👥 People & Roles — Incident Management
Core Roles
Service Desk Agent (L1)
- First point of contact for all incidents
- Logs, classifies, and prioritises incidents
- Attempts first-contact resolution (target: 75%+ FCR)
- Escalates to L2/L3 when unable to resolve within 15 minutes
- Communicates status updates to the affected user
Technical Resolver (L2/L3)
- Receives escalated incidents from L1
- Diagnoses root symptoms using monitoring tools, logs, and CMDB
- Applies technical fixes; documents resolution steps
- Creates knowledge articles for recurring solutions
- Hands back to L1 for user confirmation and closure
Incident Manager
- Oversees daily incident queue health and SLA compliance
- Identifies trends and recurring incidents for Problem Management
- Reviews all P1/P2 incidents post-resolution
- Manages the on-call escalation roster
- Produces weekly and monthly incident KPI reports
Major Incident Manager
- Activated for all P1 critical incidents
- Coordinates cross-functional bridge calls
- Provides executive updates every 30–60 minutes
- Drives towards service restoration (not root cause)
- Owns the Post-Incident Review (PIR) process
Problem Manager (interfacing role)
- Receives patterns and recurring incidents from Incident Manager
- Raises Problem Records to prevent recurrence
- Provides Known Errors and workarounds back to Service Desk
Service Owner (interfacing role)
- Informed of P1/P2 incidents affecting their service
- Approves exceptions to standard escalation paths
- Participates in PIR meetings
RACI Matrix
| Activity | SD Agent | Tech Resolver | Incident Mgr | Major Inc Mgr | Service Owner |
|---|---|---|---|---|---|
| Log & classify incident | R | I | I | I | I |
| P1 detection & declaration | C | C | A | R | I |
| Technical investigation | I | R | C | C | I |
| User communication | R | I | C | A (P1) | I |
| Escalation decision | C | C | A | R (P1) | I |
| Bridge call facilitation | I | C | C | R | I |
| Executive update | I | I | C | R | A |
| Post-Incident Review | I | R | C | A | R |
| Knowledge article creation | I | R | C | I | I |
| Incident closure | R | C | I | I | I |
R = Responsible · A = Accountable · C = Consulted · I = Informed
Skills & Training
| Role | Key Skills | Recommended Certifications |
|---|---|---|
| Service Desk Agent | Active listening, ITSM tooling, basic troubleshooting | ITIL 4 Foundation, HDI |
| Technical Resolver | Systems/network expertise, log analysis, scripting | ITIL 4, vendor certs (MCSE, CCNA) |
| Incident Manager | Process governance, reporting, stakeholder management | ITIL 4 Managing Professional |
| Major Incident Manager | Crisis management, facilitation, executive communication | ITIL 4 MP, COBIT |
Downloadable Resources
| Resource | Format | Download |
|---|---|---|
| RACI Matrix | Word | ⬇ Download |
| Incident Report | Excel | ⬇ Download |
← Back to Incident Management