During a review of an organization's incident management process, an IS auditor notes that the service desk assigns priority to incidents based solely on the order in which tickets are received. Several business-critical outages recently sat in the queue behind low-impact password reset requests, delaying restoration. What should the auditor recommend as the MOST effective improvement?