Why ServiceNow SLA breach counts disagree
3 min readFor service operations leaders
An SLA breach count needs a defined unit, clock and reporting population. Count incidents and attached SLA instances separately, distinguish business time from elapsed time, and agree which assignment group owns the reporting attribution before comparing two reports.
Decide what one row means
An incident and its service commitments are different objects. If a report joins incidents to multiple SLA records, counting the joined rows can turn a single incident into several apparent failures. Start with the service commitment being evaluated: response, resolution, or another named definition.
Ask the report owner whether the denominator includes completed commitments, active commitments, cancelled records or all records created in the period. A completed-period measure and a current-risk queue should have different names. Neither is a substitute for the other.
Work a small example before reviewing a percentage
Synthetic example: four incidents each have a response and a resolution commitment. Two resolution commitments breach. The resolution-instance breach rate is 2 of 4, or 50%. Dividing by all eight attached commitments produces 25%, which answers a different question. Neither number explains how many customers experienced a material disruption.
ServiceNow distinguishes actual elapsed time from business elapsed time. Use the selected SLA's schedule and pause rules; subtracting an incident's open timestamp from its close timestamp does not reconstruct that business clock.
| Decision | Record explicitly |
|---|---|
| Population | Completed resolution SLAs in the agreed period |
| Attribution | Group at breach, completion or another approved checkpoint |
| Clock | Business schedule, time zone and pause handling |
Investigate the handoff, not just the current owner
An incident reassigned after a breach may belong to a different group today. Historical attribution needs the appropriate history; a current assignment field cannot answer who held the work at the breach. Put missing history in an unknown bucket rather than making a team look better or worse through a silent guess.
Sample one breached and one unbreached incident from each material group. Compare the selected SLA record, stage, schedule and timestamps with the source report. Keep cancelled and duplicate commitments visible in the reconciliation notes.
Bring this to a Nexatron walkthrough
Ask: Which completed resolution SLAs breached last month, by the group responsible at completion? Bring the approved report and two user roles. Confirm that your configured connector exposes the required records and history before requesting this breakdown. Judge the answer on population, attribution and access, not the polish of its explanation.
Bring three business questions
Explore your sources, definitions, and review criteria in a tailored Nexatron demonstration. Please keep credentials and sensitive records out of the inquiry.
Request a tailored demoExplore Nexatron with Claude