Let's Merge Incident and Problem Management

I’ve been involved with ITIL? for nearly 20 years with my time in OGC / HMT and decades of consultancy, training, writing, and blogging. And all this time I’ve preached on the benefits of both Incident and Problem Management as practices and how they should be kept (and managed) separately. These 2 practices are at the heart of efficient and effective service management and customer support and they serve 2 very distinct purposes.

But now I’m asking the question: is ITIL? wrong? Or rather, is the advice to manage the practices separately wrong?

It’s true that, for most organizations, the default recommendation of keeping these practices separate is still the best as their objectives, timelines, and workflows are fundamentally different. However, ITIL? is designed to be flexible isn’t it? There's an increasing demand to combine the practices, so I’ve been using the flexibility of the framework to do exactly that; and with great results.

What is Incident Management?

At its core, Incident Management is about one thing: restoring normal service operation as quickly as possible. It’s reactive, an event has happened that’s impacted someone in a negative way and Incident Management is designed to minimise disruption to users and business operations by getting things back to “business as usual” (whatever that may look like) as quickly as possible. It’s the sticky tape that holds things together that is never meant to be permanent.

Incident Management as the IT organization’s emergency response team. When something breaks or it’s running slow then Incident Management’s job is to put out the fire as efficiently as possible.

I use a number of examples when I’m teaching, but let’s use my pothole example. Imagine if you will than you’re walking out of your office (or any office for that matter) looking at your phone. We all do it. You don’t see the pothole in the pavement and you tip, breaking your leg. Ouch!

Incident Management will:

• Call an ambulance.
• Treat your pain.Put a cast on your leg.
• Give you crutches.

In other words, restore "service" to you getting you up and walking again as quickly as possible, with the immediate disruption addressed.

The focus for Incident Management is on urgency and restoring functionality, not on understanding or fixing the root cause of the problem.

What is Problem Management?

By contrast, Problem Management focuses on a long-term, and sometimes proactive, view. Its purpose is to prevent further incidents from happening by identifying and resolving the underlying causes of disruptions. The root cause.

Returning to the pothole:

Problem Management will:

• Immediately mark the pothole with bollards to improve visibility in the short term.
• Arrange for the pothole to be repaired permanently, ensuring it no longer poses a hazard to others.
• Ask why was the pothole there in the first place.
• Investigate measures to ensure no further potholes appear in the pavement.

Problem Management is about identifying and analysing the root cause, then finding solutions to resolve the underlying causes. Unlike Incident Management, which works in the present and with a sense of urgency, Problem Management often operates on a slower timeline (when was the last time you tried to get a pothole repaired??), prioritising long-term improvements over immediate results.

Why Are These Practices Typically Separate?

Let’s face it. you wouldn’t want the roadwork crew attending to your broken leg, and you also wouldn’t want the doctor fixing the pothole. The objectives, workflows, and skills needed for Incident and Problem Management are fundamentally different, which is why ITIL? treats them as distinct disciplines:

Different Goals:

• Incident Management aims to minimise downtime and restore service quickly.
• Problem Management seeks to identify root causes and prevent recurring incidents.

Different Timelines:

• Incident Management operates on short, urgent timelines.
• Problem Management is a longer-term discipline, involving deeper investigations and systemic fixes.

Different Skillsets:

• Incident Management involves Service Desk / front-line IT staff skilled and tasked with rapid resolution; they hold the reel of tape to hold things together.
• Problem Management typically requires specialist technical analysts skilled in root cause analysis. They’re looking for that permanent fix.

By keeping these disciplines separate, organisations ensure that urgent issues don’t get delayed by lengthy investigations, while systemic problems receive the attention they deserve.

So When Should We Combine Them?

Whilst keeping Incident and Problem Management separate is often the best practice, there are situations where combining them both is needed:

• Smaller Organisations with Limited Resources

In small IT teams, resources are often stretched thin. Maintaining separate workflows and skills for incidents and problems can lead to inefficiencies, duplicated effort, and skills shortages. In these environments, combining the practices ensures that both the immediate and long-term needs of the customer are addressed without unnecessary complexity.

• Organizations Implementing a Structured ITSM Framework

When 1st implementing a structured ITSM framework organizations will start invariably select Incident Management as their starting point. This is a natural starting point, but you can’t ignore long-term, permanent fixes in favor of short-term work-arounds. Without any Problem Management activities then issues will recurr frequently and so what is implemented isn’t true Incident Management, but a merger of Incident and Problem Management practices.

• High-Volume, Repetitive Incidents

I expand on proactive and reactive Problem Management and the specialist skills needed during training sessions and also on my Youtube channel if you need further explanation of the practice, but when incidents occur frequently due to the same underlying issue, proactive Problem Management isn’t always the 1st practice to identify the frequency of these incidents. Invariably Incident Management and the Service Desk are the 1st to identify frequent, and widespread, service interruptions. A combined practice can accelerate both resolution and root cause identification. For example, if a specific group of users frequently experience the dreaded “blue screen of death” then the Service Desk can identify the common attributes amongst the users which forms part of the root cause analysis. That same Service Desk team can also investigate the root cause to implement a fix.

• Organizations Seeking Operational Simplicity

Some organizations aim to streamline their workflows, eliminating handoffs and reducing bureaucracy. Combining incident and problem management allows them to work more efficiently, particularly in fast-moving environments like startups.

• Integrated ITSM Tools

Most ITSM tools support the integration of incident and problem records, allowing for seamless tracking and collaboration. This makes it easier to combine practices without losing visibility into either and is especially important when 1st implementing an ITSM framework.

What a Combined Practice Looks Like

If you choose to combine Incident and Problem Management, it could look like this:

1: Centralized Logging

• All disruptions are logged as incidents in the ITSM tool.
• Incidents that are recurring or have significant impacts are automatically flagged as potential problems.

2: Immediate Response

• Prioritise restoring service quickly for high-priority incidents.
• Front-line staff focus on minimising user disruption.

3: Root Cause Investigation (Parallel Workstreams)

• While resolving incidents, teams initiate root cause analysis.
• Use knowledge bases or previous problem records to accelerate RCA.

4: Preventative Measures

• If a root cause is identified, implement temporary workarounds (e.g., marking the pothole with bollards).
• Schedule permanent fixes where possible.

5: Knowledge Sharing

• Document known errors, workarounds, and fixes in a shared knowledge base.
• Ensure that future incidents related to the same problem can be resolved faster.

6: Continual Improvement

• Periodically review combined processes to ensure they are efficient and achieving the desired outcomes.

Potential Challenges

Combining Incident and Problem Management practices isn’t without risks:

• Loss of Focus: Urgent incidents may overshadow longer-term problem management efforts.
• Resource Strain: Teams may struggle to balance reactive and proactive tasks.
• Skill Gaps: Service Desk staff may lack the expertise (and time) needed for effective root cause analysis.

It’s therefore important that clear a governance structure is in place, with defined policies, processes, skills, roles, and tools to address these challenges and support efficient and effective issue management. It should also be noted that the same distinction between an Incident and a Problem must be maintained even when the practices are combined.

Final Thoughts

Incident and Problem Management are distinct disciplines for good reason, but there are times when a combined approach can bring value—particularly for smaller teams or high-volume environments. By carefully designing a framework that balances immediate resolution with long-term prevention, you can achieve the best of both worlds.

Jo Peacock is a visionary leader in IT governance and organizational change, empowering teams through strategic innovation and best-practice guidance.

Jo Peacock

919 308 0634

[email protected]