• Investigation and diagnosis: In this phase of the incident lifecycle, work is undertaken by the service desk or support areas to understand what has to be done in order to restore service. This is often the most time-consuming part of the process although it can be speeded up using diagnostic scripts and by reference to other incidents and problems as well as known error databases.
• Resolution and recovery: The investigation and diagnosis phase will
arrive at a resolution. This needs to be applied and then testing needs to take place to ensure that the incident has been resolved and service restored. There may be a time lag between a fix being applied and the service running normally again (e.g. there may be a backlog of processing to catch up on). On other occasions, it may not be possible to ascertain whether the fix has worked for a period of time (e.g. if the original issue was with a month-end process). Regardless of where the resolution has been put in place or who was involved, the incident should be passed back to the service desk for closure.
• Incident closure: Only the service desk should close incidents. It needs the user’s agreement that the incident has been resolved. All incident documentation will have to be completed prior to closure and a closure category allocated to allow meaningful metrics to be produced. User satisfaction surveys ought to be conducted for an agreed (in the SLA) percentage of incidents. These user satisfaction surveys can be undertaken via telephone, email or web interface.