Incident management BPMN example
Incident management is the process that turns a "something is broken" report into a restored service. Teams map it because it is the most visible IT process in the organisation: when it fails, everyone notices. The common failure points are fuzzy triage criteria, escalations that depend on who happens to be on shift, and fixes that are declared done before anyone has checked the service actually works again.
This example models the flow as one pool with three lanes: Service desk, Incident manager, and Engineering. Three exclusive gateways carry the logic: a major incident split at triage, a first line resolution check, and a service restoration check that loops back to diagnosis when the fix does not hold. That rework loop is the modelling choice worth noticing, because it makes "fix, test, fix again" explicit instead of hiding it inside one long task.
Standard BPMN 2.0 interchange XML: opens in Camunda Modeler, Signavio, Bizagi, and any other compliant tool.
The process at a glance
How to read this diagram
The process starts when an incident is reported to the Service desk, which logs and categorises it. The first gateway asks "Major incident?": on the Yes branch the Incident manager declares a major incident and notifies stakeholders before Engineering begins diagnosis; on the No branch (the default) the desk attempts a first line fix. A second gateway, "Fixed at first line?", closes simple tickets immediately, while its default No branch escalates to Engineering.
Engineering diagnoses the root cause and applies a fix, then the gateway "Service restored?" checks the outcome. The default No branch loops back to diagnosis, so the token cannot escape until the service genuinely works. Once restored, the Incident manager holds a post-incident review, the Service desk closes the ticket, and the flow ends at "Incident closed". One end state for resolution keeps reporting simple; the rejected path you might expect in other processes has no place here, because every incident must end resolved.
BPMN elements used
| Element | Count | In this diagram |
|---|---|---|
| Start event | 1 | Incident reported |
| End event | 1 | Incident closed |
| Task | 4 | Log and categorise incident, Attempt first line fix, Apply and test fix, Close incident ticket |
| User task | 3 | Declare major incident, Diagnose root cause, Hold post-incident review |
| Send task | 1 | Notify stakeholders |
| Exclusive gateway | 3 | Major incident?, Fixed at first line?, Service restored? |
View the BPMN 2.0 XML for this diagram
<?xml version="1.0" encoding="UTF-8"?>
<bpmn2:definitions xmlns:bpmn2="http://www.omg.org/spec/BPMN/20100524/MODEL" xmlns:bpmndi="http://www.omg.org/spec/BPMN/20100524/DI" xmlns:dc="http://www.omg.org/spec/DD/20100524/DC" xmlns:di="http://www.omg.org/spec/DD/20100524/DI" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="Definitions_1" targetNamespace="http://bpmn.io/schema/bpmn" exporter="swimdraft" exporterVersion="1.0">
<bpmn2:collaboration id="Collaboration_1">
<bpmn2:participant id="pool_im" name="Incident management" processRef="Process_pool_im" />
</bpmn2:collaboration>
<bpmn2:process id="Process_pool_im" isExecutable="false">
<bpmn2:laneSet id="LaneSet_pool_im">
<bpmn2:lane id="lane_im_desk" name="Service desk">
<bpmn2:flowNodeRef>start_im</bpmn2:flowNodeRef>
<bpmn2:flowNodeRef>t_im_log</bpmn2:flowNodeRef>
<bpmn2:flowNodeRef>g_im_major</bpmn2:flowNodeRef>
<bpmn2:flowNodeRef>t_im_first</bpmn2:flowNodeRef>
<bpmn2:flowNodeRef>g_im_first</bpmn2:flowNodeRef>
<bpmn2:flowNodeRef>t_im_close</bpmn2:flowNodeRef>
<bpmn2:flowNodeRef>end_im</bpmn2:flowNodeRef>
</bpmn2:lane>
<bpmn2:lane id="lane_im_mgr" name="Incident manager">
<bpmn2:flowNodeRef>t_im_declare</bpmn2:flowNodeRef>
<bpmn2:flowNodeRef>t_im_comms</bpmn2:flowNodeRef>
<bpmn2:flowNodeRef>t_im_review</bpmn2:flowNodeRef>
</bpmn2:lane>
<bpmn2:lane id="lane_im_eng" name="Engineering">
<bpmn2:flowNodeRef>t_im_diag</bpmn2:flowNodeRef>
<bpmn2:flowNodeRef>t_im_fix</bpmn2:flowNodeRef>
<bpmn2:flowNodeRef>g_im_restored</bpmn2:flowNodeRef>
</bpmn2:lane>
</bpmn2:laneSet>
<bpmn2:startEvent id="start_im" name="Incident reported">
<bpmn2:outgoing>fim1</bpmn2:outgoing>
</bpmn2:startEvent>
<bpmn2:task id="t_im_log" name="Log and categorise incident">
<bpmn2:incoming>fim1</bpmn2:incoming>
<bpmn2:outgoing>fim2</bpmn2:outgoing>
</bpmn2:task>
<bpmn2:exclusiveGateway id="g_im_major" name="Major incident?" default="fim4">
<bpmn2:incoming>fim2</bpmn2:incoming>
<bpmn2:outgoing>fim3</bpmn2:outgoing>
<bpmn2:outgoing>fim4</bpmn2:outgoing>
</bpmn2:exclusiveGateway>
<bpmn2:userTask id="t_im_declare" name="Declare major incident">
<bpmn2:incoming>fim3</bpmn2:incoming>
<bpmn2:outgoing>fim5</bpmn2:outgoing>
</bpmn2:userTask>
<bpmn2:sendTask id="t_im_comms" name="Notify stakeholders">
<bpmn2:incoming>fim5</bpmn2:incoming>
<bpmn2:outgoing>fim6</bpmn2:outgoing>
</bpmn2:sendTask>
<bpmn2:task id="t_im_first" name="Attempt first line fix">
<bpmn2:incoming>fim4</bpmn2:incoming>
<bpmn2:outgoing>fim7</bpmn2:outgoing>
</bpmn2:task>
<bpmn2:exclusiveGateway id="g_im_first" name="Fixed at first line?" default="fim9">
<bpmn2:incoming>fim7</bpmn2:incoming>
<bpmn2:outgoing>fim8</bpmn2:outgoing>
<bpmn2:outgoing>fim9</bpmn2:outgoing>
</bpmn2:exclusiveGateway>
<bpmn2:userTask id="t_im_diag" name="Diagnose root cause">
<bpmn2:incoming>fim6</bpmn2:incoming>
<bpmn2:incoming>fim9</bpmn2:incoming>
<bpmn2:incoming>fim12</bpmn2:incoming>
<bpmn2:outgoing>fim10</bpmn2:outgoing>
</bpmn2:userTask>
<bpmn2:task id="t_im_fix" name="Apply and test fix">
<bpmn2:incoming>fim10</bpmn2:incoming>
<bpmn2:outgoing>fim11</bpmn2:outgoing>
</bpmn2:task>
<bpmn2:exclusiveGateway id="g_im_restored" name="Service restored?" default="fim12">
<bpmn2:incoming>fim11</bpmn2:incoming>
<bpmn2:outgoing>fim12</bpmn2:outgoing>
<bpmn2:outgoing>fim13</bpmn2:outgoing>
</bpmn2:exclusiveGateway>
<bpmn2:userTask id="t_im_review" name="Hold post-incident review">
<bpmn2:incoming>fim13</bpmn2:incoming>
<bpmn2:outgoing>fim14</bpmn2:outgoing>
</bpmn2:userTask>
<bpmn2:task id="t_im_close" name="Close incident ticket">
<bpmn2:incoming>fim8</bpmn2:incoming>
<bpmn2:incoming>fim14</bpmn2:incoming>
<bpmn2:outgoing>fim15</bpmn2:outgoing>
</bpmn2:task>
<bpmn2:endEvent id="end_im" name="Incident closed">
<bpmn2:incoming>fim15</bpmn2:incoming>
</bpmn2:endEvent>
<bpmn2:sequenceFlow id="fim1" sourceRef="start_im" targetRef="t_im_log" />
<bpmn2:sequenceFlow id="fim2" sourceRef="t_im_log" targetRef="g_im_major" />
<bpmn2:sequenceFlow id="fim3" name="Yes" sourceRef="g_im_major" targetRef="t_im_declare">
<bpmn2:conditionExpression xsi:type="bpmn2:tFormalExpression">Yes</bpmn2:conditionExpression>
</bpmn2:sequenceFlow>
<bpmn2:sequenceFlow id="fim4" name="No" sourceRef="g_im_major" targetRef="t_im_first" />
<bpmn2:sequenceFlow id="fim5" sourceRef="t_im_declare" targetRef="t_im_comms" />
<bpmn2:sequenceFlow id="fim6" sourceRef="t_im_comms" targetRef="t_im_diag" />
<bpmn2:sequenceFlow id="fim7" sourceRef="t_im_first" targetRef="g_im_first" />
<bpmn2:sequenceFlow id="fim8" name="Yes" sourceRef="g_im_first" targetRef="t_im_close">
<bpmn2:conditionExpression xsi:type="bpmn2:tFormalExpression">Yes</bpmn2:conditionExpression>
</bpmn2:sequenceFlow>
<bpmn2:sequenceFlow id="fim9" name="No" sourceRef="g_im_first" targetRef="t_im_diag" />
<bpmn2:sequenceFlow id="fim10" sourceRef="t_im_diag" targetRef="t_im_fix" />
<bpmn2:sequenceFlow id="fim11" sourceRef="t_im_fix" targetRef="g_im_restored" />
<bpmn2:sequenceFlow id="fim12" name="No" sourceRef="g_im_restored" targetRef="t_im_diag" />
<bpmn2:sequenceFlow id="fim13" name="Yes" sourceRef="g_im_restored" targetRef="t_im_review">
<bpmn2:conditionExpression xsi:type="bpmn2:tFormalExpression">Yes</bpmn2:conditionExpression>
</bpmn2:sequenceFlow>
<bpmn2:sequenceFlow id="fim14" sourceRef="t_im_review" targetRef="t_im_close" />
<bpmn2:sequenceFlow id="fim15" sourceRef="t_im_close" targetRef="end_im" />
</bpmn2:process>
<bpmndi:BPMNDiagram id="BPMNDiagram_1">
<bpmndi:BPMNPlane id="BPMNPlane_1" bpmnElement="Collaboration_1">
<bpmndi:BPMNShape id="pool_im_di" bpmnElement="pool_im" isHorizontal="true">
<dc:Bounds x="20" y="20" width="1720" height="390" />
</bpmndi:BPMNShape>
<bpmndi:BPMNShape id="lane_im_desk_di" bpmnElement="lane_im_desk" isHorizontal="true">
<dc:Bounds x="50" y="20" width="1690" height="130" />
</bpmndi:BPMNShape>
<bpmndi:BPMNShape id="lane_im_mgr_di" bpmnElement="lane_im_mgr" isHorizontal="true">
<dc:Bounds x="50" y="150" width="1690" height="130" />
</bpmndi:BPMNShape>
<bpmndi:BPMNShape id="lane_im_eng_di" bpmnElement="lane_im_eng" isHorizontal="true">
<dc:Bounds x="50" y="280" width="1690" height="130" />
</bpmndi:BPMNShape>
<bpmndi:BPMNShape id="start_im_di" bpmnElement="start_im">
<dc:Bounds x="112" y="59" width="36" height="36" />
<bpmndi:BPMNLabel><dc:Bounds x="88" y="101" width="85" height="14" /></bpmndi:BPMNLabel>
</bpmndi:BPMNShape>
<bpmndi:BPMNShape id="t_im_log_di" bpmnElement="t_im_log">
<dc:Bounds x="230" y="37" width="100" height="80" />
</bpmndi:BPMNShape>
<bpmndi:BPMNShape id="g_im_major_di" bpmnElement="g_im_major">
<dc:Bounds x="405" y="52" width="50" height="50" />
<bpmndi:BPMNLabel><dc:Bounds x="392" y="32" width="77" height="14" /></bpmndi:BPMNLabel>
</bpmndi:BPMNShape>
<bpmndi:BPMNShape id="t_im_declare_di" bpmnElement="t_im_declare">
<dc:Bounds x="530" y="167" width="100" height="80" />
</bpmndi:BPMNShape>
<bpmndi:BPMNShape id="t_im_comms_di" bpmnElement="t_im_comms">
<dc:Bounds x="680" y="167" width="100" height="80" />
</bpmndi:BPMNShape>
<bpmndi:BPMNShape id="t_im_first_di" bpmnElement="t_im_first">
<dc:Bounds x="530" y="37" width="100" height="80" />
</bpmndi:BPMNShape>
<bpmndi:BPMNShape id="g_im_first_di" bpmnElement="g_im_first">
<dc:Bounds x="705" y="52" width="50" height="50" />
<bpmndi:BPMNLabel><dc:Bounds x="686" y="32" width="89" height="14" /></bpmndi:BPMNLabel>
</bpmndi:BPMNShape>
<bpmndi:BPMNShape id="t_im_diag_di" bpmnElement="t_im_diag">
<dc:Bounds x="830" y="297" width="100" height="80" />
</bpmndi:BPMNShape>
<bpmndi:BPMNShape id="t_im_fix_di" bpmnElement="t_im_fix">
<dc:Bounds x="980" y="297" width="100" height="80" />
</bpmndi:BPMNShape>
<bpmndi:BPMNShape id="g_im_restored_di" bpmnElement="g_im_restored">
<dc:Bounds x="1155" y="312" width="50" height="50" />
<bpmndi:BPMNLabel><dc:Bounds x="1136" y="292" width="89" height="14" /></bpmndi:BPMNLabel>
</bpmndi:BPMNShape>
<bpmndi:BPMNShape id="t_im_review_di" bpmnElement="t_im_review">
<dc:Bounds x="1280" y="167" width="100" height="80" />
</bpmndi:BPMNShape>
<bpmndi:BPMNShape id="t_im_close_di" bpmnElement="t_im_close">
<dc:Bounds x="1430" y="37" width="100" height="80" />
</bpmndi:BPMNShape>
<bpmndi:BPMNShape id="end_im_di" bpmnElement="end_im">
<dc:Bounds x="1612" y="59" width="36" height="36" />
<bpmndi:BPMNLabel><dc:Bounds x="1592" y="101" width="76" height="14" /></bpmndi:BPMNLabel>
</bpmndi:BPMNShape>
<bpmndi:BPMNEdge id="fim1_di" bpmnElement="fim1">
<di:waypoint x="148" y="77" />
<di:waypoint x="230" y="77" />
</bpmndi:BPMNEdge>
<bpmndi:BPMNEdge id="fim2_di" bpmnElement="fim2">
<di:waypoint x="330" y="77" />
<di:waypoint x="405" y="77" />
</bpmndi:BPMNEdge>
<bpmndi:BPMNEdge id="fim3_di" bpmnElement="fim3">
<di:waypoint x="455" y="77" />
<di:waypoint x="510" y="77" />
<di:waypoint x="510" y="207" />
<di:waypoint x="530" y="207" />
<bpmndi:BPMNLabel><dc:Bounds x="461" y="57" width="21" height="14" /></bpmndi:BPMNLabel>
</bpmndi:BPMNEdge>
<bpmndi:BPMNEdge id="fim4_di" bpmnElement="fim4">
<di:waypoint x="455" y="77" />
<di:waypoint x="530" y="77" />
<bpmndi:BPMNLabel><dc:Bounds x="461" y="83" width="17" height="14" /></bpmndi:BPMNLabel>
</bpmndi:BPMNEdge>
<bpmndi:BPMNEdge id="fim5_di" bpmnElement="fim5">
<di:waypoint x="630" y="207" />
<di:waypoint x="680" y="207" />
</bpmndi:BPMNEdge>
<bpmndi:BPMNEdge id="fim6_di" bpmnElement="fim6">
<di:waypoint x="780" y="207" />
<di:waypoint x="810" y="207" />
<di:waypoint x="810" y="337" />
<di:waypoint x="830" y="337" />
</bpmndi:BPMNEdge>
<bpmndi:BPMNEdge id="fim7_di" bpmnElement="fim7">
<di:waypoint x="630" y="77" />
<di:waypoint x="705" y="77" />
</bpmndi:BPMNEdge>
<bpmndi:BPMNEdge id="fim8_di" bpmnElement="fim8">
<di:waypoint x="755" y="77" />
<di:waypoint x="1430" y="77" />
<bpmndi:BPMNLabel><dc:Bounds x="761" y="57" width="21" height="14" /></bpmndi:BPMNLabel>
</bpmndi:BPMNEdge>
<bpmndi:BPMNEdge id="fim9_di" bpmnElement="fim9">
<di:waypoint x="755" y="77" />
<di:waypoint x="810" y="77" />
<di:waypoint x="810" y="337" />
<di:waypoint x="830" y="337" />
<bpmndi:BPMNLabel><dc:Bounds x="761" y="83" width="17" height="14" /></bpmndi:BPMNLabel>
</bpmndi:BPMNEdge>
<bpmndi:BPMNEdge id="fim10_di" bpmnElement="fim10">
<di:waypoint x="930" y="337" />
<di:waypoint x="980" y="337" />
</bpmndi:BPMNEdge>
<bpmndi:BPMNEdge id="fim11_di" bpmnElement="fim11">
<di:waypoint x="1080" y="337" />
<di:waypoint x="1155" y="337" />
</bpmndi:BPMNEdge>
<bpmndi:BPMNEdge id="fim12_di" bpmnElement="fim12">
<di:waypoint x="1205" y="337" />
<di:waypoint x="1260" y="337" />
<di:waypoint x="1260" y="392" />
<di:waypoint x="810" y="392" />
<di:waypoint x="810" y="337" />
<di:waypoint x="830" y="337" />
<bpmndi:BPMNLabel><dc:Bounds x="1211" y="317" width="17" height="14" /></bpmndi:BPMNLabel>
</bpmndi:BPMNEdge>
<bpmndi:BPMNEdge id="fim13_di" bpmnElement="fim13">
<di:waypoint x="1205" y="337" />
<di:waypoint x="1260" y="337" />
<di:waypoint x="1260" y="207" />
<di:waypoint x="1280" y="207" />
<bpmndi:BPMNLabel><dc:Bounds x="1211" y="343" width="21" height="14" /></bpmndi:BPMNLabel>
</bpmndi:BPMNEdge>
<bpmndi:BPMNEdge id="fim14_di" bpmnElement="fim14">
<di:waypoint x="1380" y="207" />
<di:waypoint x="1410" y="207" />
<di:waypoint x="1410" y="77" />
<di:waypoint x="1430" y="77" />
</bpmndi:BPMNEdge>
<bpmndi:BPMNEdge id="fim15_di" bpmnElement="fim15">
<di:waypoint x="1530" y="77" />
<di:waypoint x="1612" y="77" />
</bpmndi:BPMNEdge>
</bpmndi:BPMNPlane>
</bpmndi:BPMNDiagram>
</bpmn2:definitions>Frequently asked questions
Why do the incident manager and engineering share a pool with the service desk?
All three roles work the same incident record inside one organisation, so they are lanes in a single pool. A second pool would imply a separate participant with its own process and message-based communication. Reserve that for genuine outsiders, such as a customer reporting the incident or a third party supplier.
Why loop back to diagnosis instead of adding a second fix task?
A loop back to "Diagnose root cause" states that a failed fix means the diagnosis was wrong, not just the remedy. Duplicating tasks for each retry bloats the diagram and caps the number of attempts. A sequence flow returning to an earlier activity is valid BPMN and models unbounded rework honestly.
Can I open this diagram in my own modelling tool?
Yes. The download is standard BPMN 2.0 interchange XML, validated against 19 normative rules from the OMG 2.0.2 specification, so it opens cleanly in Camunda Modeler, Signavio, or Bizagi. You can also edit it in the Swimdraft browser editor first and export .bpmn, SVG, or PNG.
Related BPMN examples
Change management
An IT change management process as a BPMN 2.0 swimlane diagram: risk assessment, CAB approval, implementation, and rollback. Free .bpmn download included.
User access request
A user access request process as a BPMN 2.0 diagram: manager approval, parallel provisioning, and an access register update. Download the .bpmn file free.
Password reset
A password reset process as a BPMN 2.0 diagram: MFA self-service, manual verification fallback, and a message wait state. Free .bpmn file download included.
Software release
A software release process as a BPMN 2.0 diagram: build, regression testing, approval, parallel deployment, and rollback. Download the free .bpmn file.
Generate your own version of this diagram
Describe how the process works in your organisation: plain English, meeting notes, a transcript, or a spreadsheet. Swimdraft turns it into a spec-validated BPMN 2.0 diagram you can edit in the browser and export as .bpmn, SVG, or PNG.
Start freeNo credit card required