{"id":4669,"date":"2013-06-19T00:07:31","date_gmt":"2013-06-19T00:07:31","guid":{"rendered":"https:\/\/multiacademstg.wpengine.com\/20000academy\/blog\/2013\/06\/19\/trip-1000-miles-begins-first-step-initial-diagnosis-incident\/"},"modified":"2025-05-27T15:06:46","modified_gmt":"2025-05-27T15:06:46","slug":"trip-1000-miles-begins-first-step-initial-diagnosis-incident","status":"publish","type":"post","link":"https:\/\/advisera.com\/20000academy\/blog\/2013\/06\/19\/trip-1000-miles-begins-first-step-initial-diagnosis-incident\/","title":{"rendered":"A trip of 1,000 miles begins with the first step &#8211; Initial diagnosis of an incident"},"content":{"rendered":"<p>So, an incident occurred. Service is affected. If you are lucky, event monitoring tools are in place and you will notice the incident before users do. Unfortunately, according to my experience, most incidents are reported by users. Anyhow, now\u2019s when the Incident Management process takes over.<\/p>\n<h2 style=\"padding-top: 10px; padding-bottom: 10px;\">The Incident management process as described by ITIL<\/h2>\n<p>Let\u2019s recall the purpose of an <a href=\"https:\/\/advisera.com\/20000academy\/iso-20000-documentation-toolkit\/?rel=resolution-and-fulfillment-processes&amp;doc=incident-management-process\" target=\"_blank\" rel=\"noopener\">Incident Management process<\/a> as defined in <a href=\"https:\/\/advisera.com\/20000academy\/what-is-itil\/\" target=\"_blank\" rel=\"noopener noreferrer\">ITIL<\/a> Service Operation: to restore normal service operation as quickly as possible and to minimize the adverse impact on business operation. Emphasized \u2013 \u201cas quickly as possible.\u201d<\/p>\n<p>Is there anything that could be done to speed up incident resolution? If an incident is logged using the IT Service Management (ITSM) tool, i.e. user portal, and there is not enough information to diagnose an incident, there is little that IT can do in the first step. The advantage is that the user, i.e. requestor name, is known. So, the Service Desk (SD) has to call back and gather all necessary data. But, the clock is ticking.<\/p>\n<p>Luckily (or not?), users feel it is quicker and easier to call the Service Desk and talk to someone. There\u2019s your chance. With the user still on the phone, the Service Desk has to try to solve the incident without escalation. Finding out what exactly went wrong (believe me, it sounds much simpler that it really is) and what the symptoms are is the only possible starting point. I noticed that a lot of Service Desk employees are easily taken into useless discussions.<br \/>\n<div id=\"middle-banner\" class=\"banner-shortcode\"><\/div><script>loadMiddleBanner();<\/script><br \/>\n<div id=\"side-banner-trigger\" class=\"banner-shortcode\"><\/div><\/p>\n<h2 style=\"padding-top: 10px; padding-bottom: 10px;\">Matching<\/h2>\n<p>There are few things that can help to diagnose and resolve incidents by the Service Desk:<\/p>\n<p><strong>Diagnostic scripts\u00a0<\/strong>\u2013 communication script made for particular incident category. Service Management has a lot experience with services it supports and can point to the most critical parts of the service (based on experience or on proactive analysis). This is especially useful in cases when there is a lot of staff rotation at the Service Desk. If the resolution is not known, a diagnostic script will help to isolate the cause of an incident and collect symptoms (for later diagnosis and investigation).<\/p>\n<p><strong>Known error database (KEDB)<\/strong>\u00a0\u2013 many service management tools (and almost all of the enterprise-class ITSM tools) have KEDB. This is a database where <a href=\"https:\/\/advisera.com\/20000academy\/iso-20000-documentation-toolkit\/?rel=resolution-and-fulfillment-processes&amp;doc=known-error-record\" target=\"_blank\" rel=\"noopener\">known errors<\/a> (and respective solutions) are stored. Service Desk employees use search functionality (a skilled SD employee will easily identify keywords describing the incident) and try to match the incident with a known error.<\/p>\n<p><strong>Problem matching<\/strong>\u00a0\u2013 it could happen that an incident with the same symptoms is already opened, the <a href=\"https:\/\/advisera.com\/20000academy\/iso-20000-documentation-toolkit\/?rel=resolution-and-fulfillment-processes&amp;doc=problem-record\" target=\"_blank\" rel=\"noopener\">problem recorded<\/a> (meaning, someone is already working on it), and a workaround exists.<\/p>\n<p>Incident matching procedures help to prevent doing the same thing several times.<\/p>\n<p>KEDB and problem matching will contain all relevant information and there is no need to start the investigation from scratch.<\/p>\n<p>Diagnostic scripts simplify, standardize and optimize diagnosis and resolution of incidents. Even though they are used inside the Service Desk, they can be published and used by end users. Once I found the questionnaire used by the Service Desk published as a workflow in HTML form. In such a way, users can navigate until they get to the solution. This increases user satisfaction (people feel \u201csmart enough\u201d to solve the incident by themselves) and saves resources inside the ITSM organization. Quite the contrary, some large service providers do not allow opening an incident until you pass one such questionnaire.<\/p>\n<p style=\"text-align: center;\"><img decoding=\"async\" class=\"aligncenter size-full wp-image-10625\" src=\"\/wp-content\/uploads\/\/sites\/6\/2015\/07\/Incident_matching_procedure1.png\" alt=\"Incident_matching_procedure\" width=\"555\" height=\"485\" \/><em>Figure: Incident matching procedure<\/em><\/p>\n<h2 style=\"padding-top: 10px; padding-bottom: 10px;\">What\u2019s the importance of initial diagnosis?<\/h2>\n<p>Recently, I spoke with a few users at one of my <a href=\"https:\/\/advisera.com\/20000academy\/iso-20000-documentation-toolkit\/?rel=relationship-and-agreement-processes&#038;doc=customer-portfolio\" target=\"_blank\" rel=\"noopener\">customers\u2019<\/a> businesses. I ask them to describe their Service Desk and they replied: \u201cForwarding managers!\u201d Explained \u2013 what the Service Desk does is escalate most of the incidents. And users don\u2019t get the feeling that they are efficient, i.e. they are not of much help. Skilled staff is one of the answers, but sometimes it\u2019s hard to find appropriate people. Other solutions include\u00a0<a href=\"https:\/\/advisera.com\/20000academy\/knowledgebase\/incident-classification\/\" target=\"_blank\" rel=\"noopener noreferrer\">incident matching procedure<\/a>\u00a0(with well-developed KEDB and active Problem Management process) and powerful service management tools, which are a great help for the Service Desk to solve <a href=\"https:\/\/advisera.com\/20000academy\/iso-20000-documentation-toolkit\/?rel=resolution-and-fulfillment-processes&amp;doc=incident-record\" target=\"_blank\" rel=\"noopener\">incidents<\/a> during the first call.<\/p>\n<p>Nice and efficient, isn\u2019t it? Well, it\u2019s not that simple. There will always be incidents that can\u2019t be resolved by the Service Desk. They will be escalated (to the next support level \u2013 Functional escalation). And that is OK as long as the Service Desk keeps ownership of those incidents.<\/p>\n<p>Or, back to the title \u2013 the Service Desk has to navigate throughout the whole journey. Otherwise, every crossroad will be a potential pitfall and ETA (Estimated Time of Arrival) changes to -&gt; unknown.<\/p>\n<p><em>To implement ISO 20000 easily and efficiently, use our<\/em> <a href=\"https:\/\/advisera.com\/20000academy\/iso-20000-documentation-toolkit\/\" target=\"_blank\" rel=\"noopener\">ISO 20000 Documentation Toolkit<\/a> <em>that provides step-by-step guidance for full ISO 20000 compliance.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>So, an incident occurred. Service is affected. If you are lucky, event monitoring tools are in place and you will notice the incident before users do. Unfortunately, according to my experience, most incidents are reported by users. Anyhow, now\u2019s when the Incident Management process takes over. The Incident management process as described by ITIL Let\u2019s &#8230;<\/p>\n","protected":false},"author":32,"featured_media":17125,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[416,344,451,447,385],"class_list":["post-4669","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-incident","tag-itil","tag-known-error","tag-problem","tag-service-operation"],"acf":[],"_links":{"self":[{"href":"https:\/\/advisera.com\/20000academy\/wp-json\/wp\/v2\/posts\/4669","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/advisera.com\/20000academy\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/advisera.com\/20000academy\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/advisera.com\/20000academy\/wp-json\/wp\/v2\/users\/32"}],"replies":[{"embeddable":true,"href":"https:\/\/advisera.com\/20000academy\/wp-json\/wp\/v2\/comments?post=4669"}],"version-history":[{"count":3,"href":"https:\/\/advisera.com\/20000academy\/wp-json\/wp\/v2\/posts\/4669\/revisions"}],"predecessor-version":[{"id":18313,"href":"https:\/\/advisera.com\/20000academy\/wp-json\/wp\/v2\/posts\/4669\/revisions\/18313"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/advisera.com\/20000academy\/wp-json\/wp\/v2\/media\/17125"}],"wp:attachment":[{"href":"https:\/\/advisera.com\/20000academy\/wp-json\/wp\/v2\/media?parent=4669"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/advisera.com\/20000academy\/wp-json\/wp\/v2\/categories?post=4669"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/advisera.com\/20000academy\/wp-json\/wp\/v2\/tags?post=4669"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}