Workflow Template
IT Incident Management Workflow
Captures reported IT incidents, uses AI to prioritise them, assigns the right engineer, supports diagnosis and escalation to a senior engineer if needed, and on resolution notifies affected users, confirms recovery and closes the incident.
For IT service delivery and support functions operating under service-level and compliance obligations, consistent incident handling is a governance imperative rather than an operational nicety. This workflow provides a structured, auditable process for capturing reported incidents, applying AI-assisted prioritisation with manual review fallback, assigning and escalating engineering resources, and confirming resolution before closure. It is designed for use by service desk teams, IT operations, engineering leads, and IT management, ensuring role-based accountability at every stage from initial report through to user-confirmed recovery.
Business Outcomes
- Reduced mean time to resolution through automated priority classification and routing
- Full audit trail of every status change, escalation, and approval decision
- Consistent SLA adherence across service desk and engineering teams
- Reduced misclassification risk via manual review fallback on low-confidence AI priority scoring
- Improved user satisfaction through automated recovery confirmation and closure notifications
Workflow Steps
Steps
- 1Create Incident Recordcreate record
Registers the reported incident as a new record.
- 2Set Status to Openupdate record
Marks the incident as newly opened.
- 3Classify Incident Priorityai prioritisation
AI assesses urgency and severity based on symptoms and impact.
- 4Route on Priority Confidence
Sends low-confidence classifications to human review before assignment.
_ai_priority_prioritise_incident_needs_human_review: "true"→Manual Priority ReviewDefault→Assign Engineer - 5Manual Priority Reviewrequest approval
A senior engineer reviews and confirms the incident priority when AI confidence is low.
- 6Route on Manual Review Outcome
Proceeds to assignment once priority is confirmed; closes the incident if rejected.
approval_status: "approved"→Assign Engineerapproval_status: "rejected"→Close Incident - Priority RejectedDefault→Assign Engineer - 7Assign Engineerassign user
Assigns the incident to an on-duty engineer for diagnosis.
- 8Set Status to Assignedupdate record
Marks the incident as assigned to an engineer.
- 9Diagnose Incidentcreate task
Engineer investigates the incident and records diagnosis and outcome.
- 10Set Status to Under Diagnosisupdate record
Persists diagnosis notes and marks the incident as under diagnosis.
- 11Route on Resolution Outcome
Branches to senior escalation or straight to closure notification based on engineer's finding.
resolution_outcome: "Needs Senior Escalation"→Set Status to Escalatedresolution_outcome: "Resolved"→Set Status to Resolved & Notify UsersDefault→Set Status to Escalated - 12Set Status to Escalatedupdate record
Marks the incident as escalated before handing to a senior engineer.
- 13Escalate to Senior Engineercreate task
Senior engineer takes over diagnosis and resolves the incident.
- 14Persist Senior Resolution Notesupdate record
Saves the senior engineer's resolution notes to the record.
- 15Set Status to Resolved & Notify Usersupdate record
Marks incident resolved and emails the reporter with the resolution summary.
- 16Notify Affected Userssend email
Sends the reporter a notification that the incident has been resolved.
- 17Request Recovery Confirmationrequest external input
Asks the reporter to confirm that service has been restored to their satisfaction.
- 18Route on Recovery Confirmation
If the user confirms recovery, close the incident; otherwise reopen diagnosis.
recovery_confirmed: "Yes"→Close Incidentrecovery_confirmed: "No"→Reopen Incident for Further DiagnosisDefault→Close Incident - 19Reopen Incident for Further Diagnosisupdate record
Marks the incident as escalated and loops back to diagnosis since recovery was not confirmed.
- 20Restart Diagnosisrestart from step
Restarts the workflow from the diagnosis step for another attempt.
- 21Close Incidentupdate record
Marks the incident as closed after recovery is confirmed.
- 22Close Incident - Priority Rejectedupdate record
Closes the incident when the senior engineer rejects it during manual priority review.
Fields
- Reporter Name*
- Reporter Email*
- Affected Service/System*
- Symptoms Observed*
- Impact Description*
- Who Is Affected*
- +7 more fields
Forms
Report an IT Incident
6 fields
Data Views
Active Incidents
affected_service, incident_status, who_affected, reporter_email
Dashboard Widgets
Recommended integrations
Setup the following integrations to extend workflow capability.
Send email in the workflow
AWS SES
Similar Workflows
Similar Categories
FAQs
How is this workflow audited?
Every step in the workflow — record creation, status changes, priority classification, escalation, and closure — is timestamped and logged within assess.one, creating a complete audit trail. This log can be reviewed by IT management or compliance teams to demonstrate SLA adherence and process integrity. Because the workflow itself defines the control points, auditors can trace exactly how each incident was handled without relying on separate manual records.
Who has access to incident records and status updates?
Access is governed by role-based permissions configured within assess.one, so service desk staff, assigned engineers, senior engineers, and IT managers only see the information and actions relevant to their role. Organisations can restrict sensitive diagnostic notes or escalation decisions to specific roles as required. Permissions are managed centrally, ensuring consistent access governance across all incidents processed through the workflow.
How does this integrate with existing IT tools and notification channels?
Notifications to affected users, engineers, and senior engineers are configured directly inside assess.one using its built-in email and Slack integrations, with no external development work required. This means incident status updates and escalation alerts flow to the right channels without custom integration projects. Additional notification rules or channels can be added by adjusting the workflow configuration directly in the platform.
Can the escalation and priority classification logic be customised?
Yes, the AI-driven priority classification, confidence-based routing, and escalation thresholds are all configurable within assess.one. Teams can adjust when manual priority review is triggered, define escalation criteria to senior engineers, and modify approval logic to reflect their internal support tiers. These changes are made directly in the workflow editor without requiring technical implementation support.
What compliance or approval considerations apply at manual review and escalation steps?
The manual priority review step ensures that low-confidence AI classifications are checked by a qualified reviewer before routing continues, reducing the risk of mis-prioritised incidents. Escalation to a senior engineer introduces a formal decision point where diagnosis outcomes are reviewed and resolution notes are persisted for accountability. Both steps can be configured to require named approvers, supporting internal governance policies around incident severity handling.
How long does it take to implement this workflow?
This is a ready-to-use template that can be customised and published in minutes, not a multi-week implementation project. Once published, the service desk and engineering teams can begin logging and managing live incidents immediately. Further adjustments to steps, roles, or notifications can be made at any time directly within assess.one.
What happens if recovery is not confirmed by the affected user?
If recovery confirmation fails, the workflow automatically reopens the incident and routes it back into diagnosis via the Reopen Incident and Restart Diagnosis steps. This prevents incidents from being closed prematurely and ensures engineers revisit unresolved issues. The full history of the reopening and re-diagnosis is retained in the audit log for reporting and root-cause analysis.
Who needs access to this workflow within the organisation?
Typical users include service desk agents who create incident records, engineers who perform diagnosis, senior engineers who handle escalations, and IT managers who monitor status and SLA performance. Access can be scoped so each role only interacts with the steps relevant to them. IT leadership can also be granted read-only visibility for oversight and reporting purposes.
Can this workflow scale across multiple teams or business units?
Yes, the workflow is built to scale within assess.one and can be replicated or configured with different routing rules, engineer pools, and escalation paths for different teams or business units. Role assignments and notification settings can be tailored per team without duplicating infrastructure. This supports consistent incident governance across a growing or distributed IT organisation.
Ready to use this workflow?
Create a free account and customise this workflow for your business.
