General Management Practices. They are the backbone of any organisation, whether it is a hospital, a bank, or a tech company. For the ITIL 4 Foundation exam, you need to know what these practices are and what they do — not memorise every detail, but understand their purpose and key activities.
Jump to a section
A simple way to picture General Management Practices
The head chef at a busy restaurant kitchen. This chef does not cook every dish herself. Instead, she runs the whole operation. She plans the menu weeks in advance to make sure they can source enough ingredients. She manages the budget so the restaurant does not run out of money. She hires new cooks when the kitchen is short-staffed. She designs the workflow so that orders flow smoothly from the waitstaff to the grill station to the plating area. She also sets the safety rules for handling hot oil and sharp knives. When a supplier delivers bad tomatoes, she decides whether to send them back or find a replacement quickly. Her job is not to chop vegetables or flip burgers. Her job is to create the conditions where every cook, dishwasher, and server can do their best work.
This is exactly what General Management Practices do in IT. They are the systems and routines that keep the whole organisation running well. The head chef uses menu planning, budgeting, hiring, workflow design, and rule-setting — those are her management practices. In ITIL 4, the General Management Practices are the equivalent set of tools. They include things like information security management, relationship management, and risk management. The chef does not need to taste every sauce. She needs to make sure the kitchen has the right people, processes, and protections in place. Similarly, an IT manager does not fix every broken server. They make sure the organisation has the right practices to deliver value safely and consistently.
In ITIL 4, a "practice" is a set of organisational resources designed for performing work or accomplishing an objective. Think of it as a repeatable recipe for getting something done. ITIL 4 defines 34 practices, split into three categories: General Management Practices, Service Management Practices, and Technical Management Practices. This chapter focuses on the first group.
General Management Practices are the practices that every organisation, regardless of industry, uses to run itself. They are not unique to IT. A supermarket uses them. A school uses them. A government department uses them. ITIL 4 took the best of these general management ideas and adapted them for the world of IT services.
There are 14 General Management Practices in ITIL 4. They are:
Architecture management
Continual improvement
Information security management
Knowledge management
Measurement and reporting
Organisational change management
Portfolio management
Project management
Relationship management
Risk management
Service financial management
Strategy management
Supplier management
Workforce and talent management
Let us walk through the most important ones for the exam.
Architecture management is about understanding all the components of the organisation — the technology, the data, the processes, and the people — and how they fit together. It ensures that changes to one part do not break another part. For example, if the marketing team buys a new customer database, the architecture manager checks whether it will integrate with the existing sales software.
Continual improvement is the practice of constantly looking for ways to do things better. It is not a one-off project. It is a permanent mindset. Teams regularly review their performance, identify gaps, and make small or large improvements. ITIL 4 uses a model called the Continual Improvement Model, which has steps like "What is the vision?" and "Where are we now?"
Information security management is about protecting the organisation's information from threats. This includes keeping data confidential (only the right people can see it), ensuring it is accurate and complete (integrity), and making sure it is available when needed (availability). This is often called the CIA triad.
Knowledge management is the practice of capturing, organising, and sharing information so that people can do their jobs effectively. Instead of knowledge being stuck in one person's head, it is stored in a central place that everyone can access. For example, a wiki with steps for resetting a user's password.
Measurement and reporting is about collecting data on how things are performing and presenting it in a way that helps people make decisions. If a website is slow, measurement tells you how slow it is. Reporting shows that data to the right people at the right time.
Organisational change management is about helping people adapt to changes. When a new software system is introduced, it is not enough to install it. You also need to train people, address their fears, and get them on board. This practice focuses on the human side of change.
Portfolio management is about deciding what the organisation should invest in. A portfolio is a collection of projects, programmes, or services. The practice involves evaluating each potential investment against the organisation's goals and deciding which ones to fund.
Project management is the practice of planning and controlling temporary efforts to create something new, like launching a new app or building a data centre. It focuses on delivering the required output on time and within budget.
Relationship management is about building and maintaining good relationships with stakeholders — the people or groups who have an interest in the organisation's work. This includes customers, users, and internal teams. Good relationships lead to better communication and trust.
Risk management is the practice of identifying possible problems before they happen and deciding what to do about them. It could be accepting the risk, avoiding it, reducing it, or transferring it (for example, buying insurance).
Service financial management is about managing the money side of IT services. It includes budgeting (planning how much to spend), accounting (tracking where the money went), and charging (billing customers for the services they used).
Strategy management is about defining the organisation's direction. What is the long-term goal? How will the organisation get there? This practice ensures that all the other practices are aligned with the overall mission.
Supplier management is about managing relationships with external vendors, such as cloud providers, software companies, or hardware suppliers. It includes negotiating contracts, monitoring performance, and dealing with problems when they arise.
Workforce and talent management is about making sure the organisation has the right people with the right skills. This includes hiring, training, career development, and succession planning.
These practices replace the older, more rigid processes found in previous versions of ITIL. ITIL 4 deliberately uses the word "practice" instead of "process" to emphasise that these are ongoing activities that need to be adapted to the organisation's context, not fixed checklists.
Identify the need
Someone in the organisation raises a problem or an opportunity. For example, the sales team reports that the website is slow. This triggers the use of General Management Practices like Measurement and reporting to assess the situation.
Assess with measurement and reporting
Collect data to understand the current state. In this step, you use dashboards, logs, or surveys to find the facts. This practice gives you evidence instead of guesses.
Evaluate risk and impact
Use Risk management to decide how serious the issue is. Could it cause financial loss? Damage reputation? This step helps you prioritise which problems to solve first.
Decide using portfolio management
Compare this issue against other ongoing work. Is fixing the website more important than building a new feature? Portfolio management helps you make that call by aligning with strategic goals.
Implement with project management
Plan and execute the solution. This could be a small project (like adding more server capacity) or a large one (like redesigning the database). Project management ensures it is done on time and within budget.
Communicate with organisational change management
Tell everyone affected about the change. Train staff, update documentation, and manage resistance. This step ensures the solution is adopted successfully.
Review with continual improvement
After implementation, measure whether the problem is fixed. Look for further improvements. This closes the loop and ensures the organisation keeps getting better.
An IT professional uses General Management Practices every day, often without realising it. Let us walk through a concrete scenario at a mid-sized company called GreenLeaf, which provides an online platform for ordering plants.
Sarah is the IT service manager at GreenLeaf. One morning, she gets a call from the head of sales: the website is running slowly during peak hours, and customers are abandoning their carts. Sarah does not immediately run to the server room. She takes a step back and activates several General Management Practices.
First, she uses Measurement and reporting. She pulls up dashboards showing website response times, server CPU usage, and error rates. She sees that the bottleneck is the database server during lunch hours. Next, she applies Risk management. She identifies that if the database fails completely, GreenLeaf could lose thousands of pounds in revenue per hour. She decides to set up a database replica as a backup (risk reduction).
Sarah then uses Portfolio management to decide if this fix is the best use of the team's time. The company also wants to launch a new mobile app next quarter. She discusses with the product manager and they agree that fixing the website is higher priority. Then, she uses Organisational change management to inform the sales and customer support teams about the performance fix and what to tell customers.
She also uses Supplier management because the database software is hosted by a cloud provider. She contacts the provider's support team to request additional read replicas. Finally, she uses Continual improvement. She schedules a meeting for next month to review whether the fix worked and whether there are deeper issues to address.
The key activities Sarah performed in this scenario are exactly what ITIL 4 defines for General Management Practices:
Collecting and analysing data (Measurement and reporting)
Identifying and treating risks (Risk management)
Evaluating investments against strategic goals (Portfolio management)
Communicating changes to stakeholders (Organisational change management)
Managing external vendors (Supplier management)
Reviewing outcomes and planning further improvements (Continual improvement)
Without these practices, Sarah would be guessing. She would buy new servers without knowing if that was the problem. She would forget to tell the support team, so customers would get the wrong information. She would ignore the supplier's contract terms and pay extra fees. General Management Practices give her a systematic way to solve problems, not just react to them.
The ITIL 4 Foundation exam tests General Management Practices in a very specific way. The exam objective is 2.2: "Describe the purpose and key activities of general management practices." This means the exam focuses on what each practice does, not how to do it. You will not be asked to memorise the steps of a risk assessment. You will be asked to match a practice name to its purpose.
Here is what you need to know for the exam:
Which practices are General Management Practices? There are 14 of them. The exam sometimes lists a mix of practices from all three categories (General, Service, and Technical) and asks you to pick the one that belongs to General Management. You need to be able to recognise them on sight.
The purpose statement for each practice. ITIL 4 provides a one- or two-sentence purpose statement for each practice. The exam loves to give you a description and ask, "Which practice does this describe?" For example, if the question says, "This practice helps the organisation identify and deal with uncertainty," the answer is Risk management.
Key activities. The exam may ask you what the main activity of a practice is. For example, the key activity of Supplier management is negotiating and managing contracts. The key activity of Knowledge management is sharing information across the organisation.
Common traps in the exam:
Mixing up practices with similar names. For example, "Relationship management" and "Supplier management" both involve dealing with other people or organisations. The difference is that Supplier management focuses on external vendors, while Relationship management includes all stakeholders, including internal teams and customers.
Confusing Portfolio management with Project management. Portfolio management is about deciding which projects to do. Project management is about executing a specific project.
Thinking Continual improvement is optional. The exam treats it as a core practice that every organisation should do. It is not just for problems. It is for finding opportunities to get better.
Forgetting the CIA triad in Information security management. Confidentiality, Integrity, and Availability are the three pillars. If a question says, "This ensures only authorised people can see the data," it is Confidentiality. If it says, "This ensures data has not been tampered with," it is Integrity.
Key definitions to memorise:
Practice: A set of organisational resources designed for performing work or accomplishing an objective.
General Management Practice: A practice that applies to the entire organisation, not just IT.
Continual Improvement Model: A structured approach to making improvements, with defined steps.
Service Value System (SVS): The overall model that shows how all the components and activities of an organisation work together to create value. General Management Practices are a key part of the SVS.
The exam will not ask you to list all 14 practices, but you should be able to recognise them. Focus on the ones that are most commonly tested: Continual improvement, Information security management, Risk management, Relationship management, Supplier management, and Portfolio management. These appear more frequently than, say, Architecture management or Workforce and talent management.
General Management Practices are the 14 practices that every organisation uses to run itself, regardless of industry.
Continual improvement is a proactive, ongoing practice, not just a reaction to problems.
Information security management is built on the CIA triad: Confidentiality, Integrity, and Availability.
Risk management covers all forms of uncertainty, not just security threats.
Portfolio management decides which projects to pursue; Project management executes a specific project.
Supplier management focuses on external vendors; Relationship management covers all stakeholders.
The ITIL 4 Foundation exam tests the purpose and key activities of each practice, not detailed steps.
Organisational change management addresses the human side of change, such as training and communication.
These come up on the exam all the time. Here's how to tell them apart.
Portfolio Management
Decides which projects to invest in
Focuses on the collection of all projects
Aligns with strategic goals
Project Management
Executes a specific project
Focuses on time, cost, and scope of one project
Delivers a defined output
Supplier Management
Focuses on external vendors
Manages contracts and performance
Ensures supplier delivers as agreed
Relationship Management
Covers all stakeholders
Includes internal teams and customers
Builds trust and communication
Continual Improvement
Ongoing and never-ending
Focuses on incremental changes
Uses the Continual Improvement Model
Project Management
Has a defined start and end
Focuses on delivering a specific outcome
Uses methodologies like Agile or Waterfall
Risk Management
Covers all types of uncertainty
Includes financial, operational, and reputational risks
Focuses on identifying and treating risks
Information Security Management
Specialises in information threats
Focuses on CIA triad
Includes access controls and encryption
Mistake
General Management Practices are only for IT managers, not for technical staff.
Correct
These practices are used by everyone in the organisation. A developer uses knowledge management to document code. A support agent uses relationship management when talking to a client.
People think "management" means only managers do it, but ITIL 4 uses it to mean any organised activity that helps the organisation run.
Mistake
Continual improvement is just about fixing things when they break.
Correct
It is proactive, not just reactive. It includes finding opportunities to improve even when nothing is broken, like making a process faster or cheaper.
The word "improvement" sounds like fixing problems. Beginners miss that it also covers proactive enhancements.
Mistake
Risk management only deals with security risks like hackers.
Correct
It covers all types of uncertainty, including financial risks, operational risks, compliance risks, and reputational risks.
Cybersecurity is so prominent in the news that people forget risk is a broader concept.
Mistake
Supplier management and Relationship management are the same thing.
Correct
Supplier management specifically handles external vendors and contracts. Relationship management covers all stakeholders, including internal teams, customers, and partners.
Both involve managing relationships, but the scope is different. Beginners confuse them because the word "relationship" appears in both.
Mistake
Portfolio management is about managing a single project.
Correct
It is about managing a collection of projects, services, or investments. It helps decide which ones to do, not how to do a single one.
Beginners hear "portfolio" and think of a single document or plan, but it is about the big picture.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Yes, you need to recognise them, but you do not need to recite them from memory. Focus on the purpose and key activities of each one.
A practice is broader than a process. It includes people, tools, and information, not just a sequence of steps. ITIL 4 uses "practice" to emphasise flexibility and context.
They are part of the Service Value System. They provide the capabilities needed to perform the activities in the value chain, like plan, improve, engage, and deliver.
Continual improvement is very common. Also watch for Information security management and Risk management. These appear often in matching questions.
Yes. That is why they are called "general." They are adapted from standard business practices that any department can use.
Key activities are the main things you do when practising that practice. For example, a key activity of Supplier management is negotiating contracts.
You've finished General Management Practices. Continue through the ITIL4F study guide to build a complete picture of the exam.
Done with this chapter?