Balancing incident owner and manager needs in response team roles: How to do it?

using the RACI terminology it is relatively simple: Incident (Process) Owner - is accountable for the whole process. It is a role which defines the process of Incident Management and sets the environment/playground/borders. Incident Manager on the other hand is responsible and he is actively involved and using the process. From the description of the article it is not clear to me if in this example the Incident Owner is not the person who reported the incident - if so, then this person provides all the important information about the incident and in most cases just stays I - informed about the progress of resolution of the incident. However in some cases this person can also be involved actively in the solution of the incident.

It is perhaps useful to separate this into "small/medium" vs "enterprise" organizations for more nuance. In smaller organizations, the incident owner and manager roles can sometimes be merged due to a variety of constraints. I think this can be effective if there are well established clear guidelines are established about the responsibilities and decision-making powers of the merged role. In enterprises, complexity is often higher due to larger scale and more stakeholders so having distinct roles is more important - enhanced communication through tooling is a must though. Use of collaborative incident management tools can be a game-changer as they can help maintain clear lines of communication and in documenting every step of the process.

The incident owner is accountable for the business impact and resolution, representing the affected customer, service, or product. In contrast, the incident manager coordinates and facilitates response activities, acting on behalf of the incident response team or IT department. This separation of roles ensures that business priorities are addressed by the incident owner, while the incident manager focuses on operational execution. This clear delineation streamlines response efforts and enhances overall effectiveness in managing and resolving incidents.

One key area that is impacted if they aren't balanced, in the case where the roles are separate: decision making. The incident owner usually is taking into account the broader impact of the organisation, where the incident manager usually is taking into account the specific impact of the incident and the customers. If the two are aligned, great, if they are misaligned, things can quickly get out of hand. An example: the owner would be ok with a bit more downtime to make sure the customers are protected and customer support calls drop immediately post resolution; the manager thinks they need to prioritise bringing the platform up even if not totally operational/safe because they're losing money while down.

The incident owner requires timely updates on status, impact, root cause, and remediation to make informed business decisions. Conversely, the incident manager needs clear guidance on priority, scope, and objectives to coordinate response efforts efficiently. Misalignment between these needs can lead to confusion, conflict, and delays, compromising the response quality. Ensuring both roles have aligned expectations and open communication channels enhances coordination, reduces frustration, and improves the overall efficiency of incident management.

Documented and agreed-upon process is a must so that you're not (re)inventing things when an incident is occurring. Nowadays, I'd suggest leveraging modern incident management platforms that can automate and guide much of this process, ensuring that roles are clearly communicated and all responsibilities understood according tot the roles everyone is playing. Additionally, tooling can help with real-time notifications and updates about role assignments as your incident evolves.

Establish a documented process detailing the roles and responsibilities of each position, ensuring everyone knows who the incident owner and manager are for different types of incidents. Effective communication is key: confirm these roles with all relevant stakeholders at the start and update as needed throughout the incident. This clarity prevents misunderstandings and ensures both the strategic and operational aspects of incident response are effectively addressed, enhancing overall response efficiency and effectiveness.

Quantitative metrics are all very good to have and you should study them but don't forget to also have a qualitative approach especially when it comes to people. It's useful to have metrics on how many pages they got, how long incidents are taking, how many follow-up actions have been resolved. It's also useful to ask your people how it felt to go through the incident, what they learned, what was scary, how they think it should be made less scary, etc.

Take a deliberate approach to setting people up for these roles. A great way to do this is to: - have them shadow the person performing the role - have them perform the role with someone experienced shadowing them (reverse-shadow) - get feedback from the reverse-shadow and apply it in other incidents - have the person reverse-shadowing approve the new person getting to the role Whether for an incident owner or manager role the above works and scales well.