Exploring the impacts of IT service management on the business agility index: an AHP simulation-based decision-making approach

Abstract

Business agility has been recognized as a core competitive capability in a dynamic business environment. In this context, the organizational IT capability is a co-factor for achieving and keeping business agility. IT capability has been managed through the utilization of plan-driven IT service management (ITSM) frameworks and standards such as the ITIL v3.v2011 and the ISO/IEC 20000. These implementations have produced benefits such as better IT user satisfaction level, reduction of IT services TCO, and improved understanding and communication between IT services users and IT services staff. However, the current business environment continues highly changing with the emergence and maturation of new IT technologies and IT-based business innovation approaches. Consequently, the organizational IT capability is pushed to be also agile and keep its contribution to the business agility aim. Given the novelty of agile ITSM standards and frameworks—ITIL v4 framework, VeriSM framework, and the ISO/IEC 29110-4-3 standard—, there is a knowledge gap on what they are and how they could produce an agile organizational IT capability and contribute to the business agility aim in this modern business environment. This research, thus, compares the potential impacts on a business agility index from the main plan driven and agile ITSM frameworks and standards. For this aim, we design an Analytical Hierarchical Process (AHP) decision-making model using core findings from the business agility literature and the Porter’s value chain and simulate a set of scenarios. Simulation results indicated that: (1) there were differences in the contributions from the five evaluated ITSM frameworks and standards to the business agility index; and (2) the high and very high scores produced by the two agile ITSM frameworks and standards were obtained only when other relevant agility capabilities were also achieved. Hence, this research reduces the knowledge gap and provides initial theoretical findings and insights on the impacts on business agility from the main ITSM frameworks and standards considering other relevant agility capabilities. However, empirical research is encouraged to collect confirmatory evidence.

Appendices

Appendix 1: Review of the main five ITSM frameworks and standards

ITIL v2011 framework (TSO 2012) is a suite of best practices for ITSM. This framework is not a standard to be followed step by step but guidance on processes, functions, and practices for IT service providers can govern, organize, manage and control the IT function to deliver high-quality IT services. ITIL v2011 (TSO 2012; p. 7) defines ITSM as “the implementation and management of quality IT services that meet the needs of the business”. ITIL v2011 is organized in an IT service lifecycle. An IT service lifecycle supports the notion that for delivering high-quality IT services, they must be developed through several phases, from its conception and design to its deployment, operation, and continual improvement. The IT service lifecycle in ITIL v2011 has five phases. These are Service Strategy, Service Design, Service Transition, Service Operation, and Continual Service Improvement. Service Strategy includes 5 processes (Strategy management for IT services, Service portfolio management, Financial management for IT services, Demand management, and Business relationship management). Service Design includes 8 processes (Design coordination, Service catalog management, Service level management, Availability management, Capacity management, IT service continuity management, Information security management, and Supplier management). Service Transition includes 7 processes (Transition planning and support, Change management, Service asset and configuration management, Release and deployment management, Service validation and testing, Change evaluation, and Knowledge management). Service operation includes 5 processes (Event management, Incident management, Request fulfillment, Problem management, and Access management), and 4 functions (Service desk, Technical management, IT operations management, and Application management). Continual Service Improvement includes 1 process (Seven-step improvement process). Service Strategy concerns the formulation of IT service strategic plans, the estimation and planning of IT service demands, the management of the financial activities for budgeting, accounting and charging of IT services, the management of the planned, active and retired IT services, and the management of business relationships between IT customers and the IT service provider. Service Design focuses on the transformation of new or to-be changed authorized IT services requirements into IT service design specifications that cover such requirements. For designing IT services, Service Design also addresses the design and utilization of management information systems and tools, IT architectures, and the associated design processes, methods and metrics. The particular processes of Availability, Capacity, Continuity, and Information security management are used for supporting the achievement of the IT service warranty, which is monitored through Service level management. The active IT services are managed through the Service catalog management process. Design coordination and Supplier management help to control IT service design tasks and coordinate the relationships with the IT service suppliers. Service Transition refers to the processes to assure that the IT service design can be realized in a production environment. For this aim, in this process transition plans are elaborated, changes are managed, service assets are configured, protocols for releasing and deploying IT services are elaborated, validation and testing procedures for IT services are applied, evaluations for changes are executed, and technical knowledge support is provided. Service Operations concerns with the specific processes used to support the active IT services in the production environment. These processes are used to keep IT services working through the processing of events, incidents, requests, access and problems. Finally, Continual Service Improvement provides seven steps to improve IT services. These steps are: (1) identify the strategy for improvement, (2) Define what you will measure, (3) Gather the data, (4) Process the data, (5) Analyze the information and data, (6) Present and use the information, and (7) Implement improvement.

The ISO/IEC 20000 standard (ISO/IEC 2010) was the first international standard concerning IT service management. This standard provides an integrated process approach to deliver managed IT services aligned to the business and customer requirements. Two documents—ISO/IEC 20000-1, and ISO/IEC 20000-2—were published in the 2005 year, and later in 2010 were added three technical reports—ISO/IEC TR 20000-3, ISO/IEC TR 20000-4, and ISO/IEC TR 20000-5. The ISO/IEC 20000-1:2005 standard defines the requirements to provide agreed-quality managed IT services to customers that an IT service provider must meet. The ISO/IEC 20000-2:2005 standard states a code of practice based on best practices from industry consensus to deliver the best possible IT service aligned to customer business needs within the agreed resource levels. The ISO/IEC TR 20000-3:2009 reports guidance on the scope, applicability and demonstration of conformity of the ISO/IEC 20000-1:2005 standard. The ISO/IEC TR 20000-4:2010 reports a process reference model (PRM) describing in a high-level—i.e. name, context, purpose, outcomes, and requirements traceability—the implied processes of the ISO/IEC 20000-1:2005 standard. The ISO/IEC TR 20000-5:2010 presents an exemplar 3-phased implementation plan for the ISO/IEC 20000-1:2005 standard. The ISO/IEC TR 20000-4:2010 reports six categories of processes. These are SMS general, design and transition of new or changed services, service delivery, control, resolution, and relationships processes. The category of SMS general addresses ITSM secondary processes that are required to support the primary ITSM processes. There are nine ITSM secondary processes—organizational management, SMS establishment and maintenance, management review, audit, measurement, improvement, human resources management, risk management, and information item management—. The category of design and transition of new or changed services includes four processes focused on the specification of a solution—i.e. a new design or a relevant change of an IT service—from the customer requirements. The four processes are service requirements, service design, service planning and monitoring, and service transition. The category of service delivery corresponds to processes directly linked to the provision of IT services. There are six processes. These are capacity management, service continuity and availability management, information security management, service level management, service reporting, and budgeting and accounting for services. The category of control processes aims to define and control the components of an IT service as well as maintain reliable configuration information for the new or changed IT services. This category includes three processes: configuration management, change management, and release and deployment management. The category of resolution processes focuses on the restoration of down IT services as well as on solving the root causes of the IT service interruptions. There are two processes: incident management and request fulfillment, and problem management. Finally, the category of relationships processes deals with the communication between the IT service provider and its customers, as well as with its suppliers. Consequently, this category includes the business relationships management process, and the supplier management process. This ISO/IEC 20000 standard does not report a set of roles in the SMS. An estimation of three roles per category of process results in 18 expected roles. Similarly, this standard does not report a mandatory list of artifacts. However, it proposes expected outcomes for each one of the 26 processes. An outcome can be mapped to one artifact but it is not mandatory. Similarly to roles, an estimation of five artifacts per process results in 130 expected artifacts. The two parts 1 and 2 of this standard were updated respectively in 2011 and 2012. A third update was done in 2018 and 2019 again.

The ISO/IEC 29110-4-3:2018 standard (ISO/IEC 2018a) provides the specification for the Service Delivery profile of the ISO/IEC 29110 family of standards. The ISO/IEC 29110 set targets Very Small Entities (VSEs), defined as organizations, or departments or teams from 1 up to 25 people. The ISO/IEC 29110 family of standards and technical reports address software engineering, system engineering, and service delivering processes. A profile of application refers to a set of defining characteristics for a specific target group. A complementary technical report is the ISO/IEC 29110-5-3:2018 (ISO/IEC 2018b) that provides guidelines to manage services delivered to customers in VSEs. The ISO/IEC 29110-4-3:2018 standard defines the requirements for four processes, which contain eleven activities, forty tasks, twenty-one work products, and eight roles altogether. The four processes are Governance, Service Control, Service Relationships, and Service Incident. The first Governance process pursues to establish a system to direct and control service delivery activities efficiently and effectively. The second Service Control process aims to support and control the design, building, and transition of new or changed services. The third Service Relationships process assures that documented agreements for services, valid communications, and valuable feedback maintain adequate relationships between the service provider and its customers and providers. The fourth Service Incident process aims to prevent service disruptions and restore them in the event of a service disruption. Four Governance objectives include GO.O1 define the scope of the service delivery activities and assign authority; GO.O2 implement a service delivery policy, objectives, and plan(s); GO.O3 establish a management structure; and GO.O4 report on and improve the services provided to customers. Four Governance activities are linked to the objectives, which include GO.A1 define the scope of activity and required roles; GO.A2 define and implement governance structures; GO.A3 manage resources including documentation; and GO.A4 complete reporting and improvement activities. Eight Governance work products are WP.01 business goals and objectives; WP.04 customer experience approach; WP.05 data and document management procedure; WP.06 Feedback log; WP.07 improvement report; WP.08 list of assigned roles; WP.14 service delivery policy, objectives, and plan(s); and WP.15 service delivery scope. Two Service Control objectives include CO.O1 control and manage change to services and subsequent deployments and CO.O2 secure and mitigate risks to data and information assets. Three Service Control activities include CO.A1 manage change to services; CO.A2 evaluate and build the service change; and CO.A3 test and deploy approved service change. Eight Service Control work products are WP.02 configuration record; WP.09 secure component procedure; WP.11 service change request; WP.12 Service change schedule; WP.13 Service change—built; WP.16 service design; WP.17 service design, build, test, and deployment procedure(s); and WP.20 service test report. Two Service Relationships objectives include RE.O1 define clear, mutually beneficial agreements between the VSE, its customers, and suppliers, and RE.O2 complete regular reviews with stakeholders to ensure current and future needs are met. Two Service Relationships activities include RE.A1 create and/or maintain a suitable service catalog and RE.A2 Establish and manage agreements with customers and suppliers. Four Service Relationships work products include WP.03 customer agreement; WP.10 service catalog; WP.19 service performance report; and WP.21 supplier agreement. Two Service Incident objectives include IN.O1 prevent incidents to ensure services are available and delivered as agreed and IN.O2 manage incidents, including communication, to maximize the service experience. Two Service Incident activities are IN.A1 prevent incidents and IN.A2 manage incidents. One Service Incident work product is WP.18 service incident record. Details of the forty tasks are not reported here due to space limitations. However, it is important to note that detailed information on the forty tasks is reported in the complementary technical report ISO/IEC 29110-5-3:2018 (ISO/IEC 2018b). Besides, this technical report includes descriptive details for each one of the twenty-one work products. Finally, the eight suggested roles in this ISO/IECm29110-4-3 standard are Control Manager, Customer, Incident Manager, Management of the VSE, Practitioner, Relationship Manager, Service Manager, and Supplier. Several roles can be played by the same people, but these roles cannot be combined into a single role.

ITIL v4 framework (TSO 2019; p. 14) has been re-defined and re-structured as a Service Value System (SVS) “to ensure a flexible, coordinated, and integrated system for the effective governance and management of IT-enabled services”. ITIL v4 does not claim to be an SVS for the whole organization; instead, it indicates that with the new dynamic business demands for digital transformations, enhanced customer experiences based on IT, and the proliferation of new practices and technologies such as Agile Paradigm, DevOps, Lean, Cloud Computing, Internet of Things and Machine Learning, the majority of the business services are IT-enabled services. Thus, an updated ITSM framework is required. ITIL v4 is framed in an initial 4-dimensional model that represents the viewpoints on the ITIL v4 SVS. These four dimensions are Organizations and People, Information and Technology, Partners and Suppliers, and Value Streams and Processes. The political, economic, social, technological, legal, and environmental factors, which by their external nature are out of the control of the ITIL v4 SVS, must be also considered. These external factors constrain and impact the ITIL v4 4-dimensional framework that supports the ITIL v4 SVS, and thus are influence factors for achieving effective and efficient service management that delivers the IT services with the expected value to customers. ITIL v4 defines the concept of Service Management as “a set of specialized organizational capabilities for enabling value for customers in the form of services” (idem; p. 18). However, the focus on the 5-phase IT service lifecycle model (i.e. Service Strategy, Design, Transition, Operation, and Continual Improvement) has been re-structured in the concept of a 6-Phase Service Value Chain, which is one of the five core components of the new SVS. However, these five IT service lifecycle phases have been implicitly included and updated in the 6-Phase Service Value Chain. The concept of service is kept as “a means of enabling value co-creation by facilitating outcomes that customers want to achieve, without the customer having to manage specific costs and risks” (idem; p. 248), and the concept of IT service is simplified to “a service based on the use of information technology” (idem; p. 242). The concept of value that was indirectly defined as how well an IT service helps achieve the expected customer outcomes for using such an IT service now has been explicitly defined as “the perceived benefits, usefulness, and importance of something” (idem; p. 20). In particular, the concept of ITSM is not explicitly defined in ITIL v4. The five core components of the ITIL v4 SVS are Guiding Principles, Governance, Service Value Chain (SVC), Continual Improvement, and Practices. The ITIL v4 Principles aim to guide organizational decision-making and behaviors towards an adequate service management philosophy to be applied from top to bottom organizational levels. There are eight principles, and they are focus on value, start where you are, progress iteratively with feedback, collaborate and promote visibility, think and work holistically, keep it simple and practical, and optimize and automate. ITIL v4 Governance refers to the top-level policy and regulation body created to assure the alignment of the IT actions with the IT strategies, policies, and regulations. ITIL v4 Governance component also accounts for the organizational body at the highest organizational level that evaluates, directs, and monitors the SVS. The ITIL v4 SVC includes six phases that define a flexible and adaptable operational model for creating, delivering, and continually improving IT services. These six phases of the ITIL v4 SVC are plan, improve, engage, design and transition, obtain/build, and deliver and support. The ITIL v4 Continual Improvement model is reported as usable and required for all organizational areas from strategic to operational levels. The previous 7-phase model from ITIL v2011 is kept. The ITIL v4 Practices are organizational resources that provide a guide on what work to do and they are organized into three categories of General Management, Service Management, and Technical Management. In the updated ITIL v4 ITSM framework, there are no mandatory or obligatory ITSM practices to be performed. The new flexible and adaptable ITIL v4 SVS model defines the generic 6-phase SVC that accommodates flexibly the utilization of the 34 ITIL v4 Practices including 14 of General Management, 17 of Service Management, and 3 of Technical Management. These 34 ITIL v4 practices are not restricted to being used in a specific phase of the ITIL v4 SVC. Instead, there is a heat map reported for each practice to show where it is expected to use, not in a mandatory manner, such a practice. Consequently, ITIL v4 proposes a flexible, adaptable, and highly customized Service Management model where each organization is responsible to define its Value Streams. Value Streams are “specific combinations of activities and practices, and each one is designed for a particular scenario” (idem; p. 83). A Value Stream starts with the customer’s demand and ends with the delivery of value to the customer. Value Streams can be organized as disciplined, agile, or hybrid flexible workflows, and they are organizational decisions. Furthermore, depending on their criticality level, some Value Streams can be designed for a disciplined approach while others are used with more flexible approaches such as Agile, Lean, and DevOps.

VeriSM framework (Agutter et al. 2017; p. 376) is defined as a “value-driven, evolving, responsive, and integrated service management approach” for the entire organization instead of only the IT area in the digital era. A service management approach is a management approach to delivering value to customers through quality products and services. VeriSM indicates that whereas the ITSM best practice frameworks have provided value to organizations in the last decade, the new digital business era demands a broader IT-based or digital transformation approach for the entire organization, and accordingly, these ITSM frameworks are insufficient to cope with the business demands in this digital era. VeriSM aims to help organizations use integrally a mesh of best management practices in a flexible way to deliver the right product or service at the right time to their customers. VeriSM is documented with a service management operating model composed of Consumers, Governance System, Service Management Principles, and the Management Mesh. The implementation of the VeriSM approach enables organizations to define governance requirements, service management principles, a management mesh of best practices, and the service or product stages of definition, production, responding, and provision. Customers provide the product or service requirements, pay, receive, and give feedback for the products or services. Governance provides the background system to direct and regulate the activities of an organization, and Management provides the foreground system that manages the activities of an organization within the boundaries and regulations designated by Governance. Governance consists of three main activities including evaluate, direct, and monitor. Evaluate refers to comparing the overall current organizational status vs the future forecasted or planned ones. Direct refers to creating organizational principles, policies, and strategies. Monitor refers to assuring that policies are complied with and strategic performance is achieved. Service Management Principles are statements that define how the organization wants to perform and what is valued. Service Management Principles, thus, help define the specific best practices to be included in the Management Mesh. Service Management Principles address usually assets/resources utilization, change, continuity, finance, knowledge, measurement and reporting, performance, quality, regulations, risk, and security issues. Management Mesh refers to the integral and flexible fabric composed of organizational resources, management practices, current and emergent technologies, and environmental conditions. This Management Mesh enables a flexible and agile management service approach in organizations to define, produce, provide, and respond to their products and services. The definition of a particular Management Mesh occurs after the definition of Governance strategies and policies and Service Management Principles. In particular, the environmental conditions in the Management Mesh include the service stabilizers such as processes, tools, and measurements. This Management Mesh lately defines four functional areas/stages for developing and providing the products and services of the organization, which are Define, Produce, Provide, and Respond. There are about two to four high-level activities respectively in the four stages. The four ones of the Define area/stage are consumer need, required outcome, solution, and service blueprint. The three ones of the Produce area/stage are built, test, and implement and validate. The three ones of Provide area/stage are protect, measure, and maintain, and improve. The two ones of the Respond area/stage are record and manage.

Appendix 2

See Table 7.

Table 7 Summary of the main findings of business agility research

Appendix 3

See Table 8.

Table 8 Summary of the main findings of joint business agility and organizational IT capability research

Appendix 4. AHP pairwise comparison matrices

Pairwise comparison matrix for agility dimensions regarding business agility index

		Attribute Y
CR: 0.00	Contribution to: Business agility index	Customer agility	Operational agility	Partnering agility
Attribute X	Customer agility	–	3 (X moderately more than Y)	1 (X equal than Y)
	Operational agility	1/3 (X moderately less than Y)	–	1/3 (X moderately less than Y)
	Partnering agility	1 (X equal than Y)	3 (X moderately more than Y)	–

Pairwise comparison matrix for agility capabilities regarding customer agility.

		Attribute Y
CR: 0.05	Contribution to: Customer agility	Business responsiveness	Business speed	Business flexibility	Business simplicity and standardization
Attribute X	Business responsiveness	–	1 (X equal than Y)	3 (X moderately more than Y)	3 (X moderately more than Y)
	Business speed	1 (X equal than Y)	–	3 (X moderately more than Y)	3 (X moderately more than Y)
	Business flexibility	1/3 (X moderately less than Y)	1/3 (X moderately less than Y)	–	3 (X moderately more than Y)
	Business simplicity and standardization	1/3 (X moderately less than Y)	1/3 (X moderately less than Y)	1/3 (X moderately less than Y)	–

Pairwise comparison matrix for agility capabilities regarding operational agility.

		Attribute Y
CR: 0.04	Contribution to: Operational agility	Business responsiveness	Business speed	Business flexibility	Business simplicity and standardization
Attribute X	Business responsiveness	–	1/3 (X moderately less than Y)	1/3 (X moderately less than Y)	1/5 (X strongly less than Y)
	Business speed	3 (X moderately more than Y)	–	1 (X equal than Y)	1/3 (X moderately less than Y)
	Business flexibility	3 (X moderately more than Y)	1 (X equal than Y)	–	1 (X equal than Y)
	Business simplicity and standardization	5 (X strongly more than Y)	3 (X moderately more than Y)	1 (X equal than Y)	–

Pairwise comparison matrix for agility capabilities regarding partnering agility

		Attribute Y
CR: 0.02	Contribution to: Partnering agility	Business responsiveness	Business speed	Business flexibility	Business simplicity and standardization
Attribute X	Business responsiveness	–	1/3 (X moderately less than Y)	1/5 (X strongly less than Y)	1/5 (X strongly less than Y)
	Business speed	3 (X moderately more than Y)	–	1/3 (X moderately less than Y)	1/3 (X moderately less than Y)
	Business flexibility	5 (X strongly more than Y)	3 (X moderately more than Y)	–	1 (X equal than Y)
	Business simplicity and standardization	5 (X strongly more than Y)	3 (X moderately more than Y)	1 (X equal than Y)	–

Pairwise comparison matrix for agility enablers business responsiveness

		Attribute Y
CR: 0.00	Contribution to: Business responsiveness	Value chain Primary activities	Value chain Support activities
Attribute X	Value chain Primary activities	–	1 (X equal than Y)
	Value chain Support activities	1 (X equal than Y)	–

Pairwise comparison matrix for agility enablers business speed

		Attribute Y
CR: 0.00	Contribution to: Business speed	Value chain Primary activities	Value chain Support activities
Attribute X	Value chain Primary activities	–	3 (X moderately more than Y)
	Value chain Support activities	1/3 (X moderately less than Y)	–
Pairwise comparison matrix for agility enablers business flexibility		Attribute Y
CR: 0.00	Contribution to: Business flexibility	Value chain Primary activities	Value chain Support activities
Attribute X	Value chain Primary activities	–	3 (X moderately more than Y)
	Value chain Support activities	1/3 (X moderately less than Y)	–

Pairwise comparison matrix for agility enablers business simplicity and standardization

		Attribute Y
CR: 0.00	Contribution to: business simplicity and standardization	Value chain Primary activities	Value chain Support activities
Attribute X	Value chain Primary activities	–	1 (X equal than Y)
	Value chain Support activities	1 (X equal than Y)	–