In many organizations the role of Incident Manager is assigned to the Service Desk. It is important that the Incident Manager is given the authority to:

Limiting authority to only 1st and 2nd line excludes 3rd line specialists and vendors, preventing the Incident Manager from driving resolution for complex incidents that require specialist or supplier involvement.

Restricting authority to only 1st line means the Incident Manager cannot coordinate escalations to 2nd or 3rd line, making effective incident management impossible for anything beyond simple issues.

Authority at only 3rd line ignores the majority of incidents handled at 1st and 2nd line, removing the Incident Manager's ability to oversee the full incident lifecycle from detection through resolution.

ITIL defines the Incident Manager as responsible for the effective implementation of the incident management process across the entire organization. This requires authority over 1st line (Service Desk), 2nd line (technical support), and 3rd line (specialist/vendor support) to escalate, coordinate, and manage incidents end-to-end without being blocked at any tier.