IT incident triage flowchart template

Incident triage works best as a decision flow rather than a swimlane, because the hard part is the routing logic, not the handoffs. We recommend following this process:

1. List every state an incident can be in, from reported through to closed.
2. Write down the questions that move an incident between those states: is this major, can first line resolve it, has the user confirmed the fix.
3. Turn each question into a decision node with both exits drawn, including the ones you would rather not think about.
4. Add the escalation targets for each no branch, so every path terminates somewhere real.
5. Draw the diagram in the tool your audience already uses. A free template removes most of the layout work.

Each one routes the incident down a different path:

• Major incident: sends the incident straight to the major incident team, bypassing tiered escalation.
• Resolved at 1st level: the first escalation gate, deciding whether the service desk can close it.
• Resolved at 2nd level: the second gate, before third-line or vendor engagement.
• User confirms fix: the closure check, which loops back to second level if the fix did not hold.

Add a further decision for security incidents or change-related failures if your process needs it — the branches stay attached as the diagram reflows.

Identification, logging, categorisation, prioritisation, diagnosis, escalation, resolution and recovery, then closure. This template covers the sequence from logging onward, because that is where the routing decisions live and where most incident processes are actually ambiguous.

The stages before logging, detection and reporting usually belong to monitoring or the service portal rather than to triage itself.

Most organisations define it by business impact rather than technical severity: a service is down for many users, revenue is affected, or there is a regulatory or safety implication. The threshold is a decision your service desk sets, not a fixed rule.

It sits on the diagram as the first decision node because calling it late is expensive and calling it early is merely inconvenient. Edit the criteria on the shape to match your own definition.

Incident management restores service as quickly as possible. Problem management finds and removes the underlying cause so it does not recur. The difference matters in practice:

• An incident is closed when the user can work again, even if the cause is unknown.
• A problem is closed when the cause is removed, which may be weeks later.
• Closing incidents without raising problems is how the same outage happens four times.

This template maps the first. A separate process flow diagram works well for the second.

PowerPoint can do it with SmartArt and the Shapes gallery, but the work is manual: you place each diamond yourself, label both exits, and reattach connectors every time something moves. For a flow with four decision nodes and a loop back, this becomes the reason the diagram stops getting updated.

A faster route is the Lucen Flowchart tab, which snaps connectors to shape anchors and reflows the diagram with Auto layout when you add a branch. Either way the result stays a set of native PowerPoint objects on your slide.

Because a reopened incident is not a new one. Looping back to second level keeps the original ticket, its history, and its clock intact, which is what makes reopen rate measurable in the first place.

Closing and re-raising instead hides the failure — the metrics look clean while the user waits twice. Drawing the loop on the diagram is what makes the rule explicit for whoever is on shift.

Every branch in the diagram should terminate at a named owner. A common split:

• Service desk / first line: logging, categorisation, priority, and known-error fixes.
• Second line: technical diagnosis within the supported estate.
• Third line or vendor: anything requiring code, infrastructure change, or supplier involvement.
• Major incident team: coordination, comms, and stakeholder updates, running in parallel to the fix.

If you already run a support model with defined tiers, the branches in this template map onto it directly. IT and license administrators often standardise one version of this diagram across several teams.

The download is a free .pptx made of native PowerPoint shapes, so anyone can open, read, and edit it, and you can share it as you would any deck; recipients need nothing installed.

The smart connectors, Auto Layout, and Lucen AI come from the Lucen Flowchart add-in, which adds a Lucen Flowchart tab to the ribbon and runs on Windows with PowerPoint 2016 or later and with PowerPoint for Microsoft 365. PowerPoint for the web, Mac, and mobile are not supported. Setup and troubleshooting steps are in Lucen Support.