ISO20K: Alice in Service Management Wonderland

Alice in Service Management Wonderland
Frameworks, methods and standards: complementing or competing each other?

‘Would you tell me, please, which way I ought to go from here?’
‘That depends a good deal on where you want to get to,’ said the Cat.
‘I don’t much care where—’ said Alice.
‘Then it doesn’t matter which way you go,’ said the Cat.
‘—so long as I get somewhere,’ Alice added as an explanation.
‘Oh, you’re sure to do that,’ said the Cat, ‘if you only walk long enough.’

Brainteaser

We’re doing ITIL… we’re doing CobiT… we’re doing Balanced Scorecard… we’re doing CMMI… we’re doing MOF… we’re doing 6 Sigma… we’re doing T-MAP, we’re doing every single framework and method that’s available out there, but we’re still not sure whether or not we’re doing the right thing!

Introduction

As a Service Management trainer and consultant it’s amazing and sometimes almost eerie when you come across yet another organization that seems to do and have it all and still doesn’t seem to get it quite right.

Spending bucket loads of money and wearing out dozens of highly capable and initially motivated staff many organizations seem to be (or feel) totally lost in a maze of promising-the-world frameworks and we-know-it-all-better methods. What all these organizations, maybe even including your own organization, have in common is that they’re all desperately, and often with valid and good intentions, trying to:

• increase the quality of their IT Services;


• decrease, or at least manage, the costs of providing their IT Services; and


• align their IT organization with the rapidly changing business requirements.

Why?

Because most of us are facing or are already dealing with increased global competition, rapidly changing customer demands and expectations, shortening product and service lifecycles, ever increasing complexity of IT Infrastructures, and truckloads of data waiting to be translated into useful information and ultimately organizational wisdom.

As the author I probably feel as much confused as you do! What’s the optimal path (most efficient and most effective) forward? Is ITIL version 3 the answer, or should we stick with ITIL version 2? What about this MOF thing? Surely many of you are running a large percentage of their nodes on the wIntel platform, and the Microsoft Operations Framework may just be what you need, but then again there’s also ISACA’s CobiT. By the time I’ve finished this article someone in the world has probably come up with yet another framework or method.

I don’t claim having the ultimate answer, but I do think it’s time for a complete and total mind shift where organizations move from focusing on Service Management frameworks and methods to focusing on Service Management standards. ISO/IEC 20000 has been locked up in the cupboard for way too long and hasn’t as yet received the credit is deserves. Let’s have a tea party with ISO/IEC 20000 and ask Alice to come along.

This article’s intention is to give you an overview of where ISO/IEC 20000 positions itself and how it interacts with the various existing frameworks and methods, more specifically how it interacts with the ITIL framework. I could have chosen any other framework, but feel more comfortable with ITIL as I was spoon fed and grew up with ITIL from the day I could walk and talk.

In this article we’ll take a closer look at the current dilemma facing most, if not all, organizations. You’ll be provided with a succinct description of ISO/IEC 20000, and we’ll discuss training and literature as well as the certification and accreditation that are inherent to the standard. We’ll examine the costs, benefits and risks and also take a brave and daring step into the not too distant future. Where possible we’ll compare the standard with ITIL v3 and leave it up to you the reader to compare when applicable to other frameworks and methods.

Pain

Having a bit of a marketing background, I’ve been taught to show you pain and then give you pleasure. So where’s the pain? The pain lies in organizations investing enormous amounts of valuable dollars in a plethora of frameworks, methods and training, without achieving the reward that’s telling them: “you’re on track – for now”. Yes, I had to add “for now” as nothing is static in glamorous business world, and complacency often kicks in before you’ve even said your ABC.

So, you think you’re doing ITIL (it’s a bit like: “So, you think you can Dance”)? Far worse even; some organizations think they’re ITIL compliant. There’s no such thing as being ITIL compliant! You cannot be compliant with a highly flexible and dynamic framework – maybe in fairytales, but surely not in the real and highly complex world. ITIL doesn’t mandate anything. You can do with it whatever you want, and still call yourself an ITIL-ised or ITIL-based organization.

So, what’s the answer? Do you care where you’re going? Do you care whether or not you’re doing the right things and things right? If you care, then surely something should tell you exactly what to do! And that my dear reader is exactly what the ISO/IEC 20000 standard is all about. It doesn’t give you should/s, but is gives you shall/s. It provides you clear answers and to-the-point direction, whereas most (not all) frameworks and methods are wishy-washy, woolly, fluffy and directionless. Tell me what to do, and stop beating around the bush. Give me the standard, and give it to me now!

Description

The ISO/IEC 20000 standard has been around since December 2005, and has recently (February 2007) been adopted by Standards Australia as the Australian National Standard for IT Service Management. The ISO/IEC 20000 standard (by many referred to as ISO20K) is a result of ISO (International Organization for Standardization) and IEC (International Electro-technical Commission) working together in a joint technical committee (JTC). Leveraging of BS15000 as an existing British Standard ISO20K was fast tracked into an International Standard for IT Service Management.

The standard consists of the following two key parts:

1. Part 1 – Specification: The specification outlines those aspects of IT Service Management that an organization must comply with in order to withstand the all-seeing eye of the external auditors.


2. Part 2 - Code of practice: The code of practice provides guidance and recommendations on how to meet the requirements as set by the specification.

Any organization, public, private, not-for-profit, can use ISO/IEC 20000 to design, develop, implement, maintain and improve a quality IT Service Management environment, and if it wishes to do so, pursue full accreditation as ultimate proof to its customers and own staff showing that the IT Service Management organization is on track, and is committed to stay on track.

ISO/IEC 20000 is not about accreditation, it’s about committing your organization and yourself to a mind-set and destiny called “managing quality”.

Training

When comparing ISO20K to some other ITSM frameworks and methods, it seems relatively young, nevertheless there’s strong evidence in the form of ever growing support, training and literature that it’s here to stay, and that one day it may even push ITIL from its favorite number-one spot.

As it currently stands training is (made) available on three levels:

1. Foundation Level: This training is geared towards giving you the ISO/20K language, concepts and bare bones. Remember: “Stronger foundations carry heavier loads”.


2. Professional Level: Training on this level focuses on (five) specific parts of the standard including support, delivery, management, alignment and control of IT Services. The professional training provides each specific team with the capabilities of making the organization ready to be ultimately assessed against the standard (if and when required).


3. Consultant/Manager, Auditor Level: At the highest level there’s an opportunity to specialize as manager/consultant or auditor. It may be evident that there’s a bit of a conflict of interest between these two main streams, as consultants should not be auditing themselves, and auditors should not give advice but merely gauge the status quo against a set standard.

Remember that ISO/20K is not necessarily about becoming accredited – it’s about committing to quality, in body and soul, when it comes to delivering IT Services.

Literature

As the ISO20K specification and code of practice outline to a large extend what needs to be done rather than how to do it, a purpose written set of publications, very similar to IT Infrastructure Library (ITIL), is made available through the British Standards Institute. A number of these publications (see below) are also used as part of the above mentioned ISO/IEC 20000 training modules.

The following publications are part of the “Achieving ISO/IEC 20000” series:

• Management, decisions and documentation (BIP 0030)


• Why People Matter (BIP 0031)


• Making Metrics Work (BIP 0032)


• Managing end-to-end service (BIP 0033)


• Finance for service managers (BIP 0034)


• Enabling Change (BIP 0035)


• Keeping the service going (BIP 0036)


• Capacity Management (BIP 0037)


• Integrated Service Management (BIP 0038)


• The differences between BS15K and ISO/IEC20K (BIP 0039)

Rest assured that any framework, any method, and any set of publications can be used, as long as the right bits and pieces are carefully selected that align with the ISO20K standard. The “Achieving ISO/IEC 20000” series makes this selection process just a wee bit easier.

Certification/accreditation

Although not necessarily 100% accurate - as always “It Depends” which dictionary you use - I would like to make a distinction between certification and accreditation.

Certification: To supply an individual with credentials or authority.

This means that as an individual level you can get certified against the various ISO/IEC 20000 training levels. The certification stays with you, wherever you decide to go. Your organization may not be ISO/IEC 20000 accredited as such, but you are still recognized as for example a certified ISO20K Service Delivery professional.

Accreditation: To supply an organization, or part thereof, with credentials or authority.

This means that the organization, or part thereof, can get accredited against the ISO/IEC 20000 standard. The accreditation is not bound to any individual, but the organization, or part thereof.

What part of the organization becomes accredited depends on the scope of the assessment exercise.

Having both certified ISO20K staff and your ISO20K certificate framed on the wall (being ISO/IEC 20000 accredited) means you’re recognized a champion in the arena of quality management leaving the other players (for many of you read “competition”) struggling and desperately trying to keep up.

Costs

There are few things that come for free in this world, and ISO/IEC 20000K surely isn’t one of them. Fortunately it’s not only about spending money, but often saving even more, sometimes even your very existence. What do you prefer? A well managed Change Management process with properly kept change records, or delivering services that don’t work and ending up with frustrated and turning-your-back-on-you customers? The choice is yours my friends.

So, what are the costs? Here’s a comprehensive overview of some of the cost items you’ll be facing:

• Consultants (could be done by internal staff):


• Pre self-assessment or assessment performed by a recognized consultancy organization (what gaps need fixing?)


• Changes (read improvements) to made based on identified gaps using ISO20K as benchmark


• Post self-assessment or assessment performed by a recognized consultancy organization (are the gaps fixed?)


• Auditors (cannot be done by internal staff, unless accreditation is not the aim of the game):


• Pre-assessment (scoping the assessment, team composition, etc.)


• Initial assessment (the official assessment by the auditors)


• Surveillance (initially 6-12 months after granting accreditation, hereafter annually)


• Re-assessment (six months before accreditation expires)


• Scope extension (if required)


• Miscellaneous:


• Publications and supporting tools


• Roles and staff needed


• Accommodation for new staff


• Training at the various levels

For the purpose of this article it’s really difficult to put a hard dollar value against the above mentioned list, as many factors, such as scope of the assessment (e.g. business units/geography covered) will influence the overall price tag.

Value proposition/benefits

Okay, so you’ve just been presented a comprehensive list of some of the cost items you’ll be facing when jumping on the ISO20K band wagon. On purpose I didn’t paint a world that can be admired through pink glasses only, but hopefully a more realistic one. Investing in quality costs money, but the following benefits, directly derived from ISO20K, should outweigh the costs and the risks.

• Competitive advantage


• Clear goals and targets to aim for


• Improved internal and external relationships


• Increased confidence by staff and customers


• Frequent feedback on the state of quality provided


• Instigates a change in mindset


• Professionalizes culture


• Consistency of service delivery


• Focus-shift from reactive to proactive


• Improved communication and reporting


• Improved knowledge management


• Independent assessment of your quality


• Marketing opportunities


• Reduced confusion on whether or not we’re doing the right thing


• Clear and concise training and career opportunities


• Focus-shift from technology to business drivers and enablers


• Clear view on IT’s maturity and ability to perform well


• Independence from other frameworks and methods

ISO/IEC 20000 is a true means, and at the time of writing this article probably the only means, of becoming completely frameworks and methods independent. Bygone are the days of proprietary process maturity assessments and to some degree also proprietary technology maturity assessments. Please realize that ISO20K can be used as a guideline to assess technology’s capabilities, but cannot be used to accredit the technology (read products). As such products cannot earn the status of being ISO20K compliant, but maybe some could be called ISO20K compatible.

Challenge/problems/risks

The single biggest challenge often experienced by organizations implementing ITIL (or other frameworks) is the culture, and I guess this will be the same for organizations embracing ISO/IEC 20000, but to a lesser extent. I can almost hear you think: “Why to a lesser extent?” Frequent and substantial audits, especially linked to the official ISO/IEC 20000 accreditation leave no escape gates open, and no pages unturned. It’s often the lack of clear visibility of what should happen and what does happen in reality that creates a vacuum where non-conformities are allowed to breed and multiply. ISO/IEC 20000 is BIG BROTHER and the ever-watchful eye of Sauron - like it or not – it’s something we all need at times.

Some other problems you may well have to face are:

• No sense nor urgency felt to jump on the ISO20K band wagon


• Scope too wide or too narrow


• Insufficient funding


• No long-term commitment or involvement from senior management


• No proper supporting products


• Unclear how other standards (e.g. ISO9000) complement ISO/IEC 20000


• Lack of vision, strategy and/or planning


• Lack of ISO20K skills, knowledge and champions

Future

The Caterpillar was the first to speak.
‘What size do you want to be?” it asked.
‘Oh, I’m not particular as to size,’ Alice hastily replied; ‘only one doesn’t like changing too often, you know.’
‘I don’t know,’ said the Caterpillar.

The future is change and change is the future. Is there a time in the future where all frameworks, methods and standards converge in a grand unifying service management theory? I sincerely hope so, but it may take another couple of decades before we finally get there. Until then playing it safe and becoming compliant to the International IT Service Management standard ISO/IEC 20000 doesn’t seem an illogical or wasted step into a future that will most definitely be filled with increased pressure on governance, compliance and standards.

Pleasure

However, when they had been running half an hour or so, and were quite dry again, the Dodo suddenly called out ‘The race is over!’, and they all crowded round it, panting, and asking ‘But who has won?’
This question the Dodo could not answer without a great deal of thought, and it stood for a long time with one finger pressed upon his forehead (the position in which you usually see Shakespeare, in pictures of him), while the rest waited in silence. At last the Dodo said ‘Everybody has won and all must have prizes.’

It’s not about ITIL being better than ISO20K, or CobiT whacking MOF around the ears. The message is making practical and optimal use of common sense and proven good, better and best practices. Depending on whether you’re able to work with a highly flexible framework or you need answers right here and right now, one solution may suit your organization better than others. The standard gives you clarity (what to do); the frameworks and methods provide you with substance (how to do it).

Personally I believe that there’s a very bright future for the ISO/IEC 20000 international standard for IT Service Management, and ignoring it and not joining the Queen-of-Hearts race could well put you behind the eight ball and cause irreversible or long term damage.

Frameworks, methods and standards are not the divine destination; it’s all the experiences you encounter on your journey implementing and using them that shape and form you as an individual or organization. Look back – take a lessons learned – and move forward.

Live long and prosper

Nanoo... Nanoo...

IsleBeeBach

ITIL: Rise and Fall of the ITILian Empire!

Rise and Fall of the ITILian Empire!

Prologue

As distance education lecturer I have strong opinions on and a passion for the current status and role of [IT] service management, and believe that [IT] service management is finally getting on the right track. Although I may seem a bit cynical and pessimistic at times – this is all done as part of the play and message that I’m trying to convey in this specific article. It’s not all rosebuds and sunshine, and balance needs to be maintained at all costs.

Aiming for something

Interesting title to start with huh! Hopefully it got some of your attention. I’ve never been much of a formal author, and my Dutch roots make me quite blunt, direct and to the point. This article has one objective and one objective only. It addresses the current status of the ITIL framework within the larger space I personally refer to as the [IT] service management domain, where even IT has – over the last couple of years – become an increasingly more optional parameter.

ITSM evangelism

For those who happen to know me as an [IT]SM trainer, instructor or lecturer, courseware developer, innovator, or even animator – whatever title you may want to throw at me – you may also know me as a bit of an [IT] service management evangelist. Yes, I do preach [IT] service management (please note the consistent placement of IT between square brackets), but lately have stopped preaching ITIL as the answer and/or solution to all your problems (yeah – I know – I should say challenges nowadays), as I have come to realise, ITIL was never intended to be a solution for any problem be it large or small. I admit – even I (it hurts saying this) was to some degree a bit brainwashed by a number of my previous employers – who in the end were making a lot of hard cash out of this ITIL thing that in reality no-one really ever got a full grip on.

Changing times

I guess we’ve all moved on – times change – practices change, but has ITIL itself really changed that much? Well, my honest answer is yes and no. I’ve never been a star in making up my own mind – I enjoy the surreal, mystery, suspense, and open-endings way too much. I can almost see your face, hear your thoughts and feel your frustration: “That’s another crappy consultancy answer!” Okay, so now I feel obliged to give you a creative and of course mostly dualistic answer.

ITIL v1

Sure, ITIL has evolved. We’ve seen the birth of ITIL v1 – where we were literally suffocating under an ever increasing mountain of loosely connected ‘booklets’ describing some loosely connected [IT] service management related processes in a for the time being (late 80s) somewhat “structured chaotic” way. It’s a painful process trying to memorise even the outlines of what that ITIL thing actually looked, smelled and felt like. I just want to erase it from those grey and scarce memory cells, but at the same time still miss its many very useful – though not so colourful – templates. Surely you must have to admit that those SLA and DR-plan templates took the world by surprise, and I didn’t even mention the variety of, for example, availability management related formulas. Whatever happened to those?

ITIL v2

ITIL v1’s long overdue ‘somewhat mentally instable’ sibling was given a rather painful and long birth some 10 years down the track (late 90s) and somehow received the not so creative title of ITIL v2. This version basically “seemingly randomly” clustered some processes together at an operational, tactical, strategic, implementation and infrastructural level. Terminology and definitions – as used within v2 - were mostly clear, transparent and comprehensible for even those with an IQ of below super-extravagant-more-than-intelligent-genius. The ITIL Creators known as OGC (please observe the subtle use of the capital C) somehow managed to reduce the ITI Library (sorry, you really can’t say ITIL Library) from a whopping 42 books (surely 42 must be the only true-and-right answer as it also happens to be the answer to life, the Universe and everything else) to a meagre 9 (bye-bye good old templates). Unfortunately 99.9% of the training organisations out there really only focused on 2 of the 9 volumes, which quickly became known as the blue and red books.

Lucy in the Sky with Diamonds

By the time the spirit (mindset) of ITIL v2 had become ‘finally really’ popular, adopted, embedded, and seriously being considered and implemented – although I most definitely don’t believe there’s such a thing as “implementing ITIL” – by many small, medium and large enterprises – who had astronomical buckets with money being thrown at these so called ITIL implementations – some [not so] bright spirit went like: “let’s ‘improve’ ITIL v2!” I sincerely still believe that person was enjoying his/her life in a coffee-shop in Amsterdam watching pink elephants dance on the Beatle’s tune of “Lucy in the sky with Diamonds.”

ITIL v3

Anyway – ITIL v3 came out screaming and kicking at a weight of approximately 10 pounds bare somewhere in July 2007 (late 00s). In a nutshell OGC had managed to shred another 4 books, but somehow managed to create 5 ‘new’ tightly glued and integrated “service lifecycle” volumes. These volumes are so deeply interwoven and intertwined that probably only the big person in the sky knows the answer to the question: “Why weren’t these five volumes published as a single fully consistent, error-free and properly edited volume?” Surely OGC could and should have learned some lessons from publications like PMBOK (4th edition has 42 processes), CobiT and other academic – more consistently and better structured – publications. The amount of redundancy in ITIL v3 is still shocking, unnecessary, confusing, and a waste of CO2 absorbing and O2 producing (most likely Amazon growing) trees.

Curiouser and curiouser!

Please don’t get me wrong here - the ITIL v3 service lifecycle model is a fantastic – I repeat absolutely fantastic concept. However, we as an eagerly anticipating audience – with extremely high expectations set – are following a silent “dubbed” movie that describes an IT service from cradle to grave in a whopping 5 cinematographic colours. No seriously – I do like ITIL v3 – but I don’t understand why these volumes had to steer away from explaining good (or best) practices in a language we all speak and understand. Surely a process “is the related stuff we do to achieve things”, and not “a closed-loop system that provides change and transformation towards a goal and utilises feedback for self-reinforcing and self-corrective action.” Get a life, and start to speak a normal language! The authors didn’t even bother to keep the definitions as used in the text the same as the definitions as provided in the glossary. As Alice would say: “Curiouser and curiouser!”

ITIL e

So, has ITIL changed? Yes, but not everything has improved as much as it could have, and some things have even moved slightly backwards. It’s the latter that I personally dislike about ITIL v3, as they should not have happened and could have been avoided. In my opinion the optimal useful ITIL framework is version e (approximately 2.71828) – that floats in the twilight zone (teedee-deedee-teedeedeedee) between versions 2 and 3, complemented with all those templates and skeletons as provided in version 1.

The missing jig-saw pieces

All that said, even ITIL e (or call it eITIL) won’t be able to give you a full solution to your IT service management problem(s). ITIL roughly explains IT processes and their activities and how they can be implemented. It’s in my humble opinion still not very strong in covering the why, the what, and the who, or how to measure and be compliant with today’s standards like ISO/IEC 20000 and ISO/IEC 38500. Furthermore it only touches upon programme management, project management and most importantly the people aspect of it all – including potential cultural and structural changes that are typically unavoidable when moving into full process-based space, which may end up having even more dimensions than string theory itself – I guess 11¾ dimensions will do just fine. Furthermore the chapters on how to actually implement [IT] service management good practices have typically been reduced to a couple of pages, and aren’t most organisations really deeply interested in this specific topic?

Filling the gaps

It seems that more and more predominantly academic institutions are jumping on the much wider [IT] service management wagon, and are finally starting to fill the educational gaps that the public training organisations have not, either due to a lack of resources or capabilities, or due to pure financial reasons. Observing the job market there’s a clear trend identifiable of an increasing number of organisations searching for [IT] service management (ITSM) related capabilities, and a steadily declining number of them looking for specifically ITIL related resources and capabilities. To me this makes perfect sense, as we’re talking providing optimal services with minimal resources here. It’s not about ITIL, it’s never been about ITIL – it’s about managing services and providing optimal value to our dearly beloved customers! ITIL is “set of practical and proven practices” that are meant to support achieving an organisation’s objectives. It’s a means to an end, but somehow was elevated to something of deity-like scale and proportions.

Creative intelligence

We can use ITIL (v1/)/v2/v3 to put some process structure in place (so at least we know what we’re doing and can repeat it as well), and we can use ISO/IEC 20000 to make sure we’ve got the right processes in place and we’re sticking to them. We can also use IT Governance (CobiT) to get some proper control objectives in place, so we can actually measure some (the most critical elements) of our process performance, and we use ISO/IEC 38500 as the standard to do it right! We can use a bit of Prince2 and PMBOK to get some highly needed project management structure in place, and surround them with a bit of a programme management envelope. We can use 6-Sigma to make sense of our measurements to determine whether or not deviations are really deviations, or “naturally occurring exceptions” within defined boundaries. We can also use the balanced scorecard to map our performance against logically divided business domains, and ensure we actually get proper supporting functions like QA, HR, marketing, and finance in place. We can do lots of things, but in the end we can’t really ignore any of the domains described above, and that includes the service management domain. We need to use our creative minds and decide which pieces we’re going to use and how they will optimally connect with each other.

One ring to rule them all

Having said all of the above – there’s no such thing as one solution, one framework, or for that matters, one ring to rule them all. A highly dynamic balance needs to be carefully, intelligently and creatively planned, then constructed, maintained, continuously monitored and adapted. It needs to consists of many of the elements of the above mentioned standards, frameworks, methods, principles, mindsets, and approaches, and it all needs to be supported by a highly energetic cultural change programme where people are always first priority.

A never-ending story

So, ITIL is not the bible, it’s a single chapter of a dynamic volume that’s still being written as we speak, and unfortunately will never ever be finished. Only continuous well targeted and focused education – I’m not talking computer based training here – may give you and your organisation a head start and some knowledge of the chapters yet to be written, or rewritten.

CANESMEAC

I believe the answer is continuous and never ending service management education and commitment – that roughly translates into something like CANESMEAC. I like CANESMEAC as it sounds like a not too distant alien inhabited planet from a Star Trek original-series episode, hence live long and prosper (Star Trek).... nanoo nanoo.... (Mork and Mindy) and IsleBeeBach (Terminator).

Epilogue

If you’re like me, and you’ve been reading mostly between the lines trying to pick up the subliminal message, then hopefully you’ve come to the following conclusion. ITIL is still incredibly important and its empire is as solid as ever. However many new civilisations from far and distant countries and cultures are expanding the empire at an exponential rate. The empire has grown too big to explore without a map, and many unexplored bridges and tunnels still are demanding to be charted. It’s continuous education that allows you to peek over the shoulders of those creating the maps, and who knows – maybe one day – you may decide to become a map creator yourself and go where no one has gone before.

Finally, empires are known throughout history to be overthrown by friendly guests and neighbors without any signs of warning. Frameworks like CobiT, MOF, USMBOK and many others are lurking in dark corners waiting for their chance to take a seat on the [IT]SM throne, because in the end there can only be one dominating best practices framework, otherwise it wouldn't be the best anymore.

Live long and prosper

Nanoo... Nanoo...

IsleBeeBach