Skip to content

ITIL Incident Management Roles and Responsibilities

Incident Management roles are divided into 3 categories:

  • Users;
  • IT Support Staff;
  • Managers.


The user role refers to the customers of IT services who request assistance for an affected service. The user role applies to customers of the Requester Console or who contact the IT Service Desk to get assistance from IT support staff to resolve incidents.

The user's responsibilities include:

  • requesting support when necessary and providing the required information to help resolve the requests;
  • checking the solutions that IT service provider has implemented for his/her Incidents and re-opening them if solutions are not acceptable.

IT Support Staff

There are 2 support staff roles defined for the Incident Management process: service desk analyst and specialist – Subject Matter Expert (SME).

Service desk analysts are usually first-line support staff (the initial point of contact for users).

Their responsibilities include:

  • providing the interface for interaction between the service owner organization and its customers;
  • creating, classifying and updating Incident records, while obtaining accurate and complete information from the user;
  • ensuring that Incidents are assigned to the most appropriate group for resolution;
  • resolving incidents when possible;
  • coordinating and validating resolution with customers;
  • closing Incidents and determining customer satisfaction.

Service Desk Specialist – Subject Matter Expert (SME) are second-line support staff. They are considered subject matter experts.

Their responsibilities include:

  • updating the incident records with true and relevant information, that reflects investigation and resolution steps taken and status changes;
  • resolving incidents;
  • contributing resolution information to Knowledge repository;
  • maintaining incident data quality;
  • participating in the Incident escalation handling as subject matter expert when necessary;
  • elevating Incident to subsequent levels of support (Support Specialist), within applicable time-constraint, or expertise level.


Managers are responsible for the quality and integrity of Incident Management processes and for the work of their support group members.

Incident Assignment vs: Ownership

Incident Owner

  • the Incident Owner has end-to-end accountability for an incident;
  • normally, the IT Service Desk will be the SPOC (Single Point of Contact) and owner of incidents that are reported by the users or for incidents assigned to them;
  • if IT Specialist from a Support Group creates an incident and assigns to another support group, then they will be the owner of the incident.

The Incident Assignee

  • is responsible to resolve incidents within the assigned Service Level Target;
  • will respond to assigned incidents by accepting assignment and moving incident status to “In Progress” or immediately re-assign the incident back to Service Desk;
  • provide Timely Updates to the incident in the Work Detail Log.