Process mining is a hot technology that has proven to be very useful for enhancing the incident management process. In this blog, I share some of our customers' experiences from the past few years.
What is Incident Management Process?
The incident is an unplanned interruption to an IT Service. It may be complete unavailability or a reduction in the quality. The goal of the incident management process is to restore a normal service operation as quickly as possible and to minimize the impact on business operations. Incident Management is a key process in Information Technology Infrastructure Library (ITIL).
15 Benefits of Using Process Mining for Incident Management Process
1. Get visibility and transparency into your current incident management process.
2. Identify the main process steps in your as-is incident management process as well as the exceptional and unwanted process steps.
3. Find out how escalation rules are working and how the escalation is done.
4. Calculate incident management KPIs including SLA (%), TimeToResolution (days), FirstTimeRight (%).
5. Find root causes for process problems.
6. Analyze the effect of the opening interface (email, phone, web form, etc.).
7. Analyze the different working habits of various teams and individuals.
8. Better productivity through understanding the effect of incident categorization.
9. Calculate the cost of the incident process.
10. Identify products & services that cause the biggest amount of extra work.
11. Understand the reasons behind re-opening incident tickets.
12. Provide bases for continuous (weekly/monthly) incident management process review, follow-up, and improve action prioritization.
13. Align the Incident Management System with your incident management process.
14. Predict the outcome of currently open cases.
15. Support for Robotic Process Automation for incident management process.
1. Get visibility and transparency into your current incident management process
Incident Management as such is about reacting to the unplanned exceptions. As soon as each incident is logged into the incident management system, the process finds a resulting may be very systematic & repeatable, or it may be chaotic & ad-hoc. Incident Management systems typically contain certain process steps, and assignments that someone thinks should be followed, but the reality might be different from the planned process. Process mining visualizes the incident management process based on actual data in systems and gives stakeholders a commonly shared view to start improving the process.
2. Identify the main process steps in your as-is incident management process as well as the exceptional and unwanted process steps
Many process steps add value and are beneficial in terms of finding a resolution quickly and keeping customers happy. Some process steps are typically unnecessary, and they should be avoided. Examples are re-assigning incident tickets multiple times, too long waiting times, unnecessary questions to customer, ping-pong between 1st line helpdesk and 2nd / 3rd line specialist. However, to solve the most complex tickets, many activities are needed, so it is not always so easy to determine what good and what is bad. Process Mining is an analysis methodology giving insight to the incident management process allowing determination of value created by each process step. In general: you should conduct those steps that create the most value and stop doing steps that do not add value.
3. Find out how escalation rules are working and how the escalation is done
Escalation is needed to give special focus on critical incident tickets. If service level agreement (SLA) can be met without escalation, then the process is typically considered to be in good order. If SLA is not met then we can either a) improve the whole process b) improve escalation mechanism to allocate more resources to most major incidents. Well working escalation process may substantially improve customer satisfaction and turn the incident issues into opportunities for co-operation.
4. Calculate incident management KPIs including SLA (%), TimeToResolution (days), FirstTimeRight (%)
You get what you measure! Advanced process mining and analysis tools like QPR ProcessAnalyzer calculate all the needed process KPIs for Incident Management process automatically. And it is not just the KPI itself, the whole process mining model is used to validate the analysis and for example exclude incidents that have been created based on "spam emails" or other exceptional cases that should not be taken into account when calculating KPIs.
5. Find root causes for process problems
QPR ProcessAnalyzer has a unique Influence Analysis functionality which can identify the most relevant root causes for process problems and KPI challenges. In data scientist terms, this is made possible by applying artificial intelligence methods like associative rule mining to a large number of feature vectors created based on transaction level event data from incident management system log files.
6. Analyze the effect of the opening interface (email, phone, web form etc.)
The opening interface may have a big effect on SLA and customer satisfaction. Many of our customers have made the finding that certain service channels (opening interface) work better or worse for certain kind of incident issues. This information is then used to guide customers in selecting the right interface. Some findings include: use phone when incident can be solved during the call/1st line and prefer written opening when there is likely to be additional questions.
7. Analyze the different working habits of various teams and individuals
Some teams achieve better results than others. Process mining enables sharing best practices by comparing the results and pointing out differences in team working habits and behaviors. For large organizations, having operations in several locations, the best practice sharing is a great benefit.
8. Better productivity by understanding the effect of incident categorization
Incidents are different. Categorization helps people to understand, plan the required actions, and allocate resources optimally. Using advanced AI methods like Clustering based on unsupervised learning the QPR ProcessAnalyzer analysis can suggest categorizations that increase the productivity of the incident management teams.
9. Calculate the cost for the incident process
One can say that incident management is all about costs. With unlimited budgets, it would be possible to a) hire super talented people, b) teach everything to everybody c) have more than enough people working 24d/7d. We all know this is not possible. Adding the costs into the process mining analysis makes it possible to understand the cost structure of whole incident management operations and based on that allocate resources optimally for maximizing the selected KPIs.
10. Identify products & services causing the biggest amount of extra work
To make continuous improvements to customer service, it is important to understand which products & services are causing the biggest amount of work to incident management people. This information turns into monetary savings when it is shared with product & service owners responsible for the corresponding items. After the discussions with owners, it is beneficial to set up a longer-term plan highlighting the need for either a) improving the product/service (or replacing it with an alternative) or b) improve the competencies and capability of the incident management team for solving related incidents more effectively.
11. Understand the reasons behind re-opening incident tickets
From the process point of view, it is typically bad to re-open an already closed incident ticket. However, re-open exceptions may lead to discovering additional knowledge related to the incident management process. With QPR ProcessAnalyzer's influence analysis for process flowchart feature, it is possible to find activities and process steps that take place early in the process and have an effect on the probability of need to re-open the ticket later. This is typically a sign that something is not done "first time right" in that particular step. Typically re-thinking the instructions and details of those particular tasks may result in a much lower re-open rate and better customer satisfaction.
12. Provide bases for continuous (weekly/monthly) incident management process review, follow-up and improve action prioritization
Making the improvement of the incident management process systematic is a key for long term efficiency and incident management process excellence. Process mining is a superior tool for reading in the new incidents and all events related to those on a daily level and providing the fact-based information to support improving the process and operations. Typically the process improvement review is done on a weekly/monthly basis compared to the day-to-day operational dashboard available in real-time.
13. Align the Incident Management System with your incident management process
14. Predict the outcome of currently open cases
QPR ProcessAnalyzer with the OpenR integration can predict the outcome of any open incident using machine learning model based on actual incident management process data from an earlier incident. It is possible to show a list of "incidents likely to fail the SLA" on a daily/hourly/weekly basis and let management react to the current situation and make decisions for resource allocation.
15. Support for Robotic Process Automation for the incident management process
Companies that want to automate their operations using RPA it is possible to automate individual non-value adding manual process steps. Process mining has a key role for analyzing the current process behavior before the RPA project - if there are too many exceptions, then it is important to re-think the process and carefully understand which process steps and incident types should be handled automatically and which still should be treated manually.
How to apply process mining for Incident Management process?
Follow these simple steps for conducting your analysis:
1. Collect the date: Make sure your incident management system makes a log of the incidents. Each time something is done for the incident there should be a log entry with three mandatory data items: incident number, timestamp and some kind of description of what was done (for example, activity name).
2. Extract the data and load into process mining tool: This is easy - tools like QPR ProcessAnalyzer have ready-made connectors to many commercial and open-source incident management tools and if you are using a proprietary system then there is always good interfaces for loading data directly from the database or manually from files.
3. Analyze the incident management model and make business-oriented findings
4. Run the automated root cause analysis to see what is causing your process issues
5. Improve process -> repeat analysis -> make your process better
Are you interested in learning more? Check out our webinar below.
Rock & Roll,