SkarpChapter 8 of 13
Core Operational Practices: Service Desk, Incident, and Request Management
Most professionals first meet ITIL through tickets and queues. This chapter connects those everyday activities to the precise ITIL 5 practices and terminology you’ll see on the exam.
Step 1 – Orienting: Where These Practices Fit in ITIL 5
From Value Streams to Operations
ITIL 5 focuses on how practices form value streams. This module zooms in on three operational practices: service desk, incident management, and service request management.
What the Exam Cares About
You must know the purpose of each practice, their key activities, and how they support service levels and customer experience in real workflows.
Simple Mental Model
Service desk is the face of IT, incident management restores normal service after unplanned interruptions, and service request management handles user requests they are entitled to.
Step 2 – Service Desk: Purpose, Channels, and Role
Service Desk as a Practice
In ITIL 5, service desk is a practice. Its purpose is to capture demand for incidents and service requests and act as the single point of contact for users.
Communication and Coordination
Service desk focuses on effective, convenient communication. It coordinates with other practices rather than doing all technical work itself.
Channels and Exam Traps
Typical channels: phone, email, portal, chat, walk-up. Exam trap: service desk supports both incidents and requests but does not define or own those practices.
Step 3 – Service Desk in Action: A Short Scenario
Scenario Setup
A student cannot log in to the learning platform 30 minutes before an online exam. They call the university IT service desk.
Service Desk Steps
The desk receives the call, clarifies details, logs the ticket, checks the knowledge base, tries quick fixes, and flags a potential major incident if many students are affected.
Key Takeaway
Service desk acts as the communication hub: other teams investigate technically, but the desk owns user updates and expectations.
Step 4 – Incident Management: Purpose and Workflow
What Is an Incident?
An incident is an unplanned interruption to a service, a reduction in service quality, or a failure of a configuration item that has not yet affected a service.
Purpose of Incident Management
The goal is to minimize the negative impact of incidents by restoring normal service operation as quickly as possible, as defined by SLAs.
Typical Activities
Key steps: logging, categorization and prioritization, initial diagnosis, escalation, investigation, resolution and recovery, and closure with proper documentation.
Common Exam Traps
Incident management restores service; problem management handles root cause and prevention. Incidents may be logged by users, service desk, or automated monitoring tools.
Step 5 – Service Request Management vs Incident Management
What Is a Service Request?
A service request is a user request for something to be provided, such as access, a new device, information, or a standard change from a catalog.
Purpose of Service Request Management
This practice handles all predefined, user-initiated requests in an effective and user-friendly way, supporting agreed service quality.
Incident vs Request
Incident: something is broken or degraded. Service request: user asks for something they are entitled to. Requests follow standard, often automated workflows.
Typical Exam Traps
Password resets are usually service requests if they follow a standard process. Requests focus on fulfillment efficiency, not urgent restoration.
Step 6 – Classify These: Incident or Service Request?
Decide whether each situation is an incident or a service request. Think it through before you check the explanations.
- A user cannot send emails because the mail server is down.
- A new employee needs an account created in the HR system.
- A user asks for last month's sales report.
- A user reports that the website is very slow for all customers.
- A student clicks "Forgot password" and follows the standard reset flow.
Suggested answers (check yourself):
- Incident – unplanned interruption to email service.
- Service request – standard onboarding request for access.
- Service request – request for information.
- Incident – performance degradation of a service.
- Service request – uses a predefined reset workflow.
If you misclassified any, rephrase the rule in your own words:
- "If something is broken unexpectedly, it is an incident. If I am asking for something that is part of the normal service offering, it is a service request."
Step 7 – Major Incidents and Escalation Paths
What Is a Major Incident?
A major incident has significant business impact, often affecting many users or critical services, and needs an urgent, coordinated response.
How Major Incidents Are Handled
They involve rapid declaration, a dedicated coordinator, a war room or bridge, enhanced communication, and a post-incident review.
Escalation Types
Functional escalation sends tickets to specialized groups; hierarchical escalation raises issues to higher management due to impact or risk.
Key Exam Point
Major incidents are still incidents. They are handled with special procedures but are not a separate ITIL practice.
Step 8 – KPIs and Common Exam Traps for Operational Practices
KPIs for Service Desk
Common measures: first contact resolution, average speed of answer, user satisfaction, and call or ticket abandonment rates.
KPIs for Incidents and Requests
Incident KPIs: mean time to restore, SLA compliance, reopened incidents. Request KPIs: fulfillment time, automation level, and user satisfaction.
Key Exam Traps
Do not mix incident vs problem management, or service desk vs technical teams, or incidents vs service requests, and remember major incidents are still incidents.
Quick Decision Heuristic
Ask: is the main goal communication (service desk), rapid restoration (incident management), or providing something requested (service request management)?
Step 9 – Quick Check: Who Owns What?
Test your understanding of responsibilities across the three practices.
A user calls about a critical outage. The service desk logs the ticket, gives initial advice, then passes it to a specialist team. Which statement best describes what is happening?
- Service desk is performing incident management and problem management at the same time.
- Service desk is acting as the single point of contact while incident management is carried out by specialist teams.
- Service request management is handling a major incident through functional escalation.
- Incident management is responsible only for logging, while service desk owns the resolution.
Show Answer
Answer: B) Service desk is acting as the single point of contact while incident management is carried out by specialist teams.
The service desk logs the ticket and communicates with the user as the single point of contact. Specialist teams perform most incident management activities. Problem management and service request management are not mentioned here.
Step 10 – Flashcard Review
Use these flashcards to reinforce key exam terms and distinctions.
- Service desk (purpose)
- To capture demand for incident resolution and service requests and to be the single point of contact for users, focusing on effective communication and coordination.
- Incident (definition)
- An unplanned interruption to a service, a reduction in service quality, or a failure of a configuration item that has not yet affected a service.
- Incident management (purpose)
- To minimize the negative impact of incidents by restoring normal service operation as quickly as possible.
- Service request (definition)
- A user request for something to be provided, such as access, information, or a standard change from a predefined catalog.
- Service request management (purpose)
- To support the agreed quality of services by handling all predefined, user-initiated service requests in an effective and user-friendly manner.
- Major incident
- A high-impact incident affecting many users or critical services, requiring urgent, coordinated response. It is handled as a special case within incident management.
- Functional escalation
- Passing a ticket to a more specialized support group or team when additional expertise is needed.
- Hierarchical escalation
- Informing or involving higher management due to the impact, urgency, or risk associated with an incident or issue.
- First contact resolution (FCR)
- A service desk metric showing the percentage of tickets resolved during the initial contact, without needing escalation.
- Mean time to restore service (MTRS)
- An incident management metric measuring the average time taken to restore normal service after an incident.
Key Terms
- Incident
- An unplanned interruption to a service, a reduction in service quality, or a failure of a configuration item that has not yet affected a service.
- Service desk
- ITIL 5 practice that captures demand for incident resolution and service requests and acts as the single point of contact between service provider and users.
- Major incident
- An incident with significant business impact, often affecting many users or critical services, handled with special urgency and coordination.
- Service request
- A user request for something to be provided, such as access, information, advice, or a standard change.
- Incident management
- Practice that minimizes the negative impact of incidents by restoring normal service operation as quickly as possible.
- Functional escalation
- Routing a ticket to a more specialized support group or higher technical level.
- Hierarchical escalation
- Raising an issue to higher management due to impact, urgency, or risk.
- Service request management
- Practice that handles all predefined, user-initiated service requests in an effective and user-friendly manner.
- First contact resolution (FCR)
- Percentage of tickets resolved during the initial interaction with the service desk.
- Mean time to restore service (MTRS)
- Average time required to restore service after an incident has occurred.