Incident and Problem investigation

[dortega]

Hi again, this time in english:

Reviewing the processes of Incident and Problema Management it assaults the following doubt to me:

Must follow the Incident Management investigating the possible solution of an incidence or group of incidences that already is investigating Problem Management?

The objectives of both processes are different but I think that it seems a little inefficient that Incident Management continues investigating the possible solution which Problem Management is already investigating.

[rjp]

Incident and Problem management aren't looking for the same thing. This doesn't mean the won't frequently find the same things.

Incident management seeks a way to get the service restored, or provide an alternative capability that allows the business to continure, as fast as possible.

Problem management looks for the root cuses of incidents - and uses broader criteria for assessing its priorities than incidnet management does.

However, in reality, incident investigation will at times discover root casues, and problem management will come up with work arounds. Which is fine - they are meant to be separate but complimentary processes.

But they are not meant to work on the same incident in the same way at the same time. If the incident investigation fails to find a resolution, problem management would take over and the investigation would receive a high priority. But while problem management was looking for the cause, and fix, incident management should keep trying to find a way, any affordable way, to get the customer / end-user operational.

So: Incident management is trying to restore service levels when incidents occur. Problem management is trying to eliminate the causes of incidents.

These two process can sometimes be in conflict. The usual example given is of a situation where restoring the last good state of a system will get the service back up, but blow away the data problem management would wish to analyse in its search for the cause. In such cases Incident management should win. And problem management will probably have to take the long way around and attempt to replicate the error on a test system.

[Guest]

Thanks a lot,

I knew these two processes don't have the same goals, but I understood maybe, it was not necessary, that incident management should keep trying to find a way to restore normal user operation while problem management was looking for the cause, especially if we have not enough staff.

[rjp]

Absolutely,

it makes perfect sense to scale your efforts to the resources you have at your disposal.

In a small scale environment the difference between incident and problem management may by quite fluid, with staff switching strategies as appropriate to the situation.