The Major Incident Process

The following summarises the key components of a major incident process under ITIL.

The following video gives an overview of the process and some key understandings around the process.

Major Incident Management Process Overview

The following steps summarise the major incident process and can be downloaded in the file above which can be tailored to your own purposes.

1) Investigation

Objective

• Swiftly identify the root cause of the incident and explore initial mitigation strategies.

Procedure

• The designated receiving team is allocated a duration of one hour for the primary investigation.
• In many circumstances, it’s more efficient to promptly restart a particular component or service instead of in-depth diagnostics.
• Should the initial investigation require external expertise or additional support, the Major Incident Manager (MI Mgr) may be consulted.

2) Contact the Major Incident Manager

Objective

• Ensure coordinated and effective incident handling.

Procedure:

• If the service disruption persists beyond one hour without a resolution, the incident owner is mandated to engage the MI Mgr.
• The MI Mgr assumes responsibility for overseeing the recovery process and facilitating communications, even if there’s an anticipation of imminent resolution.

3) Assess Criteria for Major Incident

Objective

• Determine the gravity of the situation and decide on the course of action.

Procedure:

• The MI Mgr evaluates whether the ongoing situation qualifies as a major incident based on predefined criteria.
• This evaluation ensures that the MI process isn’t initiated unnecessarily, preventing resource wastage.

4) Investigate & Escalate

Objective

• Perform an in-depth analysis and involve higher tiers if needed.

Procedure:

• The investigating team is given a predetermined window to delve deeper into the incident.
• The primary focus remains on service recovery, with root cause analysis being a subsequent priority.
• All significant findings and updates are meticulously recorded.

5) Manage Recovery & Comms

Objective

• Restore normalcy and keep stakeholders informed.

Procedure

• The MI Mgr holds the reins, supervising all efforts aimed at service restoration.
• While the MI Mgr might seek external assistance, they remain the central figure guiding the overall recovery process.

6) Investigation Review Meetings

Objective

• Facilitate effective team communication during the crisis.

Procedure

• If the situation demands, the MI Mgr assembles the concerned teams for urgent review meetings.
• These meetings are focused on framing the problem, prioritising actions, and assigning ownership to ensure swift resolution.

7) Update Stakeholders

Objective

• Keep major stakeholders in the loop.

Procedure

• The MI Mgr leads the communication efforts, updating stakeholders about the ongoing progress.
• Updates are structured and provided in a consistent, standard format.

8) Communicate Resolution

Objective

• Inform stakeholders once the service is restored.

Procedure

• Post restoration, the MI Mgr disseminates information to all concerned parties, possibly enlisting support from the Help Desk.

9) Produce an MI Report

Objective

• Document the incident and its handling for future reference.

Procedure

• The MI Mgr drafts a comprehensive report capturing the incident’s impact, significant events, follow-up actions, and, if discerned, the root cause.
• This report is shared within 24 hours of incident closure. If the root cause remains elusive, the problem management process is triggered.

10) Close Incident

Objective

• Close the incident record and complete the process

Procedure

• The MI record is formally closed, recording the location of the MI report and any follow-up activities.

Major Incident Roles & Responsibilities

Role	Responsibilities
Help Desk Staff	• Responsible for identifying and logging incidents as they are reported by users. • Capturing information which will help in the analysis of the issue. • Providing updates to customers where requested. • Escalate incidents to the appropriate technical teams or the Major Incident Manager as needed.
Investigating Technical Teams	• Collaborate with other technical teams or 3rd party suppliers as necessary to resolve incidents.• Implement fixes, workarounds, or recovery actions to restore services. • Update the incident management system with the incident resolution progress and status. • Provide input to the Major Incident Manager on the incident status, impact, and expected resolution time. • Participate in post-incident reviews to identify areas for improvement and implement corrective actions.
Major Incident Process	• Coordinate the overall major incident response and resolution process. • Engage and mobilize necessary resources, including technical teams and 3rd party suppliers. • Establish and maintain communication channels with stakeholders, including senior management and affected users. • Ensure timely and accurate updates are provided to stakeholders. • Monitor and track the progress of major incident resolution. • Facilitate post-incident reviews to identify areas for improvement and implement corrective actions. • Create Major Incident Report