Risk is normally perceived as something to be avoided because of its association with threats. While this is generally true, the risk is also to be associated with opportunity. 

Failure to take opportunities can be a risk in itself. The opportunity costs of underserved market spaces and unfulfilled demand is a risk to be avoided. The Service Portfolio can be mapped to an underlying portfolio of risks that are to be managed. When service management is effective, services in the

Catalogue and Pipeline represent opportunities to create value for customers and capture value for stakeholders. 

Otherwise, those services can be threats from the possibility of failure associated with the demand patterns they attract, the commitments they require and the costs they generate. Implementing strategies often requires changes to the Service Portfolio, which means managing associated risks. 

Decisions about risk need to be balanced so that the potential benefits are worth more to the organization than it costs to address the risk. 

For example, innovation is inherently risky but could achieve major benefits in improving services. The ability of the organization to limit its exposure to risk will also be of relevance. The aim should be to make an accurate assessment of the risks in a given situation, and analyze the potential benefits. The risks and opportunities presented by each course of action should be defined in order to identify appropriate responses. 

Risk is defined as uncertainty of outcome, whether positive opportunity or negative threat. Managing risks requires the identification and control of the exposure to risk, which may have an impact on the achievement of an organization’s business objectives. 

Every organization manages its risk, but not always in a way that is visible, repeatable and consistently applied to support decision making. The task of management of risk is to ensure that the organization makes cost-effective use of a risk framework that has a series of well-defined steps. The aim is to support better decision making through a good understanding of risks and their likely impact. 

There are two distinct phases: risk analysis and risk management. Risk analysis is concerned with gathering information about exposure to risk so that the organization can make appropriate decisions and manage risk appropriately.

Types of Risks are:

Service Provider Risks

•       Contract Risks

•       Design Risks

•       Operational Risks

•       Market Risks

 The Four Ps of strategy

The lifecycle has, at its core, a service strategy. The entry points to service strategy are referred to as ‘the Four Ps’

•      Perspective – describes a vision and direction. A strategic perspective articulates the business philosophy of interacting with the customer or the manner in which services are provided. For example, a shared service provider (Type II) for a global law firm may adopt the strategic perspective of, ‘We will be a best-in-class service provider for our law firm’. The CIO determined that his business most values a certain type of service provider. By setting a perspective of competing against other industry specific

providers he not only narrows the field of competing alternatives, but also cements his own distinctiveness in the minds of his customers

•      Position – describes the decision to adopt a well-defined stance. Should the provider compete on the basis of value or low cost? Specialized or broad sets of services? Should the value be biased towards utility or warranty? An internal service provider (Type I) restricted to serving one business unit may adopt a position based on ‘product know-how’ or ‘customer responsiveness’. The law firm CIO may adopt a needs-based

position: attorney-centric offerings for knowledge, collaboration and document management services.

•       Plan – describes the means of transitioning from ‘as is’ to ‘to be’. A plan might detail, ‘How do we offer high-value or low-cost services?’ Or in the case of our law firm CIO, ‘How do we achieve and offer our specialized services?’

•       Pattern – describes a series of consistent decisions and actions over time. A service provider who continually offers specific services with deep expertise is adopting a ‘high-value’ or ‘high-end’ service strategy. A service provider who continually offers dependable and reliable services is adopting a ‘high-warranty’ strategy. If mid-course corrections are to be made within the framework of an existing perspective and position, this is where those decisions and actions are formulated. The law firm CIO, for example, may decide to offer the same specialized services but with enhanced levels of client privacy (warranty).

It is necessary to distinguish between different types of service providers. While most aspects of service management apply equally to all types of service providers, others such as customers, contracts, competition, market spaces, revenue,e, and strategy take on different meanings depending on the type. There are three types of business models service providers:

•       Type I – internal service provider

•       Type II – Shared Services Unit

•       Type III – external service provider

Type I (internal service provider)

Type I providers are typically business functions embedded within the business units they serve. The business units themselves may be part of a larger enterprise or parent organization. Business functions such as finance, administration, logistics, human resources, and IT provide services required by various parts of the business. They are funded by overheads and are required to operate strictly within the mandates of the business. Type I providers have the benefit of tight coupling with their owner-customers, avoiding certain costs and risks associated with conducting business with external parties. The primary objectives of Type I providers are to achieve functional excellence and cost-effectiveness for their business units. They specialize to serve a relatively narrow set of business needs. Services can be highly customized and

resources are dedicated toprovidinge relatively high service levels. The governance and administration of business functions are relatively straightforward. The decision rights are restricted in terms of strategies and operating models. Type I providers operate within internal market spaces. Their growth is limited by the growth of the business unit they belong to. Each business unit (BU) may have its own Type I provider. The success of Type I providers is not measured in terms of revenues or profits because they tend to operate on a cost-recovery basis with internal funding. All costs are borne by the owning business unit or enterprise.

Type II (shared services unit)

Functions such as finance, IT, human resources, and logistics are not always at the core of an organization’s competitive advantage. Hence, they need not be maintained at the corporate level where they demand the attention of the chief executive’s team. Instead, the services of such shared functions are consolidated into an autonomous special unit called a shared services unit (SSU). This model allows a more devolved governing structure under which SSU can focus on serving business units as direct customers. SSU can create, grow, and sustain an internal market for their services and model themselves along the lines of service providers in the open market. Like corporate business functions, they can leverage opportunities across the enterprise and spread their costs and risks across a wider base. Customers of Type II are business units under a corporate parent, common stakeholders, and an enterprise-level strategy. What may be sub-optimal for a particular business unit may be justified by advantages reaped at the corporate level for which the business unit may be compensated. Type II can offer lower prices compared to external service providers by leveraging corporate advantage, internal agreements, and accounting policies. With the autonomy to function as a business unit, Type II providers can make decisions outside the constraints of business unit level policies.

Type III (external service provider)

The business strategies of customers sometimes require capabilities readily available from a Type III provider. The additional risks that Type III providers assume over Type I and Type II are justified by increased flexibility and freedom to pursue opportunities. Type III providers can offer competitive prices and drive down unit costs by consolidating demand. Certain business strategies are not adequately served by internal service providers such as Type I and Type II.

Customers may pursue sourcing strategies requiring services from external providers. The motivation may be access to knowledge, experience, scale, scope, capabilities, and resources that are either beyond the reach of the organization or outside the scope of a carefully considered investment portfolio. Business strategies often require reductions in the asset base, fixed costs, operational risks, or the redeployment of financial assets. Competitive business environments often require customers to have flexible and lean structures. In such cases, it is better to buy services rather than own and operate the assets necessary to execute certain business functions and processes. Security is always an issue in shared services environments. But when the environment is shared with competitors, security becomes a larger concern. This is a driver of additional costs for Type III providers. As a counter-balance, Type III providers mitigate a type of risk inherent to Types I and II: business functions and shared service units are subject to the same system of risks as their business unit or enterprise parent. This sets up a vicious cycle, whereby risks faced by the business units or the enterprise are transferred to the service units and then fed back with amplification through the services utilized. Customers may reduce systemic risks by transferring them to external service providers who spread those risks across a larger value network.

Processes can be defined as a structured set of coordinated activities designed to produce an outcome and provide value to customers or stakeholders. A process takes one or more inputs and through the activities performed turns them into defined outputs.

Some principles:

•   All processes should be measurable and performance-driven (not just time, but measuring overall efficiency including cost, effort, and other resources used)

•       Processes are strategic assets when they create competitive advantage and market

•       differentiation.

•       Processes may define roles, responsibilities, tools, management controls, policies, standards, guidelines, activities, and work instructions if they are needed.

•       A process owner is the person responsible for ensuring that the process is fit for the desired purpose and is accountable for the outputs of that process.

•       A process manager is the person responsible for the operational management of a process. There may be several Managers for the one process or the same person may be both the process owner and process manager (typically in smaller organizations).

So when defining and designing processes, it is important to consider both the physical andbehaviorall aspects that exist. This may be addressed by ensuring that all required stakeholders are  appropriately involved in the design of processes so that:

•       They can communicate their own ideas, concern,s, and opinions that might influence how processes are designed, implemented,d and improved. Of particular importance may be current behaviors that have not been previously identified which may affect the process design and implementation.

•       Stakeholder groups are provided adequate training and education regarding how to perform their role within the process and what value the process provides for.

•       Stakeholders generally feel to be empowered in the change being developed and therefore are more likely to respond positively rather than actively or passively resisting the organizational changes occurring.

Functions refer to the logical grouping of roles and automated measures that execute a defined process, an activity, or a combination of both. The functions within Service Operation are needed to manage the ‘steady state’ operation IT environment. Just like in sports where each player will have a specific role to play in the overall team strategy, IT Functions define the different roles and responsibilities required for the overall design, delivery, and management of IT Services.

A useful tool to assist the definition of the roles and responsibilities when designing processes is the RACI model. RACI stands for:

•       R – Responsibility (actually does the work for that activity but reports to the function or position that has an “A” against it).

•       A – Accountability (is made accountable for ensuring that the action takes place, even if they might not do it themselves). This role implies ownership.

•       C – Consult (advice/guidance/information can be gained from this function or position before the action takes place).

•       I – Inform (the function or position that is told about the event after it has happened).

General Rules that exist:

• Only 1 “A” per Row can be defined (ensures accountability, more than one “A” would confuse

this).

• At least 1 “R” per Row must be (shows that actions are taking place), with more than one being appropriate where there is shared responsibility.

Lifecycle: The natural process of stages that an organism or inanimate object goes through as it matures. For example, human stages are birth, infant, toddler, child, pre-teen, teenager, young adult, adult, elderly adult, and death.

 

First the practices for ITSM were based around the how questions.

These included:

•       How should we design for availability, capacity, and continuity of services?

•       How can we respond to and manage incidents, problems, and known errors?

•        

No longer does ITIL just answer the how questions, but also why?

•       Why does a customer need this service?

•       Why should the customer purchase services from us?

•       Why should we provide (x) levels of availability, capacity, and continuity?

 

By first asking these questions it enables a service provider to provide overall strategic objectives for the IT organization, which will then be used to direct how services are designed, transitioned, supported and improved in order to deliver optimum value to customers and stakeholders. The ultimate success of service management is indicated by the strength of the relationship between customers and service providers. The 5 phases of the Service Lifecycle provide the necessary guidance to achieve this success. Together they provide a body of knowledge and set of good practices for successful service management. This end-to-end view of how IT should be integrated with business strategy is at the heart of ITIL.

•       Service Strategy Phase: Determine the needs, priorities, demands, and relative importance for desired services. Identifies the value being created through services and the predicted financial resources required to design, deliver and support them.

 

•       Service Design Phase: Designs the infrastructure, processes, and support mechanisms

•       needed to meet the Availability requirements of the customer.

 

•       Service Transition Phase: Validates that the Service meets the functional and technical

•       fitness criteria to justify release to the customer.

 

•      Service Operation Phase: Monitors the ongoing Availability being provided. During this phase, we also manage and resolve incidents that affect Service Availability.

 

•    Continual Service Improvement Phase: Coordinates the collection of data, information, and knowledge regarding the quality and performance of services supplied and Service

Management activities performed. Service Improvement Plans developed and coordinated to improve any aspect involved in the management of IT services.

 There are four perspectives (“4P’s”) or attributes to explain the concept of ITSM.

•  Partners/Suppliers Perspective: Takes into account the importance of Partner and External Supplier relationships and how they contribute to Service Delivery.

•       People Perspective: Concerned with the “soft” side – IT staff, customers and other

•       stakeholders e.g. do staff have the correct skills and knowledge to perform their roles?

•       Products/Technology Perspective: Takes into account IT services, hardware & software, budgets, tools.

•       Process Perspective: Relates the end-to-end delivery of service based on process flows.

The term IT Service Management (ITSM) is used in many ways by different management frameworks and organizations seeking governance and increased maturity of their IT organization. Standard elements for most definitions of ITSM include:

•       Description of the processes required to deliver and support IT Services for customers.

•       The purpose primarily is to deliver and support the technology or products needed by the business to meet key organizational objectives or goals.

•       Definition of roles and responsibilities for the people involved including IT staff, customers, and other stakeholders involved.

•       The management of external suppliers (partners) involved in the delivery and support of the technology and products being delivered and supported by IT.

The combination of these elements provides the capabilities required for an IT organization to deliver and support quality IT Services that meet specific business needs and requirements.

The official ITIL definition of IT Service Management is “A set of specialized organizational capabilities for providing value to customers in the form of services”.

While the benefits of applying IT Service Management practices vary depending on the organization’s needs, some typical benefits include:

•       Improved quality service provision

•       Cost justifiable service quality

•       Services that meet business, customer, and user demands

•       Integrated centralized processes

•       Everyone knows their role and knows their responsibilities in service provision

•       Learning from previous experience

•       Demonstrable performance indicators.

It is important to consider the range of stakeholders who can benefit from improved ITSM practices. These stakeholders can come from:

•       Senior management.

•       business unit managers.

•       Customers.

•       End-users.

•       IT staff.

•       Suppliers.

 The official definition of a Service is “a means of delivering value to customers by facilitating outcomes customers want to achieve without the ownership of specific costs or risks”.

Example:

While I do enjoy cooking, there are often times when I wish to enjoy quality food without the time and effort required to prepare a meal. If I was to cook, I would need to go to a grocery store, buy the ingredients, take these ingredients home, prepare and cook the meat, set the table, and of course clean up the kitchen afterward. The alternative, of course, can go to a restaurant that delivers a service that provides me with the same outcome (a nice meal) without the time, effort, and general fuss if I was to cook it myself.

Now consider how I would identify the quality and value of that service being provided. It isn’t just the quality of the food itself that will influence my perceptions but also:

·        The cleanliness of the restaurant.

·        The friendliness and customer service skills of the waiters and other staff.

·        The ambiance of the restaurant (lighting, music, decorations, etc.).

·        The time is taken to receive my meal (and was it what I asked for?).

·        Did they offer water as well as normal drinks and beverages?

If just one of these factors doesn’t meet my expectations then ultimately the perceived quality and value being delivered to me as a customer are negatively impacted. Now relate this to our role in providing an IT Service. If we as IT staff focus on the application or hardware elements being provided and forget or ignore the importance of the surrounding elements that make up the end-to-end service, just like in the example of the restaurant, the customer experience, and perceived quality and value will be negatively impacted.

But if we take a Service-oriented perspective, we also ensure that:

•       Communication with customers and end-users is effectively maintained.

•       Appropriate resolution times are maintained for end-user and customer inquiries.

•       Transparency and visibility of the IT organization and where money is being spent are maintained.

•       The IT organization works proactively to identify potential problems that should be rectified or

•       improvement actions that could be made.

IT Service Management: A set of specialized organizational capabilities for providing value to customers in the form of services.

Capabilities: The ability of an organization, person, process, application, CI, or IT service to carry out an activity. Capabilities can be described as:

• The functions and processes utilized to manage services.

• Intangible assets of an organization that cannot be purchased, but must be developed and matured over time. The ITSM set of organizational capabilities aims to enable the effective and

efficient delivery of services to customers.

Resources: A generic term that includes IT Infrastructure, people, money or anything else

that might help to deliver an IT service. Resources are also considered to be tangible assets of an organization.

Process: A set of coordinated activities combining and implementing resources and

capabilities in order to produce an outcome and provide value to customers or stakeholders.

Processes are strategic assets when they create competitive advantage and market differentiation. They may define roles, responsibilities, tools, management controls, policies, standards, guidelines, activities, and work instructions if they are needed.

Service: A means of delivering value to customers by facilitating outcomes customers want to achieve without the ownership of specific costs or risks

Process Owner: The person responsible for ensuring that the process is fit for the desired

purpose and is accountable for the outputs of that process.

Service Owner: The person who is accountable for the delivery of a specific IT Service. They

are responsible for continual improvement and management of change affecting Services under their care.

Process Manager:

The person was responsible for the operational management of a process. There may be several Managers for the one process. They report to the ProcessOwner.

Internal ServiceProviders:

An internal service provider that is embedded within a business unit e.g. one organization within each of the business units. The key factor is that the services provide a source of competitive advantage in the market space the business exists in.

Shared service providers:

An internal service provider that provides shared IT service to more than one business unit e.g. one IT organization to service all businesses in an umbrella organization. IT Services typically don’t provide a source of competitive advantage, but instead, support effective and efficient business processes.

External Service Providers:

A service provider that provides IT services to external customers.e. outsourcing

Business Case: A decision support and planning tool that projects the likely consequences of a

business action. It provides justification for a significant item of expenditure. Includes information about costs, benefits, options, issues, risks, and possible problems.

 ITIL stands for the Information Technology Infrastructure Library

Five volumes make up the IT Infrastructure Library (Version 3):

a)     Service Strategy

Determine the needs, priorities, demands, and relative importance for desired services. Identifies the value being created through services and the predictedfinancial resources required to design, deliver and support them.

b)     Service Design

Designs the infrastructure, processes and support mechanismsneeded to meet the Availability requirements of the customer.

c)     Service Transition

Validates that the Service meets the functional and technicalfitness criteria to justify release to the customer.

d)     Service Operation

Monitors the ongoing Availability being provided. During this phase we also manage and resolve incidents that affect Service Availability.

e)     Continual Service Improvement

Coordinates the collection of data, information andknowledge regarding the quality and performance of services supplied and ServiceManagement activities performed. Service Improvement Plans developed and coordinated toimprove any aspect involved in the management of IT services.