Should a Major Incident be declared if it was resolved automatically by the fail-over

By ITIL® from Experience ©

Lets take the following situation as example:
Network access was disrupted temporarily and the service automatically restored itself as soon as the fail over came on line. As a result, the interruption or outage can be measured in seconds however, users must logout and log back in to restore their network based services.

In this situation some people would argue that a Major Incident is not required since the service was restored and therefore the incident1 has been resolved. For sure an incident can be logged to record the event, but it’s hardly a Major Incident2 since it has come and gone. After all if a tree fell in the forest and no one there was there to hear it fall, did it make a sound? In this situation, a Major Incident should be opened if there was a high impact to the business or if it was significantly disrupted. If there was no impact to the business, like when netwrok traffic was automatically redirected to another switch, than a Major Incident is not required and a simple incident can be opened.

The reasons why a Major Incident should still be opened even if it has been resolved are:

  • That the Service Desk may still be receiving a large volume of calls. For example, people may not know that they must logout and back in to restore their network services and the ITSM Tool's functionality related to Major Incidents enables the Service Desk to quickly log repetitive incidents
  • To initiate the Major Incident communication protocol or procedure (since the CIO is likely to hear about it, it’s better that he/she hears it officially from operations)
  • For visibility and reporting. This is especially important if the organization does not have a good Availability Management process
  • To initiate the Problem Management process if the organization has a policy to do a root cause analysis for every major incident (see How to first introduce Problem Management)
  • To document the event and its resolution to help resolve similar incidents in the future and to provide data for problem management trend analysis

Declaring and logging a Major Incident after the fact even if the SLA clock is stopped initiates the Major Incident procedures and enables the organization to realize the process’ benefits.


More on Incident Management

From Around the Web:

ITIL Process > Incident Management


Incident: (ITIL® Service Operation) An unplanned interruption to an IT service or reduction in the quality of an IT service. Failure of a configuration item that has not yet affected service is also an incident – for example, failure of one disk from a mirror set.
Source: ITIL® glossary and abbreviations, English, 2011, http://www.itil-officialsite.com/InternationalActivities/TranslatedGlossaries.aspx


Major Incident: (ITIL® Service Operation) The highest category of impact for an incident. A major incident results in significant disruption to the business.
Source: ITIL® glossary and abbreviations, English, 2011, http://www.itil-officialsite.com/InternationalActivities/TranslatedGlossaries.aspx


Copyright 2013-2016 - ITIL® from Experience - D.Matte