Should incidents be closed or kept open for monitoring

By ITIL® from Experience©

Some organizations keep their incidents opened for a few days (e.g. 2 days) after they have been resolved so that the resolution is monitored. Some do this for incidents and major incidents. The rationale for this approach includes:

• IT can follow up with the User a few days later to confirm the incident resolution. This provides a personalized touch and is good customer service
• Keeping the incident opened avoids forgetting to do post incident clean up work such as login a change or a problem especially if other incidents need to be addressed
• It may be a strategy by people to look busier than they actually are

Incidents should be closed when resolved. If need be, they can be reopened. At minimum an action in the ITSM tool should be available to record that the incident was resolved to stop the SLA clock. The reasons to close incidents when resolved are that it:

1. Enables IT to get accurate metrics of the real incident duration
2. Simplifies the management of the process as less calls

   (ITIL Service Operation) A telephone call to the service desk from a user. A call could result in an incident or a service request being logged.
   Source: ITIL® glossary and abbreviations, English, 2011 www.itil-officialsite.com/InternationalActivities/TranslatedGlossaries.aspx

   need to be actively managed
3. Enables IT to report the real impact of incidents to the business (I.e. Availability)
4. Simplifies SLA reporting especially if the time spent monitoring needs to be extracted from the total duration of the incidents to get the actual incident duration
5. Simplifies the tool’s configuration for breach calculations
6. Captures the number of times IT was contacted for service by Users (the natural tendency is often to continue with the original incident record instead of creating a new incident for new business)
7. Calculates the number of times IT attempted to resolve an incident by calculating the number of reopens.

This last point is particularly important as it is a very good indicator of a problem. It also helps to identify training for Service Desk technicians.

If there is a need to keep incidents open as a reminder to follow up with Users, perhaps a more efficient way would be to email them a survey. Or to run a report of incidents closed in the last 48 hours and to contact the users as a follow up.

Related:

• Should the incident be reopened or a new one logged
• Should the incident be closed as soon as the RFC is logged
• How to ensure that incidents and service requests are closed quickly when there is no SLA
• How to automate the chasing of users to confirm that their incident or service request can be closed
• Who closes the Major Incident
• How much detail should people put in tickets

More on Incident Management

From Around the Web:

• Should an incident with workaround remain open once a problem record has been rasied and the two associated?

Category:
ITIL Process > Incident Management

Copyright 2012, 2020 - ITIL® from Experience - Denis Matte