Pick your starting point
Two prompts in this library, two jobs. If you already know which practice area has the issue, run the deep dive. If you don't yet, run the scan first to find out where to focus.
The same issues keep coming back — and your tool can't tell you why
Your service desk closes incidents one at a time. The same underlying issue comes in over and over — but each ticket gets logged differently, by different agents, in different words, under different categories. So nobody ever sees that it's one problem.
ITIL 4 names this gap directly: an incident with no identified cause becomes a Problem, and Problem Management's job is to prevent recurrence.1 But Problem Management can only trigger if someone connects the incidents first. Most service desks never get there — not because the pattern isn't there, but because the intake category split it into noise.
It's not that your team is missing the pattern. The pattern is split across five different category labels in your ITSM tool. Filtering by category doesn't reveal it — it hides it.
The Service Evolution Prompt Library
This is a practitioner-grade library of AI prompts you can hand to your IT team and use this week. Each one is engineered to make a public LLM — Claude, ChatGPT, Gemini, Copilot — do the work your tool isn't doing: read what your tickets describe, not how they were categorized, and surface the patterns hiding in plain sight.
Each meetup session introduces one new prompt, tied to a specific ITIL 4 practice or pattern. Every prompt is date-stamped, stays permanently in the library, and ships with sample data so you can run it before touching your own tickets. Bookmark this page. The URL never changes; only the library grows.
The Hidden Problem — Service Evolution Prompt
June 2026 session · Go deep on one Problem hidden across a batch of closed incidents
The prompt · click to copy
The copy button below gives you the full prompt with 40 sample tickets already attached, so you can paste it into any AI and watch it work before you touch your own data. It takes a batch of closed incidents — roughly 40 is a practical working size for a single AI conversation, though anything from 20 to 80 tickets produces valid output.2
The Hidden Problem — Service Evolution Prompt
Loading the prompt…
That's normal — especially in ChatGPT and Copilot. The code is your report; it just wasn't displayed as a page. Reply "Put that in a canvas" (ChatGPT) or "show this as an HTML file" — or copy the code, paste it into Notepad/TextEdit, save it as report.html, and double-click it to open in your browser. Claude renders it automatically, no extra step.
Sample output · what the report looks like
From 40 tickets logged under six unrelated categories, the AI surfaces one underlying Problem, names the single ticket that came closest to a major incident, and lays out who owns each next step. The output renders as a single, self-contained web page (HTML) — Claude opens it in the Artifacts panel; ChatGPT and Gemini render it in a canvas.
It is governed by strict guardrails: no invented vendor names, no invented KB numbers, no fabricated staff-hours, and explicit "TBD — measure first" markers anywhere the AI cannot honestly fill a value from your data.
Open the sample rendered report (PDF) ↗ — yours should look the same when you run the prompt on the included sample data.
How to run it · 3 steps, ~2 minutes
You don't need a special account, and you don't need to understand the prompt. The copy button above already includes 40 sample tickets, so you can see the whole thing work in about two minutes.
- Open a free AI assistant. Go to claude.ai, chatgpt.com, or gemini.google.com and sign in. The free tier is enough.
- Copy, paste, send. Click Copy prompt, paste into the AI's message box (Ctrl+V / ⌘V), press Enter. That single paste includes the instructions and the 40 sample tickets.
- Open the report. After a minute the AI returns a formatted report. In Claude it opens in the Artifacts panel; in ChatGPT or Gemini it appears inline (if you see raw code, reply "show this as an HTML file" or "put this in a canvas"). Save with your browser's Print → Save as PDF.
Running it on your own tickets
Once you've seen it work on the sample, swapping in your own data is easy. Read the data sanitization note below first.
- Export your closed incidents. Pull the last 30–60 days of resolved tickets from your ITSM tool (ServiceNow, Freshservice, Jira SM, ManageEngine, BMC Helix, Zendesk — anything that exports CSV). Aim for 30–60 tickets.
- Trim to five columns, one ticket per line:
INC#### | YYYY-MM-DD HH:MM | Agent | Category | short description - Replace the sample data. Find the line in the prompt that reads
----- SAMPLE DATA · delete this line and everything below it to use your own tickets -----. Delete it and the 40 sample tickets, paste your own. - Send it. Read the report.
Using it in Copilot, Cursor, and other tools
The prompt is plain text — it runs in almost any modern AI. The analysis holds up well across capable tools; how the report looks depends on whether the tool can render a web page.
- Claude, ChatGPT, Gemini: smoothest experience. Each renders inline. If you see raw code, ask for an HTML file or canvas.
- Microsoft 365 Copilot: strong at thinking, weaker at rendering. Often returns HTML as code. Either save the code as
report.htmland open in your browser, or add this to the end of the prompt: "Return the report as a formatted Word document instead of HTML." - Cursor / GitHub Copilot / dev tools: easiest place to get a clean page — create
report.html, ask the AI to write into it, then preview.
If your company gives you Microsoft 365 Copilot with a work account, use that rather than a personal AI account — your prompts stay inside your organization's data-protection boundary. That matters most when you move from sample data to your own tickets.
What to expect — results will vary
- The analysis is the durable part. The hidden Problem, the cluster, and the canary ticket hold up across capable models. That's the value — not the colors.
- Layout varies most. If output looks thin, reply: "Expand every section to match the structure in the prompt."
- Watch for invented numbers. The prompt says to mark unsupported values "TBD — measure first." Weaker models sometimes guess. If a figure looks too confident, ask: "Which ticket supports this?"
- If a tool cuts the output short, ask in two passes: "Give me sections 1 through 11," then "now sections 12 through 22."
Tweak it · make it your own
The prompt is a starting point, not a sacred text. Once you've seen it run, change it — just add the instruction to the end before you send:
- Narrow the focus: "Analyze only the security-related tickets" or "Ignore service requests — incidents only."
- Change the output: "Give me just the Problem Record and workarounds as a short email to my manager," or "Summarize the whole thing as five bullet points," or "Turn the executive summary into a slide."
- Change the audience: "Write the summary for a non-technical CFO who cares about cost and risk."
- Resize the input: 20–80 tickets works; more tickets, richer patterns, slightly slower.
Let the AI rewrite the prompt for you
This prompt is really a template for finding patterns in any pile of repetitive records. IT incidents are just the first use. Paste the whole prompt into your AI and ask it to retool itself:
"Rewrite this prompt so it analyzes [customer support tickets / change requests / security alerts / employee survey responses] instead of IT incidents, keeping the same report structure and guardrails."
One caution: when you change the subject matter, tell it to replace the five ITIL practices with whatever framework fits — otherwise the AI will force-fit Incident and Problem Management onto data that isn't about IT.
Next step after the report
If the report names a pattern you've been firefighting, the next move is decision, not analysis. Open the Change Enablement path, decide which workaround is permanent vs. temporary, and assign the Problem owner. The 30-day Risk Forecast tells you what you're betting on if you don't act.
If you ran this without first running the Practice Scan, consider running it next — it'll flag any practices that have other actionable signal in the same dataset that this deep-dive didn't surface.
ITIL 4 Practice Scan — Companion Prompt
June 2026 · One-page triage telling you which of the 34 ITIL 4 practices has actionable signal worth a deeper run
The prompt · click to copy
This prompt scans across all 34 ITIL 4 practices and tells you, in a one-page report, which ones have actionable signal in your dataset. It doesn't write deep artifacts — that's what Card 1 is for. It tells you where to look. The most common recommended next step is "run the Service Evolution Prompt focused on [practice]."
ITIL 4 Practice Scan — Companion Prompt
Loading the prompt…
Sample output · what the scan looks like
A one-page report with seven blocks: title bar with scan counts, three-sentence TL;DR naming the most urgent practice, metadata strip, three big tiles (practices flagged · no signal · not evaluated), a flagged-practices table sorted by severity, a 34-practice index proving full coverage, and a document control footer.
The flagged table is capped at 8 rows so the page stays scannable. Each row gives a one-line finding and a one-line recommended next step.
A sample one-page Practice Scan report will be added to this card after the June 16 session, so you can compare your output to a known-good. The prompt itself runs today.
How to run it · same 3 steps
Identical to Card 1: copy → paste into Claude / ChatGPT / Gemini / Copilot → press Enter. The Practice Scan output is a single HTML page — same rendering rules apply (Claude renders in Artifacts; ChatGPT / Copilot may print code, ask for a canvas or save it as scan.html and open in your browser).
For your own data: the scan benefits from a slightly larger sample — aim for 50–80 tickets so the breadth of practices has enough to read.
Next step after the scan
The scan tells you where. The next step depends on what it flagged:
- P1 or P2 flagged on Incident/Problem/Change: run Card 1 (Service Evolution Prompt) on that practice this week. Don't wait.
- P3 or INFO with a small specific action: do the small action — update a KB, open a Change record, file a CI Register entry — without running the deep dive.
- "No signal" across the board: the dataset is too small or too clean. Pull another month and re-scan.
The scan is designed to run weekly or monthly. Card 1 runs ad-hoc on whatever the scan surfaces.
Before you paste anything: a word on data
Do not paste real personally-identifiable information, customer names, real user IDs, contract numbers, internal credentials, or anything that violates your company's data-handling policy into a public LLM. Synthesized identifiers (INC4471), generic agent initials (A.Reyes), and product names (Outlook, VPN) are fine. If the description field of your tickets contains user emails, internal vendor ticket numbers, or named customers, sanitize the export first. Your AI vendor's privacy policy is a starting point, not the finish line — your company's data classification policy is.
Coming next
- August 11–20, 2026 · The Workshop Edition (in-person, six Florida cities) — bring your own incident export, run live with peers. The August prompt will target whichever practice pattern surfaces most consistently across participant datasets. City dates and RSVP →
- Sample Practice Scan report — a known-good one-page output to compare against, published with the July 14 session.
Why this is free
Because the framework AI is missing is the practitioner's judgment — and that part doesn't fit in a prompt. The prompt is the engine; interpreting the output, deciding what's structural vs. noise, and turning a Problem record into a fixed system is the practitioner's job. A library of prompts makes your team faster. Knowing which patterns to act on, and how to wire them into Change Enablement, Continual Improvement, and Knowledge Management, is the conversation we have when you're ready for it.
If either report describes a recurring pattern you didn't know was there — or one you knew but couldn't quantify — that's the conversation worth having. Book a discovery call and bring the report. 30 minutes mapping the practice gaps it surfaces — no pitch.
References
- AXELOS. (2019). ITIL Foundation: ITIL 4 Edition. TSO (The Stationery Office). Problem defined as "a cause, or potential cause, of one or more incidents" (p. 79); Problem Management described as the practice responsible for reducing the likelihood and impact of incidents by identifying actual and potential causes (p. 187); 34 ITIL 4 practices grouped into General Management (14), Service Management (17), and Technical Management (3) (pp. 81–82).
- Holzer, R. (2026). Practitioner recommendation based on prompt engineering and ITSM dataset testing. The 20–80 ticket range reflects working limits of a single LLM conversation at standard context sizes; fewer than 20 tickets reduces the AI's ability to distinguish cluster patterns from noise. Not a peer-reviewed formula — adjust to your dataset and tool.
- PeopleCert / AXELOS. (2020). ITIL 4 Practice Guide: Problem Management. PeopleCert Group. Describes the Known Error record, the relationship between Problem Management and Knowledge Management, and the CI Register's role in tracking practice gaps — the structural basis for Sections 1, 3, and 5 of the Service Evolution Prompt output.
Try it live with peers — July 14
The Service Evolution Prompt was first run live at the Florida ITSM Insights Meetup on June 16, 2026. The next session is Tuesday July 14, 2026 at 11:05 AM Eastern, virtual via Google Meet, ~55 minutes, free, no sales pitch. We'll run a fresh ticket set through the prompt, watch the AI surface a hidden Problem, and walk through the rendered report section by section. Bring your laptop. Bring your skeptics. Get the meet link and event details.
This library will grow. Each session of the Florida ITSM Insights Meetups adds a new prompt card to this page, keyed to the practice it targets. To see new prompts as they're released: come to the next session — the library updates the same week.