Once the incident resolution is applied and the issue is fixed, the Incident Resolver must carry out steps to recover the services. This could include system as well as data. The recovery testing activity may include the coordination by multiple stake holders such as Users, service providers, support groups and others.

The recovery can be done through several ways depending on the nature of incident:

• In some cases, the Incident Resolver may have to request the User itself to undertake directed activities on their own desktop or remote system
• The Incident Handler or Incident Resolver may need to implement the resolution either centrally or remotely
• Specialist support groups may need to implement specific recovery actions (e.g. Network Support reconfiguring a router)
• A third-party supplier may need to provision for recovery.

If the solution or the work around implemented is successful, then the known error database should be updated. This will serve as reference for similar incidents in future. The User must be informed of the solution provided and checked if the service is restored for the user.

If the implemented solution has failed to recover the system, then the Incident Resolver must update the incident record with chronological details of the unsuccessful attempt. If recovery is taking long or seems very difficult, Incident Manager must trigger the hierarchical escalation. This helps to involve the respective IT managers and to get required focus which will ensure that incident SLA’s are not impacted.