SkarpChapter 8 of 14
Key ITIL 4 Practices I: Service Level, Incident, and Problem Management
Dive into the high-yield operational practices that dominate real-world ITSM—and the ITIL 4 Foundation question bank.
Where These Practices Fit in the ITIL 4 Picture
From Value Chain to Practices
In ITIL 4, practices are flexible sets of resources used to perform work. Earlier, you saw how the Service Value Chain turns demand into value and how Continual Improvement keeps services evolving.
Three High-Yield Practices
This module zooms in on three key practices that dominate real operations and the Foundation exam: service level management, incident management, and problem management.
How They Connect
Service level management sets expectations with customers, incident management restores service when things break, and problem management hunts for and manages the underlying causes.
Exam Focus
For Foundation, you must know each practice's purpose, key terms, tell which practice a scenario describes, and distinguish incidents, problems, known errors, and workarounds.
Service Level Management: Purpose and Key Ideas
Purpose of Service Level Management
Service level management sets clear expectations with customers and ensures services are delivered in line with those agreed service levels. It defines what "good" looks like and checks performance.
Core Definitions
A service level is a specific, measurable result of a service. A service level target is the agreed value of that level, such as 99.9% availability or under 1 hour average response time.
SLA and SLR
An SLA is a documented agreement between provider and customer describing services and service level targets. An SLR is a customer's need or expectation that helps design or revise the SLA.
Good SLA Design
Good SLAs use business-relevant metrics, provide a single shared view of services, and use clear, simple language. Service level management is ongoing communication, not just a one-time contract.
Service Level Management: Real-World Mini Case
The Online Exam Portal
Your university's Online Exam Portal has an SLA between IT and the Exams Office. It defines the service and specific service level targets such as availability and response times.
Sample SLA Targets
Targets might include 99.5% availability per exam period (8:00–20:00), 15-minute response for "exam in progress" incidents, and 1-hour resolution for critical exam incidents.
How SLM Operates
The Exams Office states needs, SLM turns them into measurable targets, IT collects performance data, and both sides regularly review whether targets are met and what to improve.
What SLM Is Not
Service level management does not directly fix incidents and is not just writing SLAs once. It is an ongoing practice of managing expectations and monitoring performance.
Incident Management: Purpose and Key Terms
Purpose of Incident Management
Incident management minimizes the negative impact of incidents by restoring normal service operation as quickly as possible, within agreed service levels.
What Is an Incident?
An incident is an unplanned interruption to a service, a reduction in service quality, or a failure of a configuration item that has not yet affected a service.
Key Tools and Concepts
An incident model is a predefined approach for a type of incident. Priority combines impact and urgency to decide what to fix first.
Exam Clue
If a scenario focuses on unplanned disruption and getting users working again quickly, it is describing incident management, not problem management.
Problem Management: Purpose, Known Errors, and Workarounds
Purpose of Problem Management
Problem management reduces the likelihood and impact of incidents by identifying actual and potential causes and by managing workarounds and known errors.
Problem vs Known Error
A problem is a cause or potential cause of incidents. A known error is a problem that has been analyzed and has a documented root cause and a workaround or planned fix.
What Is a Workaround?
A workaround is a temporary solution that reduces or eliminates the impact of an incident or problem when a full resolution is not yet available.
When You See Root Causes
If a scenario mentions root cause analysis, trend analysis, preventing future incidents, or a known error database, it is describing problem management.
Thought Exercise: Incident or Problem?
Decide whether each situation is mainly Incident Management or Problem Management. Think for a moment before checking the explanations mentally.
- The Wi‑Fi in one building goes down during a lecture.
- You quickly restart the access point and service is restored.
- Which practice is in focus?
- Hint: Unplanned interruption, quick restore.
- You notice Wi‑Fi incidents happen every Monday morning in several buildings.
- You start investigating patterns in logs and design.
- Which practice is in focus?
- Hint: Looking for underlying cause, across incidents.
- A bug in the exam portal sometimes prevents students from submitting.
- You cannot fix the code yet, but you publish a step‑by‑step workaround in the knowledge base.
- Which practice is in focus?
- Hint: Managing workarounds and known errors.
Self‑check (do not scroll up; answer in your head first):
- Q1: Incident management (restore service fast).
- Q2: Problem management (root cause and trend analysis).
- Q3: Problem management, especially error control and workarounds, though incident management will use the workaround when new incidents occur.
Quick Check: Matching Practices to Scenarios
Test your ability to recognize which ITIL 4 practice is being described. Choose the best answer.
A team regularly meets with business representatives to review whether the online student portal is meeting agreed availability and response time targets, and to discuss improvements. Which practice is this MOST likely describing?
- Incident management
- Service level management
- Problem management
- Change enablement
Show Answer
Answer: B) Service level management
The scenario focuses on agreed targets, reviewing performance against them, and discussing improvements with customers. This is service level management. Incident management would focus on restoring service after specific disruptions; problem management would focus on root causes; change enablement would focus on authorizing and scheduling changes.
Quick Check: Incident vs Problem vs Known Error
Test your understanding of key terms around incidents and problems.
Several users report that the file storage service is slow every afternoon. The support team logs each report and restores acceptable performance by moving some workloads, but the underlying cause is still unknown. At this moment, how is the underlying cause BEST described in ITIL 4 terms?
- An incident
- A problem
- A known error
- A workaround
Show Answer
Answer: B) A problem
The underlying cause of multiple similar incidents is a problem. It is not a known error yet, because the root cause and workaround have not been fully analyzed and documented. Each user report is an incident. The temporary action of moving workloads would be a workaround.
Key Terms Review: SLM, Incident, Problem
Use these flashcards to quickly review the must‑know terms for the ITIL 4 Foundation exam.
- Service level management (purpose)
- To set clear business-based targets for service performance and ensure that delivery of services is properly assessed, monitored, and managed against those targets.
- Incident management (purpose)
- To minimize the negative impact of incidents by restoring normal service operation as quickly as possible.
- Problem management (purpose)
- To reduce the likelihood and impact of incidents by identifying actual and potential causes of incidents and managing workarounds and known errors.
- Incident (ITIL 4)
- An unplanned interruption to a service, a reduction in the quality of a service, or a failure of a configuration item that has not yet affected a service.
- Problem (ITIL 4)
- A cause, or potential cause, of one or more incidents.
- Known error
- A problem that has been analyzed and has a documented root cause and a workaround (or a planned permanent fix).
- Workaround
- A temporary solution that reduces or eliminates the impact of an incident or problem when a full resolution is not yet available.
- Service Level Agreement (SLA)
- A documented agreement between a service provider and a customer that identifies services and specifies service level targets and responsibilities.
- Service level target
- A committed, specific, and measurable performance requirement for a service, typically included in an SLA.
- Incident model
- A predefined, repeatable approach to handling a particular type of incident, including steps, responsibilities, and timescales.
Key Terms
- Problem
- A cause, or potential cause, of one or more incidents.
- Incident
- An unplanned interruption to a service, a reduction in service quality, or a failure of a configuration item that has not yet affected a service.
- Priority
- A ranking of the importance of an issue, typically based on its impact and urgency.
- Workaround
- A temporary solution that reduces or eliminates the impact of an incident or problem when a full resolution is not yet available.
- Known error
- A problem that has been analyzed and has a documented root cause and a workaround or planned fix.
- Error control
- Problem management activities that manage known errors and ensure that they are resolved when it is cost-effective.
- Incident model
- A predefined, standardized way of handling a particular type of incident, often used by the service desk.
- Problem management
- ITIL 4 practice that identifies and manages the causes of incidents and potential incidents, including workarounds and known errors.
- Incident management
- ITIL 4 practice focused on restoring normal service operation as quickly as possible after incidents occur, minimizing negative impact.
- Service level target
- A specific, measurable performance commitment for a service, usually expressed in an SLA.
- Service level management
- ITIL 4 practice that sets, agrees, and monitors business-based targets for service performance and manages relationships around service levels.
- Service Level Agreement (SLA)
- A documented agreement between a service provider and a customer that identifies services and specifies service level targets and responsibilities.
- Service level requirement (SLR)
- A customer need or expectation about service levels, used as input when defining or revising SLAs.