Major Incident Management only becomes frustrating when the team cannot restore service or solve the incident in the specified time. Those seemingly more complex incidents that ‘hang around’ for hours or even days are the ones that put teams under the most pressure and call for reasons and/or changes to understand why it took so long.
Many companies we work with have a process for Major Incident Management (MIM) and they differ greatly between clients. It is generally not the structure or steps in the process that is at fault, but rather the questioning structure used to gather information. Questioning is critical in the investigation phase of MIM as this is generally where 80% of the incident life cycle is spent. Once we know the correct factual information, only 20% of the time is spent on resolution or viable workaround implementation.
The biggest challenges to overcome with MIM information issues are:
- > Incident statements too vague.
- > Gathering irrelevant information.
- > Teams working on theories before understanding the facts.
Incident Statements too vague
The incident statement is the foundation of everything that is about to unfold in the incident investigation. If this step is not accurate or too vague then the incident is very likely to become long and drawn out.
Always ask yourself, “How many possible causes could there be for this incident statement?” If the answer is many or hundreds, then your statement is too vague. This will lead to unnecessary changes being backed out, which may cause other incidents, and drastically extended timeframes and wasted resource utilisation.
You need a specific questioning drill to get the foundation statement right and specific from the beginning so the information/facts that you gather are relevant and concise so they inspire the correct intuition from the investigation team.
Gathering Irrelevant Information
The biggest is issue with gathering information is relevancy. If you know the right questions to ask, then you gather only the relevant information which prevents "analysis by paralysis," which drastically extends incident duration. Doing this correctly also prevents over complicating a situation that may have been not that complicated to start with! A key piece here is having the 'Incident Statement' correct otherwise you may be gathering information not directly related to the most specific ‘Object' or ‘Fault'.
Teams working on theories before understanding the facts.
It is a natural human intuition to fix things and this means that teams generally jump into what we think is causing the problem. This blinkered thinking is generally the direct cause of incidents running much longer than necessary. Using a quick systematic, structured and repeatable critical question technique with a common language, will quickly help you understand the basic required facts of the situation.
Once you have these facts, you can test any theory or possible cause before a team invests precious time investigating. This will either ensure they are in fact, working on a likely situation or, in most cases, reveals that this theory does not explain certain facts and investigating it will waste time.
If you are interested in learning more about finding causes and solving problems, click here: 
