White Paper - itsmcampus.com

1 White PaperIncident management :A CA IT Service ManagementProcess MapPeter Doherty Senior Consultant, Technical Service, CA, Waterhouse Director, Product Marketing, Business ServiceOptimization, CA 2006 Table of ContentsIntroduction ..3 incident management .. 4 Event ..4 Detect ..4 Record ..4 Investigate and Diagnose ..7 Optimizing the incident management Journey ..7 Potential Issues with incident the Authors ..823 IntroductionCA s IT Service management (ITSM) process Maps providea clear representation of the ITIL best practice use the analogy of subway or underground systemtransport maps to illustrate how best to navigate a journeyof continuous IT service improvement. Each map detailseach ITIL process (track), the ITIL process activities (stations)that must be navigated to achieve ITIL process goals (yourdestination), and the integration points (junctions) thatmust be considered for process has developed two maps (Service Support Figure A;and Service Delivery Figure B), since most ITSM discussions are focused around these two critical Service Support journey represents a journey ofimproving day-to-day IT service support processes thatlay the operational foundation needed upon which to buildbusiness value.

2 The Service Delivery journey is moretransformational in nature and shows the processes thatare needed to deliver quality IT examination of the maps shows how a continuousimprovement cycle has become a circle or central line,with each Plan-Do-Check-Act (P-D-C-A) improvementstep becoming a process integration point or junction .These junctions serve as reference points when assessingprocess maturity, and as a means to consider the impli-cations of implementing a process in isolation. Each of theITIL processes are shown as tracks , and are located in aposition most appropriate to how they support the goalof continuous improvement. Notice too, how major ITIL process activities become the stations en-route towardsa process destination or Paper is part of a series of 10 ITSM process Mapwhite papers. Each Paper discusses how to navigate aparticular ITIL process journey, reviewing each processactivity that must be addressed in order to achieve processobjectives. Along each journey careful attention is given tohow technology plays a critical role in both integrating ITIL processes and automating ITIL process A.

3 Service B. Service ManagementThe objective of the incident management process is toreturn to a normal service level, as defined in a ServiceLevel Agreement, as quickly as possible with minimumdisruption to the business. incident management shouldalso keep a record of incidents for reporting, and integratewith other processes to drive continuous places great emphasis on the timely recording,classification, diagnosis, escalation and resolution ofincidents. Within incident management the Service Deskplays a key function, acting as the first line of support andactively routing incidents to specialists and subject matterexperts (SMEs). To be fully effective, the Service Desk hasto work in unison with other supporting processes. Forexample, if a number of incidents are recorded at thesame time, the Service Desk analyst needs sufficientinformation to prioritize each incident . Technology can bea key contributing factor by ranking incidents accordingto business impact and urgency. Today many tools enablethe automatic recording of incidents within the ServiceDesk function, but lack the capabilities to correlateincidents and associate them with business service levels.

4 Let s review the incident management process journey(see Figure 1), assessing each critical process activity (orstation), and examine how technology can be applied tooptimize the every stage of the journey, ensuring arrivalat the process terminus the efficient restoration ofIT services. incident management starts with an event that, accord-ing to ITIL, isn t not part of the standard operation of aservice and which causes, or may cause an interruption orreduction in service quality. Incidents can include hardwareand software errors, and user service requests which aretypically not associated with IT infrastructure of service requests include functional questionsor requests for information, or a request to have a userpassword first activity along the incident Manage-ment process journey is the mechanism todetect incidents as they occur within the opera-tional infrastructure and result in deviationsfrom normal service. Users of IT services arethe first to detect service deviations, yet withautomated management , IT can rapidly detectincidents before they adversely affect end-users and ITservices.

5 In some cases IT can use process automationtools to detect errors before they affect IT service levelsand to solve problems quickly before they impact most cases incidents will be recorded by a Service Deskfunction, which should record all incidents to ensure thatcompliance with service level agreements can be reportedcorrectly. The location of an incident will determine whoor what reports it. Naturally, users should have a facility torapidly report incidents, supplying all information to thefront line analyst, but a truly effective reporting functionalso should enable the system itself to automaticallyrecord incidents as they occur. 4 Figure 1. incident management process Service Desk solutions provide self-help andknowledge based capability, but even if users resolve theissue themselves, they should record the incident . This isimportant, since the IT function can proactively use anaccurate base of recorded incidents to facilitate effectiveprocess improvements along other IT Service Managementprocess lines.

6 Also, giving end users the ability to log non-time critical incidents through a web enabled interfacecombined with a knowledge management tool greatlyreduces the number of calls made to the Service Desk. Part of the incident management recording functionshould involve the effective classification (to determineincident category) and matching (to determine if a similarincident has occurred previously). Technology can help byproviding front line support with information pertaining tothe configuration items (CI s) supporting the end userwho recorded the incident . During this phase Service Deskanalysts review previous incident activity to understandthe reason for the incident . The analyst should also havethe means to correctly classify the incident using agreedcoding criteria, identifying type of incident ( ITService=degraded), and the Service or CI affected ( Entry Service). Many organizations mistakenlycombine the IT Service / CI into the incident type. Bydoing so, they find that their incident classificationmethodology becomes far too complicated and peopleresort to incorrectly classifying classification, it is important to properly prioritizethe incident .

7 Service Desk solutions can help byautomatically determining the priority based on the typesof incident ( IT Service=Outage), and the businessservices that are affected. The priority may also bedetermined by existing Service Level Agreements. Afterclassification, the analyst should use incident matching tosee whether a similar incident has occurred previously,and whether there is a solution, workaround or knownerror. If there is, then the investigation and diagnosisstages may be bypassed, and resolution and recoveryprocedures initiated. If the incident has high priority and can t be resolvedimmediately, the incident manager should create a linkedproblem record and initiate Problem management processactivities. Interestingly enough, Problem management willhave a different focus to incident management and couldbe in conflict. incident management should restore the ITservice while Problem management should determine aroot cause and update the status to a known error. In themajority of cases where there is a conflict, IncidentManagement should take priority, since it is more criticalto restore normal service levels, even with continuing along our incident Managementprocess journey, it is worth considering how the effectivedetection, recording and classification of incidents(achieved thus far) can facilitate an optimum journeyalong other ITIL process lines.

8 In Figure 2 we can see thatafter the detection and recording activities, the IncidentManagement process arrives at a critical point TheCheck junction. incident management outputs derivedfrom the timely detection and accurate reporting ofincidents provide the means to be more proactive andoptimize the Problem management process . For example,the accurate recording of all incidents will assist ProblemManagement with the rapid identification of underlyingerrors. Where justified, Problem management will striveto permanently correct these errors, and reduce theamount of repeat incidents. Alternatively, the Checkjunction enables incident management to take inputs fromProblem management to further streamline the overallprocess. For example, by delivering information aboutknown errors (from an integrated known error database)the journey time to the ultimate destination servicerestoration will be reduced dramatically. Naturally,technologies can play a key role, integrating both Incidentand Problem management within a single , horizontal escalation can lead to incidentsbouncing around the system without anyone takingownership and the increased likelihood of breechingservice level agreements.

9 This is why it is so important tohave a proactive approach and use process automation tocorrectly route incidents to the appropriate SME escalation is where the incident needs to gainhigher levels of priority. As part of the activity, it isessential that rules are clearly in place to ensure timelyescalation, and avoid the need for support analysts towork out when to escalate a recipe for disaster!For every resolution attempt, accurate data must beattached to the incident detail to save repeating recoveryprocedures and lengthening overall resolution can play another key role, automating theescalation process itself, and pinpointing the exact sourceof errors. This latter capability is important since it ensuresthe correct incident hand-off to appropriate SME groupsearly in the support this stage of the journey, the incident Managementprocess line has arrived at the ACT junction (see Figure3). Here, iterative investigation and diagnosis will havedetermined the nature of the incident , and what actionsneed to be initiated to resolve the problem.

10 Customerservice must be restored as quickly as possible (throughworkarounds if necessary), and incidents should beescalated to Problem management to detect the under-lying cause of the problem, provide resolutions andprevent incidents from no immediate solutions are available, then the ServiceDesk function needs to be able to route incidents tosubject matter experts (SMEs). During the investigationand diagnosis phase, support analysts will collect updatedincident details and analyze all related information(especially configuration details from a CMDB linked tothe Service Desk). During this phase, the support staff must access tocomprehensive historical incident , problem and knowledgedata, centralized and maintained within the Service critical is the capability to augment incident manage-ment records with diagnostic data supplied by SMEsor via integrated management technologies. The role ofmanagement technologies can play a key role here incorrectly identifying and routing incidents to theappropriate SMEs.