ITSM governance essential as new tech trends drive business processes

Building trust with designed ITSM governance

Policies, procedures, rules, contracts, service level agreements (SLAs) and technical protocols provide the discipline for any innovation to succeed. Unfortunately, with cloud migration, machine learning and artificial intelligence, a frequent challenge is that policies and procedures do not exist. That makes it very hard for the users to gain confidence that the technologies will work to the company's advantage.

Every rule, policy, procedure, protocol or SLA exists to define the necessary processes in order for technology to work, and for attendant risks to be avoided. Those are two very different outcomes. When we install governance, the substantive rules serve to discipline behavior toward consistent, intended outcomes. Reliability, consistency and resilience after untoward circumstances or events are all positive attributes for users deciding whether to place their trust in the related technologies. And as we all know, a single adverse event can offset dozens or hundreds of positive events that otherwise contributed to a level of trust.

The rules supporting new technology must anticipate, and suitably discipline, user behavior to avoid known risks -- whether threats, vulnerabilities or combinations of both. This is where conscious, intelligent design of the governance stack can be so useful at building trust. When users understand that compliance with the new rules avoids risks that endanger their company, their performance, their employment or their business relationships, the rules gain respect and adherence becomes a priority.

To succeed, professionals in charge of ITSM governance must rigorously perform their own root cause analysis even before the innovations are introduced and implement the necessary guiding documents with the technology's release. Collaboration is essential, both among the company's departments (operations, legal, audit, finance, HR, facilities) and with the related vendors that are often resistant to the need for extensive, well-designed ITSM governance. Of course, the internal costs -- both in time and money -- required for that collaboration are often overlooked or underestimated when projecting the potential costs and ROI of innovations. But ITSM professionals who do anticipate and include those expense projections are more likely to avoid unexpected, and indefensible, cost overruns.

Sustaining trust in ITSM

Sustaining trust requires additional work, but it will help realize the benefits promised by innovations in ITSM: faster speeds, lower costs, improved responsiveness, quicker remedial or corrective services. After all, any innovation has to prove it meets the promised performance goals.

But how does designing governance make that possible? First, when new rules are being authored, they should be crafted so that compliance or noncompliance can be automatically calculated. In other words, the behaviors that pass or fail need to be some actions that can be counted. This is much harder than it may seem, since the technology has to be producing event logs that hold reliable counts for the compliance calculations.

Second, the governance controls must enable enforcement, preferably by automated suspensions, diversions, embargoes or quarantines of noncompliant transactions or data assets. This step is often overlooked. If rules are authored that cannot be easily enforced, the noncompliant actors, even if acting innocently, will balance compliance against the likelihood of getting caught. Automated enforcements eliminate the calculations entirely.

Finally, there must be complete transparency. Users must know their behavior is being monitored, the types of conduct or actions that will represent compliance (and noncompliance) and the sanctions that will be imposed in enforcement. Transparency is vital to sustaining trust; users must know that the governance is working and effective.

If you are in the midst of evaluating ITSM, take a pause and try to reset the process to include the design and production of appropriate governance frameworks -- policies, procedures, protocols, handbooks, SLAs; all will become vital building blocks toward accelerating the trust with which the innovations will be adopted and respected.

If the innovations include those from third parties (vendors, service providers, cloud access security brokers, data storage services, etc.), encourage them to help evaluate your existing governance controls, identify where the innovations create gaps or conflicts, and author the suitable governance frameworks that will help assure the success and continued trustworthiness of their innovations. If those aspects are done correctly, then everyone wins.