Approaches to address selected incidents are
defined to prevent the future occurrence of incidents or mitigate their
All incidents have one or more underlying
causes that trigger their occurrence. Addressing the underlying cause of
some incidents may reduce the likelihood or impact of service
interference, reduce the workload on the service provider, or improve the
level of service. The practices in this goal cover the analysis of
incidents to define how to address them. The results of this analysis are
fed back to those who control and address incidents.
Underlying causes can be identified for
incidents and possible future incidents.
The root cause of an incident is often
different than the immediate underlying cause. For example, an incident
may be caused by a faulty system component (the underlying cause), while
the root cause of the incident is a suboptimal supplier selection process.
This process area uses the term “underlying cause” flexibly, ranging from
immediate causes or conditions to deeper root causes, to allow for a range
of possible responses from workarounds to prevention of a class of related
Examples include analyzing the cause of a
delivery error or system outage and monitoring use of software
memory to detect memory leaks as soon as
Refer to the Causal Analysis and
Resolution process area for more information about determining causes
of defects and