ITIL Audit - Benchmarking Vs Climbing the Bench
Posted by Ravindran A Varier
As Bruno rightly suggests in his latest blog, companies are nowadays having this big question in their minds – ‘What next?’
This question is prevalent even in the minds of those companies and Organizations who have taken pains to undergo ITIL v3 readiness, ITIL benchmarking and assessment in their respective Organization. And one possible answer that seems to be emerging is – A continued audit of their ITSM process.
An ITIL assessment might set the standards, an ITSM implementation might bring forth standardized and streamlined processes into the Organization, but then, the onus is still with the Organization to make sure that all these standards are being continuously followed. This brings into light the increasing demand for an ITIL based audit.
As a matter of fact, recently I got an opportunity to get hands-on experience in assisting in an ITIL based audit for a company. To say the least, the learning was tremendous! We all would have observed right from our childhood days that while playing games as kids or while sitting in a classroom, framing a rule and understanding where we lag behind is easy as compared to following a set of standards every time! The same is true for Organizations when it comes to lining up their ITSM processes based on ITIL best practices. In fact, it just proves the old adage that everyone resists change! And I found it to be true with ITSM processes too! 
Initially, the feeling that one gets when he/she starts auditing a process is that of barking up a rigid tree which is not ready to bend its branches down. But then, with the right approach and strategy, one would understand that even mighty trees are wiling to bow down and allow you to climb! Perhaps, the initial expression of the reader would be – how is ITIL audit different from any other audit? Quite valid in having this perception too. But my practical experiences taught me otherwise. Primarily so because I observed that ITIL benchmark or ITIL assessment leaves an organization with either of the two views
- Oh yes! I am ITIL benchmarked and found to be ITIL compliant!
- Oh no! I have a lot of ground to cover up to be ITIL compliant.
And it is easier to fall into the second category! What with numerous buzz words and jargons that ITIL brings along with it - Capacity Management, Continuity Management, Service Catalog Management, Requirement Management, Release Management, Availability Management, Incident Management, Problem Management, etc, etc (For a common man, it might seem similar to walking through a multi-specialty hospital with each room labeled with a medical jargon!)
Now the responsibility of an ITIL Audit team is not just to perform an audit and generate report from the audit, but much more. They have to understand the ITSM Process of the Organization. They have to identify what are the necessary and mandatory ITIL practices that the ITSM process should be following. The Audit person should understand the existing documentation that the ITSM process is using. Perhaps the most important aspect of an ITIL audit is to compare the documented process and the operational process, mainly so because ITIL being a fairly new concept for most of the Organizations, there is a large scope of a gap existing between what is documented and what is followed.
But perhaps the maximum impact that the Audit team can have on the ITSM Process is when they successfully identify the gaps and drive changes to the process documentation. This might lead to changes in the Audit framework too as the yardstick used for measurement is changing. The Audit team should be open to modifying the Audit framework and making sure that the process compliance reaches a steady state.
A common man might get petrified when he sees so many terminologies like Neuro, Ortho, Opto, etc. But it is the responsibility of the physician to explain who are the relevant people that he should get in touch with for a healthy living. Similarly, though ITIL encompasses many best practices, the ITIL Audit team has the responsibility of telling the Organization what are the focus points for their ITSM process.
And of course, on a lighter and philosophical note, I did gain an important learning from the entire exercise. We have to bear in mind that whatever we do is subject to an Audit or future review and hence we should also focus on doing it well – Judgement day is inevitable
