The IT Skeptic - Comments for "Risk Management - the lost process of ITIL V3"

Risk Management Discipline

ITMaturity — Mon, 16 Jun 2008 07:35:36 +0000

Microsoft has created the Risk Management Discipline in their Microsoft Operations Framework. At first it was set apart from the other functions and in their recent released version 4 it is part of the function Governance, Risk and Compliance. When you zoom in on Risk Management you'll find overlap with other functions/processes (pfff... it is difficult to stay political correct), specific problem management. When you talk about pro active problem management, you'll come into the realm of risk management. Specific when discussing possible scenario's (what can go wrong and how can we prevent this from happening?)
It the Operations Management course I've given last week, I've spend a good couple of hours on risk management. Every time I'm surprised to find that most system administrators (the course is meant for operations managers, team leaders and technical supervisors) have difficulty identifying risks in production. They can easily identify project management risks (or risks for change management), but not risks in the day-to-day running of IT services. And according to Forrester and others (I do not have the survey reports ready, so I'm now prime target for the craptoid facts) about 80% of downtime is caused by changes that are implemented hastily and untested and by administrators not following procedures or just being sloppy. I feel that spending some time on identifying risks and coming with ways to mitigate will be very useful. Also, are workarounds for incidents not some kind of contingency plans in the Risk management sense?

Paul

Oh yeah!

kengon — Sun, 15 Jun 2008 03:58:51 +0000

Cary,

Now you're talking. I've been teaching ORM for years. Thanks for introducing this into the conversation!

kengon

ORM

Cary King — Sat, 14 Jun 2008 23:48:00 +0000

Here's ORM guidance I recommend. It's the way I learned it. It works for people in the toughest of circumstances.

http://www.au.af.mil/au/awc/awcgate/usmc/orm.pdf

Cary King
Minerva Enterprises
Managing Partner
www.MinervaE.com

plenty of Risk Mgt in ITIL - you just have to see it

jvbon — Sat, 14 Jun 2008 10:17:34 +0000

It may not be ONE of these 27 'things', but it's definitely there: there's plenty of Risk Mgt in ITIL, you just have to recognize it.
In my definition, Risk Mgt is concerned with a few major activities:
- determine vulnerabilities
- identify risks
- analyze cause
- determine countermeasure
- take action
- evaluate.

If you now look at ITIL's Information Security Mgt, you'll recognize Risk Mgt. If you look at Capacity Mgt, you'll recognize it as well. Same for Availability Mgt, Continuity Mgt, or any other management function of a service quality parameter you've agreed upon in the SLA....

Of course, the functions Availability Mgt, Security Mgt, etcetera, cover more than just Risk Mgt: they also cover their Incident Mgt, Change Mgt, and the other three elementary processes of an IT organization.

you mean "itSMF-UK"

jvbon — Sat, 14 Jun 2008 09:12:22 +0000

Skep - you're generalizing too much. That booklet was the product of itSMF-UK, and they obviously follow ITIL by the book, as usual. They may still own the brand name 'itSMF' but they do not represent 'the ítSMF'. There are many others out there that now understand that there are only a few processes and many organizational functions described in ITIL - according to ITIL's own definition of 'process'. We have seen quite a few postings in your blog on that topic.
The latest itSMF publication analyses that very clearly in chapter 6.3 Functions and processes in IT management - Migrating from an ITIL reference model to a universal implementation model (see http://www.itsmbookshop.com/Media/SampleFiles/9789087531003smpl.pdf).
A must read for anyone not already infected by the belief that ITIL is a holy book.

itSMF map ITIL V3 processes

skeptic — Sat, 14 Jun 2008 05:00:33 +0000

itSMF systematically list the processes in ITIL. See page 41 of this booklet

Along with Prince2, COBIT, ASL, ISO2700n ... MoR is yet another

skeptic — Sat, 14 Jun 2008 04:55:39 +0000

They sure do. Along with Prince2, COBIT, ASL, ISO2700n ... MoR is yet another body or knowledge neither integrated nor referenced by ITIL. Great, innit?

P.S. dropping the name once in the intro of a book does not constitute referencing a BOK

Competing Frameworks?

kengon — Fri, 13 Jun 2008 14:10:03 +0000

Skep,

Are the itSMFs 27 processes a competing framework? Last I knew they didn't have one! :-0

kengon

OGC has some guidance

ITIL citizen — Fri, 13 Jun 2008 12:53:14 +0000

Surprise! Outside of ITIL, OGC does offer guidance for Managment of Risk.

You can find further information here: http://www.best-management-practice.com/Risk-Management-MoR/

InfoSec?

Red Pineapple — Fri, 13 Jun 2008 12:02:32 +0000

Maybe InfoSec should be depreciated and made a subsection of Risk management? As a process is Infosec more important than risk management?

Agree, I would't create a function in IT

Seppo Tapola — Fri, 13 Jun 2008 09:32:10 +0000

I see it a bit like Continual Service Improvement. When you look at CSI, it is very heavily dependent on the role of CSI Manager. He is the sort of torch bearer, evangelist or visionary person driving the CSI initiatives.

In same manner security and risk should be driven or promoted by someone and executed by processes and functions in various parts of the lifecycle.

Not a function in IT, in larger organizations such group or function could exist with larger scope than just IT? After all these are not just IT issues only.

---

Good point though within ITIL world: it is a requirement in the syllabus. So the students should have some understanding on the various points in the lifecycle where you should spend some effort in managing risk. Cobit would give you some additional handle on what particular actions and artifacts should result...

no centralised Risk Management function in IT

skeptic — Fri, 13 Jun 2008 08:25:49 +0000

Welcome Seppo

it's a study topic so one hopes there is some collated guidance somewhere.

I guess I agree with your points - It is not one of the itSMF's 27 processes - so long as we accept there is no centralised Risk Management function in IT. do we?

Maybe the pieces should be collected to a process...

Seppo Tapola — Fri, 13 Jun 2008 07:38:33 +0000

...or maybe not.

There are many viewpoints to risks.

There are the risks that you need to think when you are doing Service Design, there it is embedded somewhere around Availability and IT Service Continuity, as one would expect.

One should not forget the risks for the business, which I find are described in quite interesting way in Service Strategy. We IT people certainly understand that whenever you start contemplate the possibility of using IT in someway you are in big danger anyways ;-). Some good viewpoints in the green book though, written in a bit novel way. But I guess that Service Strategy really represents the point in ITIL V3, where the new IT really needs to stretch the envelope, move out from the traditional comfort zone and learn the true reasons why organizations are hiring them to play with expensive toys.

Then we have the risk in Service Operation, pretty familiar to IT people.

---

Maybe not a new process, please. In that way there would be the same danger that we have with security or quality. "It's not MY task to think of them, it's the ________ people who are managing that". So in same way that everybody is responsible for security or improving the quality, everybody should be thinking of the risks.

But it wouldn't be a bad idea to have some condensed guidance for that...

Regards,

Seppo