Task: Diagnose and Resolve Incident
Diagnose and Resolve Incident
Disciplines: Incident Management


RolesPrimary Performer: Additional Performers:


Diagnose immediate cause of incident
The service provider must determine the immediate cause of the incident. If the necessary information to resolve the incident is not in the Knowledge Base, the incident must be immediately assigned to an appropriate provider group for further support. The assignee will then research the issue to determine cause and remediation options.
Attempt Resolution
After a possible resolution or workaround has been determined either from the Knowledge Base or through research, a resolution or work around should be attempted to restore service.
Verify Resolution with customer
Verify with the customer that the resolution was satisfactory and the customer is able to perform their work. An incident resolution does not require that the underlying cause of the incident has been corrected. The resolution only needs to make it possible for the customer to be able to continue their work.
Incident closure

Closure categorization Check and confirm that the initial incident categorization was correct or, where the categorization subsequently turned out to be incorrect, update the record so that a correct closure categorization is recorded for the incident – seeking advice or guidance from the resolving group(s) as necessary.

User satisfaction survey Carry out a user satisfaction call-back or e-mail survey for the agreed percentage of incidents.

Incident documentation Chase any outstanding details and ensure that the Incident Record is fully documented so that a full historic record with a sufficient level of detail is complete.

Ongoing or recurring problem? Determine (in conjunction with resolver groups) whether it is likely that the incident could recur and decide whether any preventive action is necessary to avoid this. In conjunction with Problem Management, raise a Problem Record in all such cases so that preventive action is initiated.

Formal closure Formally close the Incident Record.