How is an incident defined in ITIL?
ITIL 4 Foundation, objective 7. Seven ITIL practices in detail easy
Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.
Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.
How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.
The options
Not correct A cause, or potential cause, of one or more incidents
That is the definition of a problem. A problem is the underlying condition; an incident is the visible loss of service the condition produces.
Correct An unplanned interruption to a service, or a reduction in the quality of a service
Correct. Note the second half: full outage is not required. A service that still runs but has degraded below its agreed quality is already an incident.
Not correct A request from a user that initiates a service action agreed as a normal part of service delivery
That is a service request. Nothing has failed; the user is asking for something the provider has already agreed to supply routinely.
Not correct The addition, modification, or removal of anything that could have a direct effect on services
That is the definition of a change. Changes are planned interventions, whereas an incident is by definition unplanned.
Why
The definition has two limbs — unplanned interruption and reduction in quality — and the second is the one candidates forget. A slow but functioning service that breaches its agreed performance is an incident, not merely a complaint.
Where this comes from
- Cited
- ITIL 4 syllabus clause 7
Practise this
Reading one question is not practice. The trainer will draw a short set from objective 7 and space the ones you get wrong.
More questions on this objective
- Which statement best describes what the incident management practice is intended to achieve? machine-checked
- Several incidents are open at once and the support team must decide which to work on first. On what basis should the order be decided? machine-checked
- A difficult incident is worked on by pulling several specialists from different teams into the same session at the same time; once it becomes clear who is best placed to continue, the others step away. What is this technique called? machine-checked
- Why does an organisation define a separate procedure for major incidents rather than handling them exactly like all other incidents? machine-checked
- A support team routinely fixes incidents by phone and updates the incident record only with the word 'fixed'. What is the most significant consequence of this? machine-checked
- The service desk cannot resolve an incident with the information available to it. According to the incident management practice, what should normally determine where the incident goes next? machine-checked