Page 1 of 2

Major Incident - Incident Manager Role

Posted: Mon Nov 28, 2011 4:49 am
by gautambangalore
All, I have a query on a Major Incident. Let's say there are array of servers in a storage subsystem and this has the ability to recognize and recognize any single drive failure within the array and any failure of 2 drives is irrecoverable. If these drives start failing one by one and the critical applications hosted on these servers begin toppling. This can be considered an enhanced risk and can someone help me what could be the role of an Incident Manager in the bridge that gets opened for this with the resolution teams and who all should be invited on to such bridge.

Thanks in advance,


Posted: Mon Nov 28, 2011 5:53 am
by Diarmid
Is this an exam question?

If not, could you be more specific please?

Posted: Mon Nov 28, 2011 1:27 pm
by gautambangalore
This is not. Wanted to know in such Major Incident scenario, what would be the role of an Incident Manager on the bridge call and who all are invited?

Posted: Mon Nov 28, 2011 3:54 pm
by Diarmid
I'm still a little hazy as to what your actual question is in context. Perhaps the term "bridge" is in v3; it's not one I have ever used.

In any event, I think my answer starts with:

"An incident manager" does not have any role to play per se. The key person is the person managing the major incident - the incident manager. This role is broadly self-expalnatory. He is tasked with managing the resolution of the incident and is assigned sufficient authority and resources to do so.

As to who will be on the bridge, if I understand the metaphor correctly, there should be any managers of resources that may be required in pursuit of resolution. Or perhaps it should be any managers who may be reqired to lend their authority to the incident manager.

Even if I am incorrect in my interpretation, it is not likely that anyone can identify closely who should be on your bridge without understanding your organization structure. So you must expect a relatively abstract answe in any eventr.

Posted: Thu Dec 01, 2011 2:42 am
by gautambangalore

Thank you for the reply. I guess I need to be a little more specific. When I say bridge, I am referring to the call that gets initiated by the Incident Manager for such major incidents to see to it that the services are restored within the time lines. Now, what role would an Incident Manager have to play on such bridge calls. If I am not wrong, on call you would have the Incident Manager, SDM, ADM, Resolution team which is supposed to resolve that incident and any client side managers. I am sure technically there wouldn't be any role for the Incident Manager to play on this call. Am I correct? If yes, what would be his role on that call?

Posted: Thu Dec 01, 2011 3:22 am

The role of the Incident Manager for the Major incident is to manage the incident not solve the incident

If you get 4 - 5 managers or senior techs on a call,
who is the call leader
who is takign notes
recording actions
initiating the call
providing updates to the customer(s) about the incident
making sure the resolution teams have their actions
making sure the ticket(s) get updated with synopsis and details
Do IT Service Management work related to the Major Incident

The answer to the above is the Incident Manager

Posted: Wed Jan 04, 2012 7:16 am
by gautambangalore
Adding more, would there be a possibility that the resolution teams working on such Major Incident do not give or ignores to give the Incident Manager a timeline as when the service could be restored? If yes, what should be the next step of the Incident Manager. Escalate to the next level of the resolution team?

Posted: Wed Jan 04, 2012 7:48 am
by Diarmid
You make it sound like your IT services dept. is at war with itself.

If the person managing the major incident is not getting communication/reporting/tracking from those s/he commisions to do work, then your organization is broken. If your organization is broken then asking for ITIL guidance is a waste of time.

Posted: Wed Jan 04, 2012 8:44 am
by abu1
Ok...i can relate to the situation abit. The major incident manager should hold meeting with network/infrastructure lead or analyst and maybe service desk manager. All the IM does is oversee the situation and make sure the MI is resolved and service is up and running.

I been in organisations where the IM gets bypassed by the technical team and deals directly with the servicedesk. This is primarily due to lack of ITIL knowledge amongts all the IT team.. they do not understand roles and responsibilities.

the IT dept as a whole neet to be aware of what ITIL is and how it works if they are going to use ITIL methodlogy

Posted: Wed Jan 04, 2012 9:26 am
by Diarmid
abu1 wrote:I been in organisations where the IM gets bypassed by the technical team and deals directly with the servicedesk. This is primarily due to lack of ITIL knowledge amongts all the IT team.. they do not understand roles and responsibilities.
I can't agree.

Failure to recognize lines of communication and authority has nothing to do with ITIL knowledge and everything to do with quality management (or the lack of it). You either have a management system that the staff do not understand or you have a discipline issue.

It is entirely wrong to ever say "Do it this way because we are using ITIL."

It is entirely correct to say "Do it this way because that is how we have designed our management system." Or any variant on that theme.

Posted: Wed Jan 04, 2012 11:02 am
by abu1
no i disagree as they have no issue with reporting to their line mangament. They did not understand the role of IM hence once resolved an incident closed it themselves or passed back to SD

you cannot impliment ITIL without everyone being aware of it. At least every member of the IT team should complete ITIL foundation course and others who do specific jobs can complete specific courses to them such as problem or change

Posted: Wed Jan 04, 2012 12:16 pm
by Diarmid
You cannot implement ITIL. Full stop!!

And While you are at improving your service management system (with some help from the guidance provided by ITIL), you can choose to educate train and inform your staff by any means you think appropriate. Sending them on ITIL training is only one possible approach. They do not even have to have heard of ITIL if you provide them with documented procedures and the the training in how to follow those procedures.

Furthermore, providing ITIL training is utterly insufficient on its own. There are no rules in ITIL for them to follow, and the procedures you design and implement are unlikely to be adhered to, or even to be fully understood, by staff just because they have had some ITIL training.

In summary, staff have to follow procedures, not ITIL.

Posted: Thu Jan 05, 2012 5:17 am
by abu1
yes follow procedures which are itil based and need to have some knowledge if the yare to particpiate and be part of the process..

Posted: Thu Jan 05, 2012 5:44 am
by Diarmid
Procedures should be requirements based. Their design may well be heavily influenced by ITIL, but the focus needs to be on the business requirement, not on ITIL.

I will make the following three assertions:

1. If you train staff in ITIL and provide only generic "ITIL" proceudres, they will not perform in a well co-ordinated way.

2. A person trained in ITIL who moves to a new "ITIL based" company will make wrong assumptions (and thus errors) about how that organization works unless further training is provided on the established procedures.

3. If an intelligent person experienced in service management moves to an "ITIL based" company and is inducted into their procedures, there is no pressing need also to provide ITIL training. If that is untrue, then the procedures are inadequate.

I'm not saying that providing all staff withITIL training doesn't help. It normally will, even greatly. I'm just saying it is not the most important factor and it is not a substitute for well designed procedures and ensuring a good understanding of them.

Posted: Sat Jan 07, 2012 2:21 pm
by Sunny60in

My observation is that, technicians are relatively more interested in resolving the issue versus communicating / updating (incident ticket / sending update emails / informing over phone etc.). If there is a Major Incident, I would prefer Incident manager should take over most of the non technical part from the technicians. I am assuming that service desk is busy handling additional calls due to on going Major Incident.

So, rather than waiting for technicians to update ticket or provide updates on the conferance call, Incident manager should drive the converstaion. He/she can 'ASK' questions to get the updates. I am assuming that Incident manager has the skill set to manage such situation. If there is no help, escalate.

I am not sure if these kind of common sense behavious should be documented. I think it is just the team effort. In case of Major Incident, priority is to minimise the business loss. So if Incident manager has to do a bit of what a technicians does on a regular ticket, it should be ok.