What are the risks of automating incident management?

Organizations aim to automate their L1 and the majority of the L2 support tickets for the sole purpose of keeping the SLA healthy and optimize the MTTR. They try to do it via the Shift Left practices where its main purpose is to try and classify tickets based on the ticket type and whether it can be resolved quickly by adopting the generic resolution techniques. Organizations use ITIL and other practices to systematically manage the volumes and hands down the most favoured tool for that is Service Now. Human oversight is a classification issue as to why your system was not able to identify that this was not a standard/routine issue, this belonged to a higher priority and hence required Human Oversight.

A key component of loss of human oversight is the ineffectiveness in decision-making through an automated system. An automated system may not always be able to make effective decisions when a complex situation arises. In such cases, human intervention is necessary to assess the situation and make appropriate decisions with regards to risk mitigation. This is particularly important in incident management for quick resolution and avoidance of escalation of reported incident. A sudden change in policies will require tweaking an automated system which if not quickly attended to would have costed a ripple effect that could be of a greater damaging effect to customer experience and largely with financial implications.

Take this scenario, 1 support personnel can close 10 tickets a day and has to do it within the specified SLA period. If there a surge of requests how would A.I handle it? It could stop users from logging requests because there aren't enough people to process. So the requests could stay unattended and work suffers. Human oversight could be useful in moving resources or leveling resources such that those requests are resolved while arrangements to notify HR for more resources can commence. The scenario painted highlight why Human supervision is critical to the overall success of incident management. Automation must work with human supervision to foster optimal results.

Automation without integration off all systems and platforms make no sense. The holistic approach is a prerequisite for such an endeavor. Configuration management and knowledge management should be in the center of the integration using frameworks and best practices (a blend of them) such as Axelos ITIL, ISO 20000, ISACA COBIT, etc. An established good process management could assist on the rest, such as change management. People will be connected maintaining the knowledge base and the configuration management, and improving the processes, they can leave the rest for the automation.

With the modern categorization techniques complemented with a little bit of ITIL understanding is sufficient to create a healthy support hierarchy for any org. Incident Manager can be appointed to set things in place and the management can come together to decide the priority based allocation mapping and reinforcing the last level of support(L1) as the technical SME level. Once the SOD is created and everybody is well aware of their duties, Service Now can take care of the rest. Period!

In my experience, one of the main issues that might arise when the IT incident management is automated, is that when the automation isn't adequate to solve the incident, the customer or stakeholder could get lost in the process to escalate the incident. Contact options are most of the times limited (otherwise people intend to go to the 'human' support instead of the automated support tool). When contact options are available, a lot of times incident automation is used to save FTE's and anything that falls outside the automated process might end up within teams that are not having incident support as their main task, even adding more loss of trust and transparency. To avoid this, detection of incident resolution is very important.

Automation inficates that we would be dealing with predefined processes and workflows that can limit the ability to adapt to new challenges or opportunities for improvement within incident management. In addition, attending to unaticipated incidents not included in the predefined process wiuld require human intervention. Without innovation and improvement, automated systems may not be able to handle new and unique incidents that require creative solutions. Without innovation and improvement, automated systems may not be able to track evolving technologies which would lead to inefficiencies and outdated processes