Incident Management vs Problem Management

This is the single most tested confusable pair on the ITIL Foundation exam, and the distinction is genuinely simple once you separate what each practice is actually responsible for.

Incident Management restores normal service operation as quickly as possible after an unplanned interruption or reduction in quality. Its entire focus is speed — get the user working again. It does not need to know why the failure happened, only how to fix the symptom right now.

Problem Management identifies the underlying cause of one or more incidents, and works to prevent that cause from producing further incidents. It is not time-pressured the way incident management is — a problem investigation can run for days or weeks while the service itself is already restored.

A useful mental model: if a server crashes and a technician restarts it to bring the service back online, that is Incident Management. If someone then investigates why the server keeps crashing and finds a memory leak in a specific application, that is Problem Management.

The exam frequently tests this by describing a scenario and asking which practice is responsible for a specific action within it — restoring service, logging a workaround, investigating root cause, or raising a known error record. Root cause investigation and known error records belong to Problem Management; anything about restoring service quickly belongs to Incident Management.

One more distinction worth knowing: a workaround (a temporary way to reduce or eliminate the impact of an incident without fully resolving the underlying problem) can be documented by either practice, but it is Problem Management that formally records it as part of a Known Error — an identified problem with a documented workaround, tracked until permanently fixed.