Global Knowledge

This is a question that we continue to be asked all the time.
How can you distinguish between incidents and problems?
This article will address this issue and provide clarification. It will identify the differences between incidents, problems, how they are related and why it matters.

What is an Incident?
ITIL 4 defines an incident as an unplanned interruption or decrease in the quality of a service. The most important factor in determining whether something is considered an incident is whether the service level agreement was violated. ITIL permits you to raise an incident or problem even before the SLA or targets are breached. This allows you to limit or prevent any impact. Automated system monitoring might notice a decrease in response time or another error before the SLA is broken. Customers may even notice it. An incident is a description of an outage.

What is a problem?
ITIL 4 defines a problem as a cause or potential cause of one or more incidents. Problems can be raised to address a single incident or multiple similar incidents. They can be raised even without the existence or occurrence of an incident. Monitoring may uncover an issue that has not yet led to an incident, but if it isn’t addressed, it could cause more problems. A problem is, in layman’s terms: the representation of the cause or potential causes of one or more outages.

What makes best practice distinguish between problems and incidents?
It is easy to distinguish between problems and incidents. Problems are the cause and incidents the effect.
ITIL 4 encourages organizations not to confuse the two, as they are often treated differently. An incident is simply a declaration that the affected service has been “temporarily restored”. This does not mean that the incident won’t happen again in the future. Temporarily could refer to a period of time, such as a minute or ten years. It is important to remember that an incident resolution is not always permanent.
However, incidents are often caused by problems. There are many ways to identify the root cause of a problem. We may also use different techniques to find possible solutions.
By providing a mechanism to quickly restore service if it’s needed, effective incident management will ensure that you as a service provider can keep your promises. Problem management allows service providers to quickly respond to incidents to prevent them from recurring.
These two practices are distinct in ITIL 4 because they often require different skills and activities. Incident management aims to quickly restore service to the level required by any SLAs, while problem management aims to eliminate the root causes of incidents.

Similar training
ITIL(r), 4 Foundation
Workshop on Problem Management: Define and Implement
Define and Implement Service Desk and Incident Management Workshop

Additional resources
ITIL4 Guiding Principles in just 30 minutes