Step 3: Incident Categorization

Download as docx, pdf, or txt
Download as docx, pdf, or txt
You are on page 1of 2

Step 3: Incident Categorization:

 Incidents are categorized during the logging stage. This can be helpful in guiding the service desk agent to
the correct known error entry or the appropriate support team for escalation. A simple category structure
should be used, however; too complex a scheme leads to incidents all being logged as “other” or
“miscellaneous” because the agent does not want to spend the time considering which category is correct.
 This makes later analysis very difficult. Incidents should be recategorized during investigation and on
resolution, if the original choice was incorrect. The service desk agent will have chosen the most appropriate
category based on the information available at the time, but further investigation may have shown that, for
example, a printer fault was actually a cabling fault.

Step 4: Incident Prioritization:

 Incidents need to be prioritized to ensure that the most critical incidents are dealt with first. It is often said
that all users believe that their own incident is the highest priority, so it is important to agree during service-
level negotiations what criteria should be used to decide priority.
 The ITIL framework recommends that two factors should be considered: business impact and urgency (how
quickly the business needs a resolution). Business impact can be assessed by considering a number of
factors: the number of people affected, the criticality of the service, the financial loss being incurred,
damage to reputation, and so on. Dependent on the type of organization, other factors such as health and
safety, for a hospital or a railway company or similar and potential breach of regulations financial
institutions, and so on) may be considered.
 Deciding the priority must be simple, because the incident has to be logged quickly. Employing service desk
staff with good business knowledge and ensuring they are trained to be aware of business impact will help a
realistic assessment of business impact to be made.

 Many organizations struggle with applying the prioritization rules when the user reporting the fault is very
senior. Some organizations will have a formal procedure in place to give these VIPs faster service; some will
apply the business impact and urgency evaluation to their incident as with any other caller, although the
business impact is likely to be higher with these users. There needs to be clear guidance to the service desk
agent whether to (for example) prioritize a VIP’s printer fault over a fault affecting online sales.
 Some organizations address this issue by formally recognizing the needs of VIPs for fast service and defining
a special service level called as gold service for them within the SLA, documented in the service catalogue.

Step 5: Initial Diagnosis

 The initial diagnosis step refers to the actions taken at the service desk to diagnose the fault and, where
possible, to resolve it at this stage. The service desk agent will use the known error database provided by
problem management, incident models (covered earlier), any other diagnostic tools to assist in the
diagnosis, and possible resolution. Where the service desk is unable to resolve the incident, the initial
diagnosis will identify the appropriate support team for escalation. (Given example for Known error
database KEDB)
 One technique used by the service desk agent is incident matching. By checking for previous incidents with
the same classification, the service desk agent may be able to identify a repeat incident and the appropriate
resolution steps. These speeds up the resolution and increases the first-contact fix rate.
 Time is of the essence in incident management, so the length of time an agent has to resolve the incident
will be limited. If the incident can be resolved at first line, it is far more efficient for the user and the IT
provider that this is done; holding onto the call for too long, however, delays the eventual resolution.
Consideration needs to be given to what the time limit should be; five to ten minutes is common
 Part of this stage is the gathering of information to assist the second-line technician in resolving the incident
quickly. Again, sufficient time is required for this step, saving time by passing the incident to a second-line
technician quickly but with sparse details is not helpful. The second-line technician will need to contact the
customer to obtain the information, adding delay and frustration. Support teams should provide guidance to
the service desk about the type and level of information they should be gathering.

You might also like