Templates and records · ISO 20000 · Clause 8.6.3

ISO 20000-1 problem and known error record

What is done about the cause of incidents rather than the symptom: find it, document how to work around it in the meantime and remove it so it does not come back.

In one sentence

The problem record arises from analysing incidents and captures classification, priority, root cause, workaround and permanent action, and records as a known error anything whose cause has been identified but not yet resolved, because clause 8.6.3 of ISO/IEC 20000-1 requires incident data to be analysed to identify problems, problems to be recorded, their causes identified and the effectiveness of their resolution monitored.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 20000 · Clause 8.6.3 Clauses are cited using the numbering of ISO/IEC 20000-1:2018, the current edition and the same one the Academy uses.
Type of information: Mandatory record Record of problems and known errors (8.6.3)
Who fills it in: Problem manager With the technical groups for each service
When: After a major incident or a trend Also proactively, from periodic analysis of incidents
How long it is kept: Set by the organisation The standard requires control of the retention and disposition of documented information (7.5.3) without setting periods. It is usual to cover at least the three-year certification cycle, or the term of the customer contract if longer.

What the standard requires

What ISO 20000 demands and what it leaves to your judgement

The organisation analyses incident data and trends to identify problems. Problems are recorded, classified, prioritised, escalated if needed and resolved where possible.

The root cause is investigated and actions are determined to reduce or prevent incidents. If the solution requires a change, it goes through change management. Problems with an identified cause but no permanent solution are recorded as known errors, with information to reduce their impact.

The effectiveness of problem resolution is monitored, reviewed and reported. It is the process that links day-to-day operations with continual improvement in clause 10.

Read it in context: Service delivery and support, in the ISO 20000 Academy

Structure

Fields the template should include

Number, date and source: major incident, trend, proactive
Linked incidents
Service and configuration items affected
Priority
Root cause analysis and method
Workaround published for the service desk
Known error: yes or no
Permanent action and associated change request
Monitoring of effectiveness and closure

Example

Example: certificate expiry

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Problem	PRB-26-021 · 16 April 2026 · source: major incident INC-26-0318
Linked incidents	INC-26-0318 and 2 others in 2025 caused by expired certificates on other services
Root cause	Five whys: certificates are renewed on demand and there is no inventory with expiry dates
Workaround	Weekly manual check of critical certificates
Known error	Yes, until the permanent action is implemented
Permanent action	Inventory of certificates as configuration items with a 30-day warning · CHG-26-077
Effectiveness	Review after 6 months: 0 incidents due to certificate expiry · closed

At the audit

Mistakes auditors commonly flag

Problems closed when the workaround is applied.
No analysis of incident trends: problems are only opened after a major outage.
Known errors the service desk cannot look up.
Permanent actions applied without going through change management.
No monitoring of effectiveness after closure.

In Kimobox

How this record is kept in Kimobox

1Recurring incidents are linked to a problem record with its root cause analysis.
2Incidents and problems remain linked, with their root cause documented and traceable.
3The permanent action is assigned with an owner, a date and a delay warning, and its effectiveness is verified later.

Frequently asked questions

What people ask us before getting started

What is a known error?

A problem whose root cause is known, or for which there is a way to reduce or eliminate its impact, but which does not yet have a permanent solution. It is recorded so the service desk can resolve the incidents it causes more quickly.

Are a problem and an incident the same thing?

No. The incident is the symptom: the service fails. The problem is the cause, known or not, of one or more incidents. Incident management restores the service; problem management stops it failing again.

Keep your ISO 20000 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring