Newcomers to ITSM often mix up three ticket types. An incident is an unplanned interruption: something is broken and users are affected. A problem is the underlying cause behind one or more incidents. A change is a planned alteration, such as a patch or upgrade, that carries risk and needs approval. Knowing which one you face changes what you do next.
How they link in practice
- Five users report the same email outage: five incidents that may point to one problem.
- The problem record investigates the cause, for example a failed mail relay, and tracks it until resolved.
- Fixing the cause usually needs a change request, with a plan, a backout option, and an approval.
- Closing the change does not close the incidents. Each still needs its own confirmation with the user.
In interviews, explain this chain with one example from start to finish. It shows you understand ITSM as a system, not as three separate ticket queues.