The IT Skeptic - Comments for "COBIT rivals ITIL"

TIPA (ITSM SPICE) is ISO/IEC 15504 Assessment for ITIL

John Clipp — Wed, 24 Aug 2011 17:56:09 +0000

I have read, with interest, the thread on using ISO/IEC 15504 as the Assessment Model for ITIL and/or ISO/IEC 20000. This Model has existed for a while now, in the form of TIPA (Tudor IT Process Assessment).

TIPA is an internationally-recognized framework that uses the principles of the ISO/IEC 15504 standard for IT process assessment within an organization. The framework offers a turnkey solution to determine the maturity levels of IT processes that are aligned with IT best practices such as ITIL, and enables process improvements.

TIPA is the result of over seven years of research by a team of international researchers who also worked on the development and review of both the ISO/IEC 15504 (Process Assessment) and the ISO/IEC 20000 (ITSM Quality Standard).

The TIPA initiative began in 2003 when a research project was defined in order to develop a framework for assessing IT Service Management (ITSM) processes. The issues that organizations were facing while improving their ITSM processes, such as the need for an objective and repeatable approach for assessing processes and a well-structured improvement path to follow, paved the foundation of the initiative.

From the year 2003, the ISO/IEC 15504 has been revised as a generic process assessment standard. It was then possible to assess any kind of process, in any company whatever their core business area. At the same time the IT Infrastructure Library (ITIL®) de facto standard was developing quickly in Europe. The combined use of both of these standards became Tudor's research objective, and the idea of a Tudor IT Process Assessment (TIPA) framework was born.

TIPA has been used extensively in Europe and is now making it's introduction into the U.S.

John Clipp
TechnoLava LLC
john@technolava.com

If you thought ITIL was expensive try ISO15504

skeptic — Thu, 04 Sep 2008 21:47:08 +0000

Hell's bells! If you thought ITIL was expensive...
ISO 15504 (a.k.a. SPICE, Software Process Improvement and Capability dEtermination) has 6 parts. The 7th is currently in Final Draft Standard form. Part 8 is coming.

1: Concepts and vocabulary
2: Performing an Assessment
3: Guidance on performing an assessment
4: Guidance on use for process improvement and process capability determination
5: An exemplar Process Assessment Model
6: An exemplar system life cycle Process Assessment Model
7: Assessment of Organizational Maturity

5 are on Amazon:

Strewth.

Practical Experience

ITIL citizen — Thu, 04 Sep 2008 14:58:28 +0000

Get dirty is great advice. After working as an ITIL consultant for some years I often felt I was on a bit of a high horse telling IT employees how to run their departments.

I decided to actually take a role where I actually worked in IT to try to walk a mile in their shoes.

Funny thing, less than 2 years later, my job disappeared because of a Service Transformation / ITIL implementation.

From a people perspective, my observation is that ITIL sends the IT cowboys on their way, and will download a lot of work on to the IT worker.

Also, an ITIL implementation can promise a renewal for an IT department which has made some huge project failures.

ISO/IEC 15504 is probably

Visitor — Thu, 04 Sep 2008 14:15:45 +0000

ISO/IEC 15504 is probably one the best publicly-available exemplars. It has shown interesting evidence of its predictive validity for organizations over 50 staff. However, the evidence doesn’t show a similar suitability for smaller organizations.

Its roots are in software process assessments and it shows. It shares a common set of problems, some of which have been mentioned, but which are primarily based with the hazards of idealized end-states and artificially derived practices. These types of PAMs emphasize statistical process control methods--an approach that has been called into question.

There is a move afoot in many channels to develop alternative approaches but it will take time. There is a recognized need, for example, for assessments to be closely tailored to the company’s overall strategy. Do the imperatives require IT to support speed and entrepreneurship, as seen in some firms, or high degrees of collaboration and partnership, as seen in others? Without well considered linkages--not just a checklist--it’s tough to get executive sponsorship for the assessed recommendations, leading to low priority and inadequate funding/resources.

An alternative approach, for example, is performing assessments though a participative approach: tailored to the goals and needs of the individual organization, not benchmarked against a synthetic model of best practices. The Scandinavians (i.e., SINTEF) are quite active on developing this approach.

That said, you could do much worse than ISO/IEC 15504. It is worth close study.

Is 15504 a good road?

John Worthington aka MySvcMon — Thu, 04 Sep 2008 13:02:00 +0000

I thought ISO 15504 provided an exemplar, and that this was the basis for others to develop PAMs specific to a process or process framework (like ISO 20K?). I admittedly am still learning about ISO 15504, but I thought that it clearly indicates that you need to balance the gaps in process capabilities and attributes against business objectives. It does not say 'process for process sake'.

CobiT seems to be all over linking IT to the business, and the ITIL (or ISO 20K) processes seem to provide the process framework against which an 'agreed' PAM could be established. My thought was that having an ISO 15504 based PAM for ITIL would be a great way to get some consistency in evaluating ITIL implementations. Proprietary assessments may lead to a fox in the hen-house kinda thing, ya' know?

It might also enable some research to determine just how much process benefits service delivery for that matter.

The more I learn about ISO 15504 the more I'm drawn to it's potential, but I'd be happy to know if I'm lost in space. I've been reading Han van Loon's book(s) for now, and may eventually break down and buy the standard.

It just seems to me that ISO 15504 would (might?) bridle some of the enthusiasm over various frameworks and force some consistency across customers and suppliers. While any PAM would take hits, having the framework providers 'bless' the assessment model would be a pretty good starting point.

So I'm on the road to 15504 for now. Is it worth the trip?

John M. Worthington
MyServiceMonitor, LLC

[Link added by the Skeptic:]

what the post-modernists will d

skeptic — Thu, 04 Sep 2008 06:42:58 +0000

I've always touted one of the benefits of ITIL V2 is that it actually defines the interations (and demarcations) between processes, but you are quite right: they are too often taken in isolation. We're on the same page (as usual). I guess my concern is not that you are being post-modernist but more what the post-modernists will do with these ideas. "process doesn't matter", "any approach has to be seen as valid", "it's not what you do, it is what the service feels like", "the service has to WANT to change" ...

Define good

Visitor — Thu, 04 Sep 2008 05:01:53 +0000

I don't propose to abandon process; I continue to see it as a vital capability. My concern is when process is taken in isolation, without context, without linkages to the greater goals of the organization.

The experiences of ITILv2 showed that maximizing the performance of processes is invariably confused with maximizing the performance of the overall organization. Optimizing each process independently, in general, will not lead to an increased optimization for the overall organization.

Worse, ignoring the interactions between processes more often impedes organizational goals (another factor frequently ignored by PAMs).

There have been many learnings over the last decade. My humble suggestion is this: we don't repeat the same mistakes. If this is post-modernism, then I am guilty.

good service requires good process

skeptic — Thu, 04 Sep 2008 04:06:00 +0000

I wouldn't presume to correct you :-D

And I was the confused one, sorry; yes i somehow segued from generic PAM to ITIL assessment. PHP coding fries my brains.

Wholeheartedly agree that process can be overdone and there isn't a fixed link with service capability. nevertheless this is funky modern thinking. ITIL V2 was all about process. letting go of process as the foundation is a big step for many organisations. I would also put it to you that "funky" = "immature", and abandoning process as a discipline is akin to many other post-modernist rejections of fundamentals (and common sense) that have ended in tears (or will).

I'm the first to say process needs to be done with restraint, and I point to my CoPr and SM4SME work to support that.

But I don't intend to throw the baby out with the bathwater. i'm old-fashioned enough to believe that good service requires good process at appropriate maturity levels and investment levels.

And that process maturity can be measured. i'm more interested in what is pragmatically useful in the trenches than what is idealogically correct or compliant with the theory du jour.

I apologize. I thought you

Visitor — Thu, 04 Sep 2008 03:42:43 +0000

I apologize. I thought you were referring to a PAM acting as an exemplar, a model of excellence independent of the process implementations it measures; something akin to SCE or ISO/IEC 15504, rather than an ITIL compliance model.

Forgetting for the moment that ITIL is not positioned as a process framework (except, perhaps, by that same user base), an ITILv3 PAM should not duplicate known shortcomings. For example, there is no universal agreement that the maturity/capability of a process corresponds to the maturity/capability of, say, service delivery. To what extent should IT staff focus on the management of services vs. the attributes of the processes used to manage those services?

Mature IT services can be delivered with little process and poor service delivery has been designed under the guidance of mature/capable processes. For smaller organizations, the burden of heavy process structures far exceeds the benefits, regardless of the assessment of most PAMs. Heck, there are billion dollar organizations who've correctly reached the same conclusion.

Perhaps I missed it but I haven't found this addressed in Cobit. Feel free to correct me.

ad nauseum

skeptic — Wed, 03 Sep 2008 22:51:00 +0000

Sorry I've heard this argument ad nauseum that a framework for ITIL assessment is either

too hard
imperfect
a moving target
not necessary because we have ISO20000 etc...
available at a special price for you my friend from MegaBucks Consulting Inc or free with your MegaBucks CMDB

I'm not buying it for the simple reason that the user base is not buying it. People want ITIL and they want to know if they are doing ITIL and they want to know if their supplier is doing ITIL or if their megabucks consulting firm is giving them ITIL.

I think ducking the issue just shows that Castle ITIL is more focused on producing a product than meeting the needs of the users - the very attitude and behaviour that ITSM is supposed to fix.

Funny that it wasn't too hard for COBIT.

I’d be curious as to what

Visitor — Wed, 03 Sep 2008 21:29:03 +0000

I’d be curious as to what you come up with.

I suspect ITILv3 kept out of the PAM game for very good reasons. Much like the “definition of process”, process assessments (i.e. process capability models) are another area under flux. There are many available if needed: ISO, proprietary and open. ITIL shouldn’t have invented another.

Most of the models, however, are derivations from CMMI, Bootstrap, Trillium and the like. Such PAMs have shown themselves to be either woefully inadequate or deeply flawed.

I’d welcome any real breakthroughs.

Process Assessment Model for ITIL V3

skeptic — Wed, 03 Sep 2008 19:07:33 +0000

What if we built our own PAM here?

The IT Skeptic and the Raroa Coding Gnome have been busy. Wait a couple of days....

The corner office

Red Pineapple — Wed, 03 Sep 2008 18:03:14 +0000

That is right. Not many CIOs can eyeball the troops from their desk in the corner office.

Where Are We Now?

John Worthington aka MySvcMon — Wed, 03 Sep 2008 12:32:31 +0000

One of the questions the CSI Model asks is "Where Are We Now?" In ITIL v2 at least we had a self-assessment questionnaire to help answer that question. Version 3 leaves that question painfully unanswered (or, worse, answered any way you want).

Your comment, "it has the components that ITIL lacks such as prescriptive criteria for assessment but I think it is as loosely aligned to ISO20000 as ITIL is (comment anyone?) hit a nerve with me.

I can't seem to find out when we will see Part 8 of ISO/IEC 15504, which is a Process Assessment Model (PAM) based on an ITSM Process Reference Model (PRM or framework - in this case ISO 20K).

From what I have heard it may be 2 years away. TWO YEARS AWAY?! And that's based on ISO 20K (not ITIL v3). Perhaps it is up to the marketplace to establish a PAM for ITIL v3? I'd like to know how we'd get that "blessed" by ITIL if that's the case.

This leaves plenty of wiggle room for assessment in the meantime, which I don't think is a good thing....for ITIL or anybody. Standards-based assessment against these frameworks would be a very, very good thing.

Until that happens, You Are Wherever You Say You Are.

John M. Worthington
MyServiceMonitor, LLC

Already better than some...

JamesFinister — Wed, 03 Sep 2008 08:49:38 +0000

If you could sit in one place and see those people at the same time then you are already in a better IT department than most. For all the metaphorical talk of silos I'm suprised how many IT departments are still located in building(s) where the office layout and design encourages silo thinking rather than communication and cross team working.

Interesting option

avallesalas — Tue, 02 Sep 2008 22:23:54 +0000

I would like to get dirty in this way... but I wouldn't draw the circle in the datacenter, as this is where technology lives... and ITIL is more about people than about technology. I would like to draw the circle in the middle of the IT department, just between the tables of the development team and the operations team, near the CIO desk and close to the helpdesk... and wait. Just close your eyes and concentrate on the conversations.

In a few hours you can hace more than ten improvements coming fromo your direct observations. I bet.

Antonio

All in good time...

skeptic — Tue, 02 Sep 2008 09:28:00 +0000

yes I noticed that the other day and it made me smile.

I think ITGI and ISACA are exceedingly polite, given the brash upstart that is currently posturing all over their front lawn as if it owned the place.

In their own genteel way I think they are getting quietly even, what with the mapping paper and now the Service Managers guide. All in good time... ITIL will be put firmly (but politely) back in its place any year now.

Not read Cobit...?

Seppo — Tue, 02 Sep 2008 08:41:31 +0000

Skep,

ISACA itself says in the Cobit-ITIL mapping document, that "Cobit defines the what, and ITIL provides the how".

Are you suggesting that ISACA haven't read Cobit? No, it must be that they are very polite. And that is not a bad thing on that level.

Regards,

seppo

The smell of ITIL

JamesFinister — Thu, 14 Aug 2008 19:12:28 +0000

Both Lean and Six sigma have their place, but like anything they aren't a panacea, particularly when implemented as a fad.

As for ITIL v3 - my personal jury is still out. Does v3 give me anything that makes my job easier? No. Has it introduced any new concepts I wasn't already aware of? Notn that I've noticed.

But perhaps we should see it as a work in progress, which at least encourages us to look at service management afresh. The real insights might not be in the books themselves yet, but could arise as the professionals start to use v3. I think it is fair comment that my view and understanding of v1 and v2 changed significantly as I used it more and went into it in more depth. A lot of the insight was gained from time debating with delegates on the training courses, and I worry that the changes in training will prevent that sort of debate about v3

Responding to your earlier post with the list of basic things I would look for in a data centre made me think how much of what I do myself isn't actually explicit in ITIL, perhaps because we think it is too simple, obvious and uninteresting. Sadly though it is the basics that still trip people up.

Perhaps Real ITSM is the answer ;-) I've ordered the book (actually two copies by mistake) so hopefully I'll find out soon

Now that you have brought up the subject of Toyota

Red Pineapple — Thu, 14 Aug 2008 17:40:42 +0000

Well, I suppose I did but the more I read about it the more I like it. However, the nonsense that followed it like Lean and Six Sigma is smelly pooh.
Funny, I feel the same way about ITIL v2 versus ITIL v3. I am alone in thinking that the plot has been lost in v3?