Which function is responsible for the closure of an incident record?

Event management detects and classifies events that may become incidents but has no authority or role in owning or closing incident records.

The service desk is the single point of contact and process owner for incident management in ITIL, and only the service desk is authorized to formally close an incident record. It must confirm with the affected user that the incident is resolved to their satisfaction, update the record with full resolution details, and ensure closure criteria are met before marking the ticket closed.

Third-party engineers may assist in resolving an incident but are not authorized to perform formal incident closure - that responsibility remains with the service desk.

Allowing any function to close incidents would violate ITIL process integrity, bypass user satisfaction confirmation, and compromise the accuracy of incident metrics and reporting.