| I've always been perplexed by the various process | | | | apply them in the right way." |
| improvement frameworks floating around the business | | | | In his book, Harris uses an analogy of three Russian |
| world. There's Six Sigma, Lean, balanced scorecard, | | | | nesting dolls. The outer doll is COBIT, which provides a |
| COBIT, ITIL. And that's only a few of them. There is a | | | | framework for governance and control of IT providers. |
| mind-boggling list. | | | | The middle doll is ITIL, which focuses on best practices |
| When a new framework is introduced, my first | | | | for IT operations.The inner doll is CMMI, which focuses |
| question is always, "Do we really need another?" So it | | | | on best practices for systems and software |
| was in February when I interviewed Sheila Upton, | | | | development. The doll analogy is employed to illustrate |
| director of Technology and Security Risk Services for | | | | the day-to-day involvement the business can expect |
| Ernst & Young and a member of the Innovation | | | | to have with each framework, explained Harris. |
| Value Institute, when the IVI introduced the IT Capability | | | | Business will be most involved with COBIT, somewhat |
| Maturity Framework (IT-CMF), a five-stage maturity | | | | less so with ITIL, and probably far less so with CMMI. |
| model used to organize and structure a framework | | | | Said Harris: |
| for mapping IT improvement efforts. I followed up a | | | | Both ITIL and CMMI are both IT-oriented best practices. |
| few weeks later with a blog post in which I asked | | | | COBIT is a business-oriented best practice. So COBIT |
| (rhetorically) Can ITIL Do It All? The answer, of course, | | | | is about the control the business should expect to |
| was no. | | | | have in place regarding IT. The strength and weakness |
| During a series of interviews I did for a story on ITIL, | | | | of COBIT is it really only defines control points and |
| Bob Mathers, a principal consultant for Compass | | | | essentially generates the climate to report and audit |
| Management Consulting, told me many organizations | | | | information at those control points. So it's perfect for |
| integrate ITIL (IT Infrastucture Library) with other | | | | monitoring information for IT governance. But it doesn't |
| improvement frameworks such as COBIT (Control | | | | really contain any best practices. So that's why I talk |
| Objectives for Information and Related Technology). | | | | about the three. And getting back to the Russian dolls, |
| "That came out of their realization that ITIL wasn't | | | | that's why I believe they should be in that order. The |
| necessarily going to solve everything they thought it | | | | business should expect to control IT through a |
| might solve," he told me. | | | | COBIT-like structure and at the same they should do |
| Using multiple frameworks is an approach advocated | | | | those check boxes that say "Are you following ITIL |
| by Mike Harris, owner and president of David | | | | practices?"and "Are you following CMMI practices?" |
| Consulting Group and one of three authors of a new | | | | Harris suggests that some organizations may also |
| book titled "The Business Value of IT: Managing Risks, | | | | want to consider Six Sigma. The pro: If the business is |
| Optimizing Performance and Measuring Results," in my | | | | already using it, employing the same approach in IT |
| recent interview with him. Specifically, he believes most | | | | could help reinforce corporate culture and strengthen |
| organizations will derive value from implementing three | | | | IT/business relations. The con: If the IT organization isn't |
| popular improvement methodologies: ITIL, COBIT and | | | | mature enough, "the focusing effect of Six Sigma may |
| CMMI (Capability Maturity Model Integration). The trick, | | | | leave too many IT capability gaps," writes Harris in his |
| he said, is to "take the strengths of each one and to | | | | book. |