[Blog] How ITIL distinguishes an Incident and a Problem
There is frequently a conflict between Incident Management and Problem Management. It’s a question we still get asked all the time, is how to differentiate an incident from a problem.
To address this and offer clarification, this article will identify the differences between the two, how they are related, and why it matters.
What is an Incident?
According to ITIL 4, an incident is an unplanned interruption to a service, or reduction in the quality of service. The main goal of Incident management is “to minimize the negative impact of incidents by restoring normal service operation as quickly as possible.”
For e.g., the five-hour outage that cost Delta Airlines $150 million in 2016 was an incident. The problem that caused that incident was a loss of power at an operations center and, presumably, no backup plan in case of that loss of power.
What is a Problem?
According to ITIL 4, a problem is a cause of one or more actual or potential incidents. Problems can be raised in response to a single significant incident or multiple similar incidents. They can even be raised without the existence of a corresponding incident.
For e.g., the 12-hour app store outage that cost Apple an estimated $25 million was an incident. The problem behind it? A DNS issue.
The purpose of Problem management is to investigate and identify the root cause of events and finding permanent solutions, workarounds and known errors.
If we used these terms outside the world of technology, you are driving a car suddenly you realize your car tire is punctured. Now getting the tire fix would be an "Incident".
But your car tire has punctured multiple times in a month would be a "Problem" (as it has occurred repeatedly). You realize it is due to a crack in wheel rim which is the root cause of repeated tire puncture. Now fixing the wheel rim to prevent tire puncture would be the "Problem management".
Why It’s Important to Know the Difference Between the Two:
While Incident Management and Problem Management are similar, ITIL 4 encourages organizations to distinguish between the two because they are often treated and resolved differently.
The main difference lies in the ultimate end goal, addressing an incident simply means that whatever service was impacted has been “temporarily” restored. It does not mean that the incident will not recur at some time in the future. When we say “temporarily,” keep in mind that could mean one minute or 5 years. The point is that a resolution to an incident is not always permanent.
Problems, however, are the cause of incidents. We might use different techniques to identify the underlying causes of a problem, potential workarounds and ultimately a structural resolution to the problem.
Bottom Line:
Implementing effective Incident management ensures that you are able to keep the promises you made in your SLAs by providing a mechanism to quickly restore service when it’s necessary.
Implementing effective Problem management ensures that you are able to reactively respond to incidents so that they don’t repeat and proactively prevent incidents from happening.