SLA & Escalation Pack

sn-sla-001

Implement SLA Pause and Resume Conditions

SLA Definition Priority: Critical Effort: Medium

To significantly reduce the 60.2% SLA breach rate by stopping the SLA clock when the IT team is waiting for information from the user, ensuring that SLA metrics reflect actual work time.

Why this pack: This rule directly configures core SLA Definition behavior (pause/resume) which is a foundational capability of the SLA & Escalation pack.

Trigger

Incident state changes to a waiting state.

Conditions

·Incident Resolution SLA is active.

·Incident state is one of: Pending User, Awaiting User Info.

Actions

·Pause the running Incident Resolution SLA.

·Resume the Incident Resolution SLA when the state changes back to an active work state.

Evidence used

·The 'SLA breached?' field shows 'Yes' for 60.2% of incidents.

·The 'Paused SLA count' and 'SLA pause hours' fields are '0' for 100% of tasks, indicating no pause conditions are configured.

·High volume of transitions into waiting states like 'Work in Progress -> Pending User' (43.00%) and 'Pending User -> Awaiting User Info' (21.10%).

ServiceNow implementation

Target table

·incident

Configuration area

·SLA Definition

Configuration trigger

·Record update where State field changes.

Configuration conditions

·Applies to all Incident Resolution SLA definitions (e.g., 'Priority 1 resolution (1 hour)', 'Priority 2 resolution (8 hour)', etc.).

Implementation steps

·Navigate to 'Service Level Management > SLA > SLA Definitions'.

·For each Incident Resolution SLA, open the record.

·In the 'Pause Conditions' section, add a condition: '[State] [is one of] [Pending User], [Awaiting User Info]'.

·Ensure the 'Resume Conditions' are configured to restart the SLA when work resumes, typically by defining a condition like '[State] [is not one of] [Pending User], [Awaiting User Info]'.

·Save the SLA Definition record.

·Repeat for all relevant resolution SLAs.

Fields used

·state

Test cases

·Create a new incident and verify the resolution SLA attaches and is 'In progress'.

·Change the incident state to 'Pending User'. Verify the attached Task SLA record's stage changes to 'Paused'.

·Change the incident state back to 'Work in Progress'. Verify the Task SLA record's stage returns to 'In progress' and the clock resumes.

Rollback notes

·To revert, navigate to each modified SLA Definition and remove the configured Pause Conditions.

Requirements / prerequisites

·System administrator or sla_admin role to modify SLA Definitions.

·Clarity on which states are considered 'waiting' states. The evidence suggests 'Pending User' and 'Awaiting User Info' should be consolidated to a single state for clarity.

sn-sla-002

Proactive Resolution SLA Breach Warning

Flow Designer Priority: High Effort: Medium

To proactively notify assignees and their managers when an incident's resolution SLA is nearing its breach point, enabling them to prioritize work and prevent SLA failures.

Why this pack: This automation uses SLA elapsed percentage as a trigger for escalations and notifications, a core function of an SLA management pack.

Trigger

Task SLA's elapsed percentage reaches 50% and 75%.

Conditions

·Task SLA [SLA Definition] [name] [contains] 'resolution'

·Task SLA [Stage] [is] [In progress]

Actions

·Send an email notification to the incident's Assignee.

·Send an email notification to the incident's Assignment Group's Manager.

Evidence used

·A high rate of SLA breaches (60.2%) suggests teams are not aware of or are unable to prioritize tickets at risk of breaching.

·Sample tasks like INC0015943, INC0015133, and INC0015497 show breaches across different priorities, indicating a systemic issue.

ServiceNow implementation

Target table

·task_sla

Configuration area

·Flow Designer

Configuration trigger

·Create two 'SLA Percentage Timer' triggers for the flow on the task_sla table, one for 50% and one for 75%.

Configuration conditions

·Trigger condition: [SLA definition.Name] [contains] 'resolution'.

·Trigger condition: [Stage] [is] [In progress].

Implementation steps

·Create a new Flow in Flow Designer.

·Add the SLA Percentage Timer triggers as specified.

·Use a 'Look Up Record' action to get the parent Incident record from the 'Task' field on the Task SLA record.

·Use a 'Look Up Record' action to get the manager of the Assignment Group on the Incident record.

·Use the 'Send Email' action to send a notification to the Assignee ('assigned_to' from the Incident record).

·Use another 'Send Email' action to send a notification to the Assignment Group Manager.

·The email body should include the Incident Number, Short Description, Priority, and a link to the record.

Fields used

·task_sla.percentage

·task_sla.stage

·task_sla.sla

·incident.assigned_to

·incident.assignment_group

·sys_user_group.manager

Test cases

·Create an incident with a resolution SLA of 1 hour. Use 'SLA Repair' or wait for the SLA to reach 50% and 75% elapsed time. Verify that email notifications are sent to the assignee and group manager at each threshold.

Rollback notes

·Deactivate the Flow Designer flow.

Requirements / prerequisites

·Flow Designer plugin (active by default).

·Accurate 'manager' field populated on Assignment Group (sys_user_group) records.

sn-sla-003

Automated Escalation for Breached P1/P2 Incidents

Flow Designer Priority: High Effort: Medium

To ensure immediate visibility and action on breached high-priority incidents by automatically notifying leadership and updating the record to reflect an escalated status.

Why this pack: This rule defines an automated action taken upon SLA breach, which is a key component of an escalation strategy.

Trigger

A P1 or P2 resolution Task SLA's elapsed percentage reaches 100%.

Conditions

·Task SLA [SLA Definition] [is one of] 'Priority 1 resolution (15 minutes)', 'Priority 2 resolution (8 hour)'

·Task SLA [Stage] [is] [In progress]

Actions

·Add a work note to the parent Incident indicating an SLA breach and escalation.

·Send a high-priority notification to an IT Operations leadership email alias.

Evidence used

·The 60.2% breach rate includes critical incidents, as shown in sample tasks like INC0015345 (P2), INC0015133 (P3, but P1/P2 also exist), and INC0014527 (P1).

·The high frequency of rework (e.g., 'Assigned -> Active' at 35.6%) indicates that incidents can get stuck, which is unacceptable for high-priority tickets.

ServiceNow implementation

Target table

·task_sla

Configuration area

·Flow Designer

Configuration trigger

·SLA Percentage Timer trigger on the task_sla table for 100%.

Configuration conditions

·Trigger condition: [SLA definition.Name] [is one of] 'Priority 1 resolution (1 hour)', 'Priority 2 resolution (8 hour)'. Note: The P1 SLA in evidence is 1 hour, not 15 mins.

·Trigger condition: [Stage] [is] [In progress].

Implementation steps

·Create a new Flow in Flow Designer with the specified trigger.

·Use a 'Look Up Record' action to get the parent Incident record from the Task SLA's 'Task' field.

·Use an 'Update Record' action on the Incident to add a Work Note: 'P1/P2 Resolution SLA breached. Escalating to IT Operations leadership.'

·Use the 'Send Email' action to notify a pre-defined distribution list for IT Operations leadership. Include incident details and a direct link.

Fields used

·task_sla.percentage

·task_sla.stage

·task_sla.sla

·incident.priority

·incident.work_notes

Test cases

·Create a P1 Incident with a 1-hour resolution SLA. Wait for the SLA to breach. Verify the incident work notes are updated and an email is sent to the leadership distribution list.

Rollback notes

·Deactivate the Flow Designer flow.

Requirements / prerequisites

·A defined escalation path and contact list/email alias for IT Operations leadership.

sn-sla-004

Performance Analytics SLA Dashboard

Performance Analytics Priority: Medium Effort: High

To provide leadership and team managers with ongoing visibility into SLA performance, identify trends, and pinpoint specific assignment groups or incident categories that are contributing to the high breach rate.

Why this pack: Performance Analytics is a key capability for reporting on SLA compliance and identifying areas for improvement, which is central to SLA management.

Trigger

Daily data collection job for Performance Analytics.

Conditions

·N/A

Actions

·Collect daily scores for incident SLA metrics.

·Display trends on a dedicated dashboard.

Evidence used

·The overall SLA breach rate of 60.2% is a lagging indicator that requires deeper analysis to solve.

·The `assignment_group` field has a wide distribution, making it difficult to manually identify which teams are struggling most.

·The 'SLA breached count' shows some incidents breach both response and resolution SLAs (18% of incidents), which requires trend analysis to understand.

ServiceNow implementation

Target table

·incident

Configuration area

·Performance Analytics

Configuration trigger

·Daily scheduled job: '[PA Incident] Data Collection'.

Configuration conditions

·N/A

Implementation steps

·Verify the Performance Analytics plugin for Incident Management is active.

·Create a new automated indicator for '% of Breached Incidents': Source = incident, Condition = 'SLA breached?' is Yes. Aggregate = Count. Check 'Collect records'.

·Create a new formula indicator for 'SLA Achievement %': Formula = '([[Number of closed incidents]] - [[Number of breached incidents]]) / [[Number of closed incidents]] * 100'.

·Create breakdowns for existing indicators like 'Assignment Group', 'Priority', 'Contact Type'.

·Create a new dashboard named 'Incident SLA Performance'.

·Add widgets to the dashboard: Time series for 'SLA Achievement %', Score widgets for current month's achievement, and bar charts showing breaches by Assignment Group and Priority.

Fields used

·incident.made_sla

·incident.assignment_group

·incident.priority

·incident.contact_type

·incident.closed_at

Test cases

·After the daily data collection job runs, navigate to the new dashboard. Verify that widgets display data and that breakdowns by assignment group function correctly.

Rollback notes

·Delete the created dashboard. Indicators and breakdowns can be deactivated by setting the 'Active' flag to false.

Requirements / prerequisites

·ServiceNow Performance Analytics Premium license.

·PA Data Collection jobs must be active and running successfully.