Incident and problem are different objects
An incident is an unplanned interruption or reduction in quality — you restore service as quickly as possible. A problem is the cause, or potential cause, of one or more incidents — you investigate it. The two run in parallel, not in sequence.
Why it is like this
They optimise for opposite things. Restoration rewards speed and workarounds; investigation rewards patience and evidence. Running them as one queue means the investigation is always deprioritised by the next outage.
Not to be confused with
Stages of one ticket. A problem can exist with no open incident, and an incident can be closed by a workaround while its problem stays open — that workaround becomes a known error record.
In practice
Restart the service, close the incident, keep the problem open. Closing the problem because the incident is over is the single most common ITIL misuse in practice.
Source: ITIL 4 Foundation (AXELOS / PeopleCert), 2019 edition — incident management and problem management practices. Read on .
ITIL® is a registered trade mark of the PeopleCert group. ytyk.org is not affiliated with, endorsed by or licensed by PeopleCert. These cards are independent commentary written in our own words; no part of the ITIL publications, and no ITIL diagram, is reproduced here.
Predict Check yourself
An outage is resolved by restarting a service. Nobody knows why it failed. What is the correct state of the records?
Show the answer
Incident closed, problem open, with the restart recorded as a workaround and a known error if the cause is identified.
Keeping the incident open punishes the restoration metric for the investigation's pace; closing the problem loses the only reason to investigate.