Incident management gets the glory — visible fires, grateful users, adrenaline. Problem management is the unglamorous sibling that determines whether your organisation has the same fires forever. It's the detective practice: while firefighters restore service, detectives ask why the building keeps igniting — and quietly, this is where mature IT departments are separated from busy ones.
Two modes: reactive and proactive
Reactive problem management responds to what already happened: a serious incident, or a pattern of small ones ("that's the fourth VPN drop this month — open a problem"). Proactive problem management hunts trouble before it becomes incidents at all: mining incident trends, reviewing logs and vendor advisories, asking "where will next quarter's fires start?" Reactive is standard; proactive is rarer and worth more — it's the difference between a coroner and a doctor.
The craft: root cause analysis
The core skill is refusing to stop at the first plausible explanation. The simplest formal tool is the five whys — keep asking why until you hit something structural. The server crashed. Why? Disk full. Why? Log files grew unbounded. Why? Log rotation was disabled. Why? A change last year turned it off for debugging and never turned it back on. Why? The change had no post-implementation review. Notice where that chain lands: not on a disk, but on a process gap — and fixing the process prevents a whole family of future incidents, not just this one. Root causes are usually deeper and more boring than the technical symptom, which is exactly why undisciplined analysis misses them.
The outputs of good detective work, formalised: a workaround (documented way to reduce impact while the cause remains), a known error record (cause diagnosed, workaround attached, awaiting permanent fix), and eventually a change to eliminate the cause. That known-error database is compound interest for a service desk — the incident that took a specialist three days to diagnose becomes a five-minute lookup for every future occurrence.
The honest economics: problem management is chronically underinvested because its success is invisible — prevented incidents don't page anyone, and staff who could investigate causes are perpetually pulled onto today's fires. It's the IT version of preventive healthcare losing budget battles to emergency surgery. When you meet an organisation that protects dedicated problem-investigation time, you've found a mature one; when interviews ask how you'd reduce ticket volume, this practice is the shape of the answer they're hoping for.
One more distinction worth carrying: not every problem gets fixed. Sometimes the permanent fix costs more than the incidents it prevents, and the rational decision — made consciously and recorded — is to live with the known error and its workaround. Problem management's real product isn't fixes; it's understood risk. Unexplained recurring failures are unacceptable; explained, costed, accepted ones are engineering.