Implementing IT Processes
Lionel Pilorget Implementing IT Processes The Main 17 IT Processes and Directions for a Successful Implementation
Lionel Pilorget Basel, Switzerland ISBN 978-3-658-04772-6 DOI 10.1007/978-3-658-04773-3 ISBN 978-3-658-04773-3 (ebook) Library of Congress Control Number: 2014958898 Springer Vieweg Springer Fachmedien Wiesbaden 2015 This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilm or in any other way, and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the German Copyright Law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer. Violations are liable to prosecution under the German Copyright Law. The use of general descriptive names, registered names, trademarks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use. Printed on acid-free paper Springer is part of Springer Science+Business Media (www.springer.com)
Preface The use of modern information technologies has become so pervasive in today s society that we no longer perceive it as a novelty. It s simply there, continuously within reach as we navigate our world, inform ourselves about our current circumstances, and conduct our business transactions. While the use of information technologies has also become overwhelmingly important to enterprises as they strive to automate their processes and achieve ever higher degrees of efficiency, the accelerated development and the growing diversity of these technologies represent a growing challenge. Enterprises repeatedly find themselves struggling to make major IT investments with no guarantee that the implemented solutions will really deliver the expected advantages. This is why IT is often an uncomfortable subject and why those responsible for it are most of the time under pressure. Owing to the strategic significance of information technologies, it is important to establish a well-functioning IT organization. The crucial first step towards this goal is to introduce greater transparency by carefully defining the IT processes that are necessary for the enterprise. This, however, is naturally easier said than done. What IT processes are currently in use? Where does each one begin and end? What are the relationships between the various processes? Difficulties in obtaining answers to these questions often end in discouragement and decisions to postpone the matter. It is precisely at this juncture that the process model featured in the present book is meant to help. The model offers a convenient framework that is based on systematic analyses and years of practical experience. The origin of the model is actually a bottom-up approach to the development of standard IT processes that is then converted at the end to a top-down approach. Seventeen core IT processes are carefully defined and the numerous dependencies between the various process areas are illuminated. Visualizations of the processes and dependencies as well as clear information structures are used to minimize the resulting complexity. It would be naïve, however, to assume that the mere representation of IT processes will be enough to solve all of an enterprise s IT problems. Other factors such as a heightened awareness of the processes on the part of employees and a commitment to process implementation are also keys to success. Furthermore, improvements will not happen overnight. Indeed, it may take a number of years before enterprises begin to reap the full rewards of v
vi Preface the standardized processes. Nonetheless, nurturing the right enterprise culture and instilling certain process principles in the minds of the many stakeholders will help to guarantee an IT organization s capacity to make the valuable contribution it is expected to make. In other words, enterprises will wind up with the IT they deserve, either a source of perpetual complaint or a strategic instrument that propels the enterprise forward. Lionel Pilorget
List of Abbreviations BCM BCP BIA BMC BSC BSI B2B CAB CFO CIO CIP CO COBIT CONFIG CPU CRM CSV DC DEV DWH ECAB ERP FIN FTE GB GPS HP HR ICA ICS ICT Business Continuity Management Business Continuity Planning Business Impact Analysis Software manufacturer founded by Scott Boulett, John Moores, and Dan Cloer Balanced Scorecard German Federal Office for Information Security Business-to-Business Change Advisory Board Chief Financial Officer Chief Information Officer Continuous Improvement Process Controlling Control Objectives for Information and Related Technology Configuration Central Processing Unit Customer Relationship Management Computer System Validation Data Center Development Data-Warehouse Emergency Change Advisory Board Enterprise Resource Planning Finance Full-Time Equivalent Gigabit Global PositioningSystem Hewlett-Packard Human Resources Internal Cost Allocation Internal Control System Information Communication Technology vii
viii IM ISO IT ITGS ITSM KPI LAN LIMS LoC MGMT NAS OLA OS PCS PDCA RA RCB RfC ROI ROM SAN SAP SL SLA SLO SLS SM SPOC STC SW SWOT TOP UAT UC UPS USD List of Abbreviations Information Manager International Organization for Standardization Information Technology IT Grundschutz (term used by the German Federal Office for IT Security to describe a standard level of IT protection) Information Technology Service Management Key Performance Indicator Local Area Network Laboratory Information Management System Lines of Code Management Network Attached Storage Operational Level Agreement Operating System Process Control System Plan-Do-Check-Act Risk Analysis Release Control Board Request for Change Return on Investment Rough Order of Magnitude Storage Area Network System Analysis and Program Development Service Level Service Level Agreement Service Level Objective Service Level Specification Senior Management Single Point of Contact Steering Committee Software Strengths Weaknesses Opportunities Threats Technical Operation Procedure User Acceptance Test Underpinning Contract Uninterruptible Power Supply US Dollar
Contents List of figures... xi List of Tables...xiii 1 Introduction... 1 Part I Introduction of IT Process Modeling 2 Presentation of the IT Process Map... 9 3 Process Dependencies... 21 4 IT Governance and Process Roles... 29 Part II Description of the Individual IT Processes 5 Functional Group: Strategic Decision Making... 51 6 Functional Group: Planning and Controlling... 73 7 Functional Group: Account Management... 93 8 Functional Group: Implementation of Changes...107 9 Functional Group: IT Operation and Configuration Management...129 10 Functional Group: Supply Management...139 11 Functional Group: IT Support...145 ix
x Contents Part III Implementation of the Model 12 Introduction of Standard IT Processes...159 13 Process Performance Indicators and Reporting...177 14 Evaluation of Process Maturity...199 15 Conclusion...215 A) IT Management Standards...217 B) COBIT 4.0...221 Glossary...231 Further Reading...237
List of figures Fig. 2.1 The role of the IT organization... 9 Fig. 2.2 The IT process map... 11 Fig. 2.3 Basic process dependency... 13 Fig. 2.4 Different ways of activating process... 14 Fig. 2.5 Interfaces between enterprise levels and IT organization... 15 Fig. 2.6 Preparing for a project to implement standard IT processes... 17 Fig. 3.1 Overview of process integration... 23 Fig. 3.2 Process dependencies at the strategic level... 24 Fig. 3.3 Process dependencies at the tactical level... 25 Fig. 3.4 Process dependencies at the operational level... 26 Fig. 4.1 General organizational model... 30 Fig. 4.2 General model of IT organization... 30 Fig. 4.3 Business process roles... 31 Fig. 4.4 IT process roles... 32 Fig. 4.5 Business & IT process roles... 46 Fig. 4.6 Main IT roles... 48 Fig. 5.1 Description of P01 IT Strategy... 54 Fig. 5.2 Description of P02 HR Management... 57 Fig. 5.3 Representation of IT architecture... 58 Fig. 5.4 Description of P03 IT Standards & Architecture... 60 Fig. 5.5 IT Financial management as a key process... 61 Fig. 5.6 Description of P04 IT Financial Management... 63 Fig. 5.7 Description of P05 IT Quality Management... 66 Fig. 5.8 Process dependencies in strategic decision-making... 67 Fig. 6.1 Project portfolio management process... 74 Fig. 6.2 IT project portfolio matrix... 76 Fig. 6.3 Description of P06 IT Project Portfolio Management... 79 Fig. 6.4 Description of P07 Capacity and Availability Management... 82 Fig. 6.5 The continuity management process... 84 Fig. 6.6 Description of P08 Continuity Management... 88 Fig. 6.7 Process dependencies in planning and controlling... 89 xi
xii List of figures Fig. 7.1 Description of P09 Service Management... 99 Fig. 7.2 Description of P10 Requirements Management...102 Fig. 7.3 Process dependencies in Account Management...103 Fig. 8.1 Project development...108 Fig. 8.2 Standard project organization...109 Fig. 8.3 Standard project phases...110 Fig. 8.4 Description of P11 IT Project Management...116 Fig. 8.5 Release sequence...118 Fig. 8.6 Testing types...119 Fig. 8.7 Description of P12 Release Management...121 Fig. 8.8 Description of P13 Application Development...124 Fig. 8.9 Process dependencies in implementation of changes...125 Fig. 8.10 Project management dependencies...127 Fig. 9.1 Description of P14 IT Operation and Configuration Management..133 Fig. 9.2 Process dependencies in IT operation and configuration...134 Fig. 10.1 Description of P15 IT Supplier Management...142 Fig. 10.2 Process dependencies in supplier management...143 Fig. 11.1 Description of P16 Incident Management...149 Fig. 11.2 Problem management (ABB Group)...151 Fig. 11.3 Description of P17 Problem Management...153 Fig. 11.4 Process dependencies in IT support...154 Fig. 12.1 Procedure for introducing standard IT processes...161 Fig. 12.2 IT process introduction plan...163 Fig. 12.3 Motivational factors...165 Fig. 12.4 Employee concerns associated with change...166 Fig. 13.1 BSC model for IT organizations...182 Fig. 13.2 Reporting model...192 Fig. 13.3 Reporting of time taken to complete tasks...193 Fig. 14.1 Levels of process maturity...205 Fig. 14.2 Evaluation of process maturity...213
List of Tables Table 2.1 Factors that influence the selection of standard IT processes... 18 Table 2.2 Benefits of a project to implement standard IT processes... 20 Table 3.1 IT process dependencies... 22 Table 4.1 Process roles for senior management... 38 Table 4.2 Process roles for middle management... 41 Table 4.3 Process roles for employees... 44 Table 5.1 Main activities in P01 IT Strategy... 52 Table 5.2 Roles for P01 IT Strategy... 53 Table 5.3 Main activities in P02 HR Management... 55 Table 5.4 Roles for P02 HR Management... 56 Table 5.5 Main activities in P03 IT Standards & Architecture... 59 Table 5.6 Roles for P03 IT Standards & Architecture... 59 Table 5.7 Main activities in P04 IT Financial Management... 61 Table 5.8 Roles for P04 IT Financial Management... 62 Table 5.9 Main activities in P05 IT quality management... 64 Table 5.10 Roles for P05 IT Quality Management... 65 Table 6.1 Examples of critical success factors for IT projects... 77 Table 6.2 Main activities in P06 IT Project Portfolio Management... 77 Table 6.3 Roles for P06 IT Project Portfolio Management... 78 Table 6.4 Main activities in P07 Capacity and Availability Management... 80 Table 6.5 Roles for P07 Capacity and Availability Management... 81 Table 6.6 Main activities in P08 Continuity Management... 85 Table 6.7 Roles for P08 Continuity Management... 87 Table 7.1 Definition of service times... 95 Table 7.2 Response times according to application criticality... 95 Table 7.3 SLO definition parameters... 96 Table 7.4 SLO examples... 96 Table 7.5 Main activities in P09 Service Management... 97 Table 7.6 Roles for P09 Service Management... 98 Table 7.7 Main activities in P10 Requirements Management...100 Table 7.8 Roles for P10 Requirements Management...101 xiii
xiv List of Tables Table 8.1 Main activities in P11 IT Project Management...114 Table 8.2 Roles for P11 IT Project Management...115 Table 8.3 Main activities in P12 Release Management...117 Table 8.4 Roles for P12 Release Management...120 Table 8.5 Main activities in P13 Application Development...122 Table 8.6 Roles for P13 Application Development...123 Table 8.7 Release management versus project management...128 Table 9.1 Main activities in P14 IT Operation & Configuration Process...130 Table 9.2 Roles for P14 IT Operation and Configuration...131 Table 9.3 Tasks handled by the service manager and system owner...132 Table 10.1 Main activities in P15 IT Supplier Management...140 Table 10.2 Roles for P15 IT Supplier Management...141 Table 11.1 Main activities in P16 Incident Management...148 Table 11.2 Roles for P16 Incident Management...148 Table 11.3 Main activities in P17 Problem management...151 Table 11.4 Roles for P17 Problem management...152 Table 12.1 Selection criteria for tools used to support IT processes...169 Table 13.1 List of useful key performance indicators (KPIs)...178 Table 13.2 Details on where the measurements take place...183 Table 13.3 Key process performance indicators in the annual IT report...195 Table 13.4 Key process performance indicators in the quarterly IT report...196 Table 13.5 Key process performance indicators in the monthly IT report...197 Table 14.1 COBIT PO processes and Standard IT Processes...200 Table 14.2 COBIT AI processes and Standard IT Processes...201 Table 14.3 COBIT DS Processes and Standard IT Processes...202 Table 14.4 COBIT ME processes and Standard IT Processes...202 Table 14.5 COBIT Light and Standard IT Processes...203 Table 14.6 Process maturity model...209 Table 14.7 Process audit results...210 Table 14.8 Criticality card for IT processes...211 Table 14.9 Identifying maturity gaps in IT processes...212