Why Every Company Needs an Incident Management System

Incidents happen and the key is to learn from them. Once reported, you can identify, analyse and prevent the same incidents from happening again. This article is written for operations leaders to get a brief intro to incident management and how it can help a company.

Imagine you are at the office and have just left a meeting. You grab a cup of coffee on the way back to your desk and as you are walking down the corridor, you hear: “I slipped on the stairs – again!”.

Or it may also be a slightly odd e-mail, where you receive a “thank you for your help”-email regarding an invoice you never approved.

There are lots of situations where an incident management system is a really good idea. But there are pitfalls along the way that you need avoid in order to reap the benefits.

What is incident management?

Incident management is about managing incidents in a systematic way. So, an Incident Management System (IMS) is a structured approach to effectively respond to and mitigate unexpected events or crises. It requires processes, tools, and personnel coordination to effectively assess, prioritize, and resolve incidents. IMS typically includes incident identification, reporting, response planning, resource allocation, and communication protocols. It is crucial in various fields, such as emergency response, cybersecurity, and IT, to minimize disruptions, ensure safety, and restore normal operations swiftly. IMS promotes organized, coordinated actions to manage and learn from incidents, ultimately enhancing preparedness and resilience.

“System” does not mean “IT system”

It is important to emphasize that neither the ISO standards nor the ITIL collection of best practices require that you implement an IT system. A “system” should be interpreted as a body of knowledge that helps the organisation towards the desired goal of improving the business within a certain field (IT security, HSE etc.).

An IT system is just a convenient way of implementing the processes and best practices.

According to ISO 27001: “This International Standard adopts a process approach for establishing, implementing, operating, monitoring, reviewing, maintaining and improving…” – not a word about the need for a specific IT system.

Having, using and improving the processes is “system” enough. Buying an IT system specifically for incident management is potentially a waste of money, as it is the processes that deserve the center stage.

With that clarified, let’s dive into its benefits.

Benefits from an incident management system

In short, incident management lets your company…

• Prevent incidents from becoming accidents (where it’s really going to be costly).
• Ensure legal compliance or mitigate contractual obligations – in which case you don’t have a choice.
• Ensure that incidents never happen twice.
• Quickly restore production to normal.
• Understand, learn and share your knowledge leveraging the productivity of the entire company.

Risks from not having an incident management system

If you don’t have a structured way to manage incidents, risks such as…

Challenges when starting with incident management

What kind of challenges can you expect, when you start implementing an incident management system?

Not having the right data to analyze and prevent future incidents

What happened? And what happened just before? Any pictures? Log files? 

Lack of content, data and surrounding knowledge about the situation can make it harder to analyse and find a solution to prevent the same thing from happening again. To help facilitate the reporting, you can make clear, accessible work instructions along with a form that collects the required amount of data.

Incident reporting is too difficult

Make sure that everyone knows that you have a reporting tool – and where to look for it. Ensure that everyone has access to it and make it crystal clear what kind of information is needed for the report or you won’t get the whole picture of the incident. 

When reporting is an uphill battle, there is a high risk that it will not be done.

To address such data challenges you should design your incident management system around the 5 best practices described below.

5 incident management best practices

Whether you are a small business or a large corporation, an incident management system will help you increase productivity and strengthen operations. Here are a few bullets on how incident management software can help you.

#1 Ensure correct reporting of incidents

First step is to report the incident. Without that nothing else matters. It will be a help for you to have uniform templates and make your report in a digital process platform all employees have access to – and knowledge about.

When you work with reporting in an incident management system, you can document to stakeholders and partners, what has happened.

When you do incident reporting in a digital process platform like Gluu, all instructions and reports are stored in one place. You will no longer spend time finding incident reports in different software systems or departments in the company. In this way Gluu makes it easier to store all work instructions and reporting in one place.

#2 Speedy recovery – getting back on your feet

Incidents and breakdowns can cause delays in production and operations. They can cause confusion and take time, if the organisation does not know how do handle them. Who is responsible for taking action and find a solution? What will you do to ensure that it will not happen again?

First of all you have to stop it, prevent it from doing more damage and get back to normal mode.

Good incident management software can also help describe how to recover, restart or refill your machinery, so you can get back in business as quickly as possible.

#3 Analyse, learn, mitigate, repeat

Once you have a clear understanding of what happened (and the immediate problem has been handled) you need to understand the cause. There are lots of brilliant tools for finding the root causes, but very often people move on, as the immediate problem has been solved. The fire has been put out – why care?

Ideally, your incident management system contains a clear process for data collection, analysis and corrective actions etc. that can force everyone involved to put in the work needed to truly ensure prevention in the future, not just correction in the present.

#4 Improve how you improve

Gaining new knowledge is not a “one-off”. When you start reporting the incidents and analyzing what caused the issues, you will see that your initial process might not cover everything or that your analysis, mitigation, and/or recovery can be improved.

Once you realise what caused the incident and what solved it, you need to make improvements such as:

In Gluu we have examples of how you can work with incident reporting and management. If you encounter new situations or variations from your current best practice, you can easily just add the new knowledge to your existing process, thus ensuring that you are as ready as possible for next time.

#5 Manage risk without closing the business

The cure must not be worse than the problem and therefore you must consider how you find the proper level where lowering the risk further cannot be justified from a business perspective.

We establish this by using a principle called ”ALARP” (As Low As Reasonably Practicable), and although the term originates in safety management, the concept is an essential one for all forms of risk management:

Conclusions

An incident management system is the structured approach to delaying with incidents. It is not about software but about how you analyse and learn from each incident and prevent that it can happen again. Preventing incidents means lowering business risk and hereby lowering costs.

The main challenge with establishing an effective incident management system is getting the right data. For this to happen, incident reporting must be easy and effective.

I hope you found this overview useful and suggest the following articles to dive deeper into the topic:

• Improving Employee Incident Reports for Better Data
• How to set up incident reporting (1/2)
• Simplified Guide to Incident Root Cause Analysis
• How to get to managing new COVID-19 incidents digitally in just half a day
• A3 Report

Incident Management System FAQs