© 2006 Jupitermedia Corporation Webcast TitleThe Impact of Outsourcing on ITIL Initiatives The...

© 2006 Jupitermedia Corporation

Webcast TitleThe Impact of Outsourcing on ITIL Initiatives

The Impact of Outsource on ITIL Initiatives

September 25, 2006

2:00pm EDT, 11:00am PDT

Speaker:

George Spafford, Principal Consultant, Pepperweed Consulting


The Impact of Outsourcing on ITIL Initiatives

Housekeeping

• Submitting questions to speaker– Submit question at any time by using “Ask a question”

section located on lower left-hand side of your console.– Questions about presentation content will be answered

during 10 minute Q&A session at end of webcast.

• Technical difficulties?– Click on “Help” link– Use “Ask a question” interface



Main Presentation



Agenda

• How an understanding of process theory can help• Why a map of dependencies and information

interchange is vital• What risks are associated with outsourcing and

ITIL• What controls that can be used to mitigate the

risks



A Process

• Is a series of tasks with a goal– “Why are we doing this?”

• If there isn’t a goal, then you do not have a process

• You can say the same for a company– It is a collection of

organizational units assembled for the purpose of attaining a goal

Task 1

Task 2

Task 3

Task 4

Goal!



What are controls?

• Controls are implemented limit variation around the attainment of objectives to acceptable levels

• All processes contain an inherent level of variation that can not be eliminated• Only put in enough controls to lower the residual risk to a level that is acceptable to

management.• Controls can be

– Manual – Meaning they take a person to perform without automation.– Automated – Meaning that technology is used to enable the process partially or entirely.– Important Note – In accounting terminology, an automated control is a control that is embedded in

a system such as bounds checking, audit trails, workflow, etc.• Three broad types

– Preventive Controls – Intended to stop a future transgression. Examples – policies and procedures

– Detective Controls – Attempt to find out about an event that has already happened. Example – Log review

– Corrective Controls – Aimed at restoring the last known good state. Example – Restore from tape



Outsourced or not, IT must enable the attainment of objectives and goals

Organizational Goal

Accounting Manufacturing

Sales Customer ServiceHuman Resources



Necessitates Teamwork, Planning & Oversight

CustomerRequirements

ChangeMgt

ConfigurationMgt

Service DeskFunction

IncidentMgt

ProblemMgt

Service LevelMgt

CapacityMgt

AvailabilityMgt

IT FinancialMgt

IT ServiceContinuity Mgt

IT SecurityMgt

ServiceDevelopment

To achieve the goal requires management of internal and external resources.



Systemic Approach

• The power of ITIL lies in its systemic integration of processes areas – not simply piecemeal adoption

• Any single process in isolation will reach a level of diminishing returns

• As Goldratt has taught us, to optimize the throughput of a system requires optimization of the system – not just one area

• Continuous improvement requires a systemic mentality of adoption and continuous refinement

• Each area both draws information from, and supplies information to, other processes and functions

• This is true internally and externally – data exchanges will be needed!

Service LevelManagement

ChangeManagement

IncidentManagement

ProblemManagement

Service DeskFunction

ConfigurationManagement

CapacityManagement

AvailabilityManagement

IT FinancialManagement

IT ServiceContinuity

Management

IT SecurityManagement



Service Delivery Impacts



Service Level Management

• Need to understand service requirements• Need to ensure service levels can be met

– Operational Level Requirements (OLAs)– Underpinning Contracts (UCs)

• Challenges– Need vendors to support service levels– No vendor contracts in place– Vendor contracts pre-existing



Availability Management

• Need to design availability into the systems vs. retrofit

• Monitor availability relative to service level commitments

• Challenges– Vendor disagrees with availability standards– Vendor fails to apply availability requirements



Capacity Management

• Need to monitor current capacity utilization and impacts of changes

• Need to plan for capacity for budgeting• Challenges

– Disconnected from internal production– Failure to provide minimum guidelines



Financial Management

• Budgeting• IT Cost Accounting• Charge backs• Challenges

– Realistic budgeting / cost containment– Participation in IT costing studies



IT Service Continuity Management

• IT needs to support the business’ Business Continuity Plan (BCP)

• Challenges– Vendor may not be able to commit to supporting the plan– Vendor may not be willing to formalize testing



Service Support Impacts



Configuration Management

• Configuration Management is the logical view of the IT environment

• Need to extend the understanding such that a service is modeled sufficiently– Internal– External

• Need accurate and timely configuration data• Challenges

– Getting the data– Keeping it both timely and accurate– Vendor needs to comply/integrate with change, configuration and

release management processes!



Change Management

• The use of standardized methodologies to manage risks associated with changes

• Challenges– Vendor may not have, or want, change management– Vendor may not be transparent– Vendor needs to comply/integrate with change, configuration

and release management processes!



Release Management

• Use of a standard methodology to ensure that what is put into production meets requirements (quality management)

• Challenges– Lack of project management– Informal testing– Poor communication– Vendor needs to comply/integrate with change, configuration

and release management processes!



Service Desk Function

• This is the face of IT• Single Point of Contact• Challenges

– Don’t want customers and users struggling with who to contact

– Need response times that comply with SLA– An internal Service Desk needs information from internal

and external sources– An outsourced Service desk needs information from internal

and external sources



Incident Management

• Concerned with abnormal operation of a service and quickly restoring service to an acceptable level

• Also worried about threats to normal operation• Challenges

– Exchanging information with vendors• Effective & Efficient Communications

– Facilitating rapid recovery



Problem Management

• Determine root cause• Proactively prevent incidents• Challenges

– Taking the time to do root cause analysis– Communication / Getting Data



Outsourcing Controls

We can leverage ISACA’s Control Objectives for Information and related Technologies (COBIT) version four, which can be obtained from

http://www.isaca.org



Understand all Supplier Relationships

• Need to identify and understand the nature of all supplier relationships (COBIT DS2.1)– Very often, not all vendor relationships are known and

managed– Categorize by supplier type, significance and criticality– Maintain formal documentation of technical and

organizational relationships covering• Roles and responsibilities

• Goals

• Expected deliverables

• Credentials of representatives of these suppliers.



Need Formal Contracts

• Need formal vendor management (COBIT DS2.2)– Internal owner who performs a liaison role between Customers and Vendors– Formal underpinning contracts (UCs) that support SLAs

• In writing!!• Legal Review• Concise• Objective oriented• Not overly complex• Performance measures / KPIs that support attaining the SLA• Right to Audit clause• Mutual Non-Disclosure

• Need a formal means to evolve over time– Business requirements will change– Risks will change– The key is to formally manage the contract, performance review and change procedures

• We need trust and transparency– What does a contract really get you?– Selecting the right vendors and maintaining relationships are essential



Supplier Risk Management

• Need to constantly identify and mitigate risks associated with vendors (COBIT DS2.3)

• Probability of occurrence• Business Impacts• Mitigation activities• Risks associated with the vendor(s)• Risks collected with the vendor(s)• Need effective, efficient and secure risk

management



Supplier Performance Monitoring

• Need to monitor how the supplier is performing (COBIT DS2.4)

• Compared to– Current business requirements– Future business requirements– Benchmarks / comparison other vendors

• Need to foster continuous improvement



General Comment

Vendor Integration – they are part of your “system” of services and must not be treated as a “bolt on” afterthought.

We need to optimize the entire system!



Vendor Integration

• Vendors need to be involved during requirements definition, functional and technical specification phases – not just at the end– “Here. Do this now.”

• This is a partnership – a failure impacts the system – not just the component service(s) the vendor supplies

• Need to clearly understand roles and responsibilities• Need to clearly define data exchanges• Automate where possible



Thank you!

George SpaffordPrincipal Consultant

Pepperweed [email protected]



Questions?



Thank you for attendingIf you have any further questions, e-mail

[email protected]

© 2006 Jupitermedia Corporation Webcast TitleThe Impact of Outsourcing on ITIL Initiatives The...

Documents

Transcript of © 2006 Jupitermedia Corporation Webcast TitleThe Impact of Outsourcing on ITIL Initiatives The...