What is ITIL, and what is the difference between an incident, a problem and a change?

ITIL is a framework of best practices for IT service management, organising operations around defined processes with clear ownership and measurement.

The three terms are distinct and routinely confused:

• Incident — an unplanned interruption or reduction in service quality. The goal is to restore service as quickly as possible, by any means, including a workaround. Fixing the underlying cause is explicitly not the objective. "The email server is down."
• Problem — the underlying cause of one or more incidents. The goal is to find and eliminate the root cause, which is investigative work done on a longer timescale. "Email goes down every Monday because the backup job exhausts memory."
• Change — any addition, modification, or removal that could affect services. The goal is to make changes with minimum risk, through assessment, approval, scheduling, and a rollback plan.

Why the distinction matters practically: incidents are measured on speed of restoration, problems on preventing recurrence. A team that only does incident management fixes the same thing forever — high ticket volume with no improvement. Recognising that pattern is what problem management exists for.

Note: Change types are worth knowing: standard (pre-approved, low risk, such as a routine password reset), normal (assessed and approved by a change advisory board), and emergency (expedited to fix an incident, reviewed afterwards).