triage-incident-vs-problem

name	triage-incident-vs-problem
description	Classify an issue as an incident (restore service now), a problem (remove the recurring cause), or a major incident (declare command), and open the right record. Reach for this when something is broken or keeps breaking.

Skill: Triage incident vs problem

Two different jobs with two different success metrics. Get the classification right or you firefight forever (§2 #1).

Step 1 — Is it a major incident?

Check the major-incident criteria (broad impact / critical service down / high urgency). If yes, declare it and switch to the major-incident process (commander + comms) — see the major-incident-runbook.

Step 2 — Incident or problem?

• Incident — service is degraded/down now; the job is to restore it fast (a workaround counts). Metric: time-to-restore.
• Problem — the underlying cause of one or more incidents; the job is to remove it. Metric: recurrence eliminated.
• A recurring incident is the signal to open a problem alongside restoring the incident.

Step 3 — Prioritize the incident

Impact × urgency → priority. Restore with the fastest safe path; a documented workaround is a legitimate restoration.

Step 4 — Drive the problem to root cause

Open a problem record, run RCA, and log the known error (cause + workaround) so the next occurrence is fast to handle.

Step 5 — Feed the permanent fix forward

The permanent fix usually needs a change → hand to the change-and-release-manager. Traverse the routing tree in ../../knowledge/itsm-decision-trees.md.