Which of the following BEST indicates that an incident management process is effective?

A decreased number of calls to the help desk could indicate fewer incidents, but it could also mean users are not reporting issues, which isn't a direct measure of the incident management *process's* effectiveness once an incident has occurred.

An increased number of incidents reviewed by IT management might indicate better reporting or scrutiny, but it doesn't directly measure the *speed or efficiency* with which incidents are handled and resolved.

An effective incident management process aims to restore normal service operation as quickly as possible with minimum impact to business operations. Therefore, a decreased time for incident resolution directly demonstrates the efficiency and effectiveness of the process in terms of speed of detection, diagnosis, and recovery.

An increased number of reported critical incidents suggests a potential increase in severe problems or better reporting, neither of which inherently indicates the *effectiveness* of the management process itself in handling those incidents.