncidentManagement process arrives at a critical point TheCheck junction. Incident Management outputs derivedfrom the timely detection and accurate reporting ofincidents provide the means to be more proactive andoptimize the Problem Management process.