IT Support Escalation: What Belongs in the Handover Ticket

The most expensive minute in support is the one in which 2nd level asks the same question again.

Escalation is not the problem. Some cases belong with 2nd level, with a specialist or with the vendor. The problem is what travels with the case. If the ticket only says “Printer doesn't work”, the next level starts from scratch – with the same questions and the same checks. In our agent's escalations, you can clearly see what makes a usable handover. And what doesn't.

What does a bad handover cost?

Time on both sides and one more level. MetricNet puts the full cost per ticket in North America at around 22 US dollars at 1st level and around 70 US dollars at 2nd level (2020). Anyone who escalates pays more anyway – and every repeated follow-up question comes on top. More on this in What does an IT ticket cost?.

What does a good handover look like?

Real example, only the printer name is left out:

Printer does not print although it is reachable on the network (ping successful). The printer is at “error”, and the queue was already cleared. The print spooler was restarted, but the problem persists. The driver is installed …

The 2nd level knows right away: It's not the network, it's not the queue, it's not the spooler. What remains is the driver, the device, the print server. Nobody has to call the employee again.

Second real example:

Chrome cannot open Wikipedia (ERR_CONNECTION_REFUSED) while other websites and browsers work. Ping, DNS and port 443 to Wikipedia are successful. Proxy and DNS cache reset in Chrome brought no improvement.

Symptom, delimitation, checks, attempts – in three sentences. The next level looks at Chrome extensions, policies or security software, not at the network anymore.

And what does a weak one look like?

Also from real escalations:

• “Printer makes unusual noises but still prints.” – Correct, but it's missing what was already checked: queue, test page.
• “Connection test failed, logs blocked, no stuck print jobs. Cause unclear.” – Honest, and the delimitation is in there. What's missing: which target was tested and what “blocked” means.

Even an agent doesn't write every handover equally well. The difference is whether the checks and their results are in the text.

So what belongs in it?

• Symptom in the employee's words – “Printer no longer prints any pages”
• Delimitation – “other websites and browsers work”
• What was checked, with result – “Ping successful, status error”
• What was tried, with result – “Spooler restarted, no improvement”
• What is ruled out – “Network, queue”
• Open question for the next level – “Driver or device?”
• Urgency – “Device not usable” or “still works”

When should you escalate at all?

When knowledge, permissions or hands are missing – not because the finding is missing.

14 days free

IT support that fixes itself.

SuperSupport fixes IT problems right on the device, before they turn into tickets. Try it free for 14 days.

Start free trial

• Knowledge: line-of-business software, servers, network infrastructure.
• Permissions: passwords, user accounts, firewall – with SuperSupport, a person deliberately does that, see 1st-level AI: What it can do – and what it can't.
• Hands: mechanics, hardware replacement – see Printer makes noises.
• Urgency: A device that no longer starts belongs with a person immediately.

What can be solved via approval at first contact doesn't have to move on in the first place – see Increasing the first-contact resolution rate in IT support.

What does an agent on the device change about escalation?

The handover starts with a finding instead of a description. The agent checked on the device before escalating: reachability, queue, services, logs. That ends up in the handover. With SuperSupport, the whole chat is also the case itself – the next level sees every check and every result, not just the summary. See Poorly documented IT tickets.

And if 2nd level uses a different system, an existing bot can query the finding directly from the agent on the PC – see AI agents in IT support: When the bot can ask the PC.

Try it yourself

Take the last ten escalated tickets and count how many contain the checks and their results. You can try SuperSupport for free and without a credit card – for internal IT teams and MSPs.

Frequently asked questions

What is an escalation in IT support?

The handover of a case to a higher level, usually from 1st to 2nd level or to specialists, because knowledge, permissions or time are missing. A functional escalation goes to specialists, a hierarchical one to the people in charge.

What belongs in a handover ticket?

The symptom in the employee's words, the affected device, what was checked and with what result, what has already been tried and what it achieved, and the open question for the next level.

Why do escalated tickets often start over from scratch?

Because the ticket only says “Printer doesn't work”. The 2nd level then has to ask the same questions and repeat the same checks that were already done – or maybe not, nobody knows.

What does “cause unclear” mean in an escalation?

On its own, little. It only becomes helpful with what was ruled out: network reachable, queue empty, service restarted. Then the next level knows where it no longer has to look.

How does an AI agent help with escalations?

It passes the case on with the finding it collected on the device: checks, results, steps tried. With SuperSupport, the whole chat is also the case itself – the next level sees what happened instead of asking for it.

14 days free

IT support that fixes itself.

SuperSupport fixes IT problems right on the device, before they turn into tickets. Try it free for 14 days.

Start free trial