Incident Response Teams and Roles

An incident response team brings together the roles needed to restore a service, classify and report the incident, communicate with those affected, and keep a record, all at the same time. The core roles are an incident lead who coordinates, a service owner who judges the customer effect, technical specialists who work the fault, a log keeper who records decisions, and communicators who handle customers, the board, and the authority. In a small firm, one person may hold more than one role, but the roles themselves should still be named, because an unnamed role is a job that nobody is doing.

The incident lead coordinates the response without necessarily fixing the fault personally. The lead runs the incident calls, sets priorities, takes or escalates decisions, and makes sure that classification, communication, and logging are progressing alongside the technical work. That coordination role is easily lost if the lead is also the person deepest in the technical problem, because the technical problem will absorb all their attention. Firms therefore often separate the lead role from the technical lead role, even in small teams, so that someone always holds the whole picture. The lead also owns the decision to stand the team down, which should be a deliberate decision based on evidence of recovery rather than a drift back to normal work.

The service owner is essential because only that role can judge the incident in service terms. The service owner knows which customers use the service, what they are trying to do, what a degradation means for them, and whether a proposed workaround is acceptable. Without the service owner, the incident team will judge success by technical indicators, such as a system returning to normal, rather than by service indicators, such as customers being able to complete their transactions. The service owner also owns the customer communication in substance, even if another person drafts it, because the message must reflect the real customer position. An incident team without a service owner is a technical team, not a service recovery team.

The log keeper records times, decisions, and reasons while the incident runs, as described in the guide on logs and evidence. The communicators prepare and send messages to customers, to the board, and, through the reporting owner, to the authority, making sure each audience receives the information it needs in language it can use. These roles are sometimes treated as administrative support, but during a major incident they are central, because the firm will be judged later on its record and its communications as much as on its recovery. A team that restores a service brilliantly but cannot explain what happened, or that leaves customers uninformed, has only partly succeeded.

In a small firm, the same people will inevitably hold several roles, and the structure should reflect that reality rather than pretend otherwise. The important discipline is to name, in advance, who holds each role for each service, and who deputises when the named person is unavailable. A small firm may have one incident lead who is also the communicator, and a service owner who is also the technical lead, but the firm should still be able to say, for any incident, who is coordinating, who is judging service effect, and who is keeping the log. Where one person holds the log keeper role alongside another, the firm should accept that the log will be briefer, and protect its quality by using a simple template that prompts for times and decisions.

A team stays ready through rehearsal and through keeping its role list current. Rehearsals reveal gaps that a written plan hides, such as a role holder who has left the firm, a deputy who has never been called, or a communication channel that nobody can access. They also let team members practise working together under time pressure, which is a different skill from knowing their individual jobs. Readiness also depends on mundane maintenance, such as keeping contact details and on call rotas up to date, and making sure new joiners know which role they hold. A team that rehearses will still face surprises in a real incident, but it will face them with roles that are familiar rather than theoretical.