ITIL management practices are the standardised, repeatable methods that an organisation uses to manage its IT services and create value. They solve the problem of chaos and inconsistency, ensuring every team member knows how to handle common tasks effectively. For the ITIL4F exam, you must understand what a management practice is, why it exists, and the key terms that describe its components.
Jump to a section
A simple way to picture Introduction to ITIL Management Practices
A family recipe book is the central collection of proven methods for running a kitchen. It does not contain every single meal ever cooked, but rather the standardised practices for the most important dishes: the Sunday roast, the birthday cake, the holiday cookies. Each recipe is a management practice. When a new family member learns to cook, they do not guess the oven temperature. They open the recipe book. The recipe for the Sunday roast specifies the ingredients (resources), the steps (processes), and the person responsible for checking the meat (roles). It also details how to get feedback—did everyone like the gravy? That feedback loop improves the recipe for next time. This makes the kitchen consistent and efficient, whether the grandparent or the teenager is cooking. The recipe book does not describe the kitchen's entire history or every appliance. It is a practical, actionable tool. ITIL management practices function identically: they are the organisation's proven recipes for delivering services. Each practice is a set of resources and activities designed to achieve a specific outcome. They provide consistency and reliability, allowing different teams to perform work in a known, repeatable way. Without the recipe book, every meal is a chaotic experiment. Without ITIL management practices, every IT task is a risky improvisation.
In ITIL 4, a management practice is a set of organisational resources designed for performing work or accomplishing an objective. Think of the organisation as a living body. The practices are its organs. Each organ (practice) has a specific purpose, but they all work together to keep the body alive and healthy. ITIL 4 defines 34 management practices. The exam focuses on their purpose and key terminology, not on memorising all 34.
The purpose of a management practice is the specific outcome or goal it achieves for the organisation. For example, the purpose of the 'Incident Management' practice is to restore normal service operation as quickly as possible and minimise the negative impact on the business. You do not need to memorise every purpose verbatim, but you must recognise the correct purpose for the most common practices (Incident, Problem, Change, Service Request, Service Desk).
The term 'resources' within a practice means everything required to perform the work. This includes people (roles and competencies), processes and procedures (the steps to follow), technology (tools and software), and information (data and knowledge). A practice is not just a process. It is a holistic combination of these four elements. For instance, the 'Change Control' practice requires a change manager (people), a change approval workflow (process), a change management tool (technology), and a change schedule (information).
Another key term is 'inputs, outputs, and triggers.' Inputs are the things needed to start an activity within a practice. Outputs are the results produced. Triggers are events that initiate the start of a practice or an activity within it. If the IT service monitoring tool sends an alert for a down server, that alert is a trigger. It triggers the 'Service Desk' practice to log an incident, which is the input for the 'Incident Management' practice. The output of Incident Management is a resolved incident, which itself can trigger the 'Problem Management' practice to find the root cause.
ITIL management practices are grouped into three categories: general management practices, service management practices, and technical management practices. General management practices are adapted from general business management, such as Information Security Management and Relationship Management. Service management practices are core to service delivery, like Incident Management and Service Level Management. Technical management practices manage technology, like Deployment Management and Infrastructure and Platform Management.
Before ITIL 4, these were called 'processes' or 'functions.' The shift to 'practices' is deliberate. It acknowledges that effective management involves more than just a process diagram. It requires a combination of skilled people, appropriate technology, and good information. For the exam, remember that a practice always includes the four dimensions of service management: people (organisations and people), process (information and technology), technology (partners and suppliers), and partners (value streams and processes—wait, that's wrong). The correct four dimensions are: Organisations and People, Information and Technology, Partners and Suppliers, and Value Streams and Processes. ITIL management practices are the practical application of these four dimensions to achieve a specific purpose.
1. Identify a Business Need
The organisation realises it needs a consistent way to handle customer IT issues. This creates the requirement for a management practice. Without this step, practices are created reactively and inconsistently.
2. Define the Practice Purpose
Clearly state what the practice will achieve. For example, 'The purpose of the Incident Management practice is to restore normal service operation as quickly as possible.' This provides a clear goal for everyone involved.
3. Allocate Resources
Assign people (roles like Incident Manager), define the process (steps for logging and resolving incidents), choose technology (an ITSM tool), and gather information (known errors and documentation). These four resources form the practice.
4. Implement the Practice
Train staff on the new process, configure the chosen tool, and begin using the practice in daily operations. This step ensures the practice is embedded in how the organisation works, not just a theoretical document.
5. Operate and Improve
The practice is used in real situations. Feedback from users and performance metrics (like incident resolution time) trigger improvements to the practice. This aligns with the ITIL principle of continual improvement.
Imagine you are an IT professional called a Service Desk Analyst at a mid-sized company, 'GreenLeaf Tech,' which provides online accounting software to small businesses. You receive a phone call. A customer, 'Speedy Books Ltd,' cannot log in to their account. This is an incident (an unplanned interruption to a service).
Here is what you actually do, guided by ITIL management practices:
First, you log the incident into the IT Service Management (ITSM) tool. This tool is part of the technology resource for the 'Incident Management' practice. You record the customer's name, the time, the error message, and the impact. You categorise the incident as 'Login - Application Error.' This categorisation is a key part of the process resource within the Incident Management practice. It helps prioritise and route the work.
Second, you follow the standard procedure defined in the Incident Management practice. You check the status page for known outages. There is none. You attempt to reset the user's password in the company's Identity Management System. This action is part of your role (people resource) and uses the technology (Microsoft Entra ID) that is part of the Cloud IAM practice. The password reset fails because the user's account is locked. You unlock the account. The customer can now log in. You document the solution in the ticket and close it. This entire step-by-step workflow is the Incident Management practice in action.
Third, because this is the fifth similar login issue this month, a different team uses the 'Problem Management' practice. They analyse the patterns from all closed incidents. They discover the underlying cause: a buggy update to the Microsoft Entra ID sync script that sometimes duplicates user records and locks accounts. They create a known error record (a documented problem with a known root cause and a workaround). This knowledge becomes an input for the 'Knowledge Management' practice. The Service Desk now has a pre-written script to check for duplicate accounts, which speeds up resolution for future incidents. This feedback loop between Incident Management and Problem Management is a core example of practices working together within the Service Value Chain.
Your daily work is not abstract theory. You use the Service Desk practice to interact with users. You use the Incident Management practice to restore service. You follow the Change Control practice when a developer requests to deploy the fix for the sync script. You use the Service Request Management practice to fulfil standard requests from employees, like granting access to a new application. Each action you take is a practical application of a defined ITIL management practice. The practices ensure you do not have to invent a new process every time an issue arises. They provide the playbook.
The ITIL4F exam tests your understanding of the purpose and key terms of ITIL management practices in a very specific way. The exam is not asking you to memorise all 34 practices. It is asking you to distinguish between practices and understand their fundamental components. Questions on this objective will fall into three main categories.
First, 'Match the practice to its purpose' questions. You will be given a list of practices (e.g., Incident Management, Problem Management, Change Control, Service Desk, Service Request Management) and a list of purposes. You must match them correctly. The trap here is that purposes sound similar. For example: - 'To restore normal service operation as quickly as possible' belongs to Incident Management. - 'To minimise the negative impact of incidents by analysing their root causes' belongs to Problem Management. - 'To handle standard requests from users for information, access, or something new' belongs to Service Request Management. The exam loves to swap the words 'Incident' and 'Problem.' Remember: an incident is an interruption to service now. A problem is the underlying cause of one or more incidents. The purpose of Problem Management is to manage problems and find the root cause. The purpose of Incident Management is to fix the immediate interruption.
Second, 'Definition of a Practice' questions. The exam will ask: 'What is an ITIL management practice?' The correct answer is: 'A set of organisational resources designed for performing work or accomplishing an objective.' The trap is distractor answers that say it is 'a process' or 'a procedure.' A process is part of a practice, but the practice itself is broader. Another trap is an answer that says 'a technology tool.' The technology tool is part of the practice's resources, not the practice itself.
Third, 'Components of a Practice' questions. The exam may ask you to identify the four types of resources that make up a practice. The correct answer involves People, Process, Technology, and Information. The trap is listing 'Hardware, Software, Data, and People.' This is close, but ITIL specifically uses the words 'Information and Technology' as one dimension and 'Organisations and People' as another. Another trap is including 'Partners and Suppliers' as a resource within a practice. Remember: 'Partners and Suppliers' is a dimension of service management, but it is not a resource within a single practice. A practice uses people, process, technology, and information. Partners and Suppliers are external resources that a practice might interact with, but they are not intrinsic to the definition of the practice's components.
Key definitions to memorise for the exam:
Management Practice: A set of organisational resources designed for performing work or accomplishing an objective.
Purpose: The specific outcome a practice aims to achieve.
Inputs: Resources or data that trigger or are used by a practice activity.
Outputs: Tangible or intangible results produced by a practice activity.
Triggers: Events that initiate the execution of a practice or activity.
Another common exam trap is confusing the 'Service Desk' with 'Incident Management.' The Service Desk is a function (a team or tool) that provides the single point of contact for users. Incident Management is a practice that manages the lifecycle of incidents. The Service Desk may perform many Incident Management activities, but they are not the same thing. The exam will ask: 'Which practice provides a single point of contact between the service provider and users?' The answer is the Service Desk practice, not Incident Management.
Finally, be aware of the 'General Management Practices' vs. 'Service Management Practices' distinction. Questions will occasionally ask which category a specific practice belongs to. For example, 'Information Security Management' is a General Management Practice (adapted from business management). 'Incident Management' is a Service Management Practice. 'Deployment Management' is a Technical Management Practice. The exam will not test the category for every practice, but it expects you to know the general grouping concept.
An ITIL management practice is a set of organisational resources (people, process, technology, and information) designed for performing work or accomplishing an objective.
The purpose of a practice defines the specific outcome it aims to achieve, such as restoring service (Incident Management) or finding root causes (Problem Management).
Incident Management focuses on restoring normal service operation quickly, while Problem Management focuses on managing the underlying causes of incidents.
The Service Desk practice provides a single point of contact between the service provider and users for handling incidents and service requests.
Inputs, outputs, and triggers are key terms that describe how practices interact; a trigger starts an activity, inputs are used in the activity, and outputs are the results produced.
ITIL management practices are grouped into three categories: General Management Practices, Service Management Practices, and Technical Management Practices.
A practice is broader than a process or procedure because it includes the people performing the work, the technology enabling it, and the information guiding it.
The four dimensions of service management (Organisations and People, Information and Technology, Partners and Suppliers, Value Streams and Processes) are applied through management practices.
These come up on the exam all the time. Here's how to tell them apart.
Incident Management
Focuses on restoring normal service operation as quickly as possible
Works on specific, individual incidents in real-time
Outcome is a resolved incident and restored service
Problem Management
Focuses on managing the lifecycle of problems to prevent recurrence
Works on patterns and root causes over time
Outcome is a known error, permanent fix, or workaround
Service Desk
Provides a single point of contact for users to report issues and request services
Is a practice that includes the function, tools, and procedures for user interaction
Deals with both incidents and service requests
Incident Management
Manages the entire lifecycle of incidents from logging to closure
Is a practice focused solely on unplanned interruptions to service
Does not handle standard service requests like password resets or access grants
Process
Is a set of sequenced steps to achieve a specific goal
Focuses only on the activities and their order
Is a subset of a practice
Practice
Is a set of organisational resources to accomplish an objective
Includes process, but also people, technology, and information
Is broader and more holistic than a process
Mistake
A management practice is the same thing as a software tool or an IT application.
Correct
A management practice is a combination of people, process, technology, and information. The software tool is just the technology component of the practice.
Beginners see a tool like 'ServiceNow' or 'Jira' and think that tool IS the practice. In reality, the practice includes how people use the tool, the workflows they follow, and the knowledge they need.
Mistake
All ITIL 4 management practices are unique to IT and were invented by ITIL.
Correct
Many practices are adapted from general business management, such as Risk Management, Information Security Management, and Relationship Management.
ITIL 4 deliberately makes management practices broader than just IT processes. Beginners assume ITIL only covers technical topics, but it borrows heavily from established business disciplines.
Mistake
The purpose of Problem Management is to fix incidents faster.
Correct
The purpose of Problem Management is to manage the lifecycle of problems, including identifying the root cause of incidents and preventing recurrence. Fixing incidents is the job of Incident Management.
People confuse incident and problem because they sound similar. But the exam strictly separates 'restoring service' (Incident) from 'finding root cause' (Problem).
Mistake
The Service Desk and Incident Management are the same practice.
Correct
The Service Desk is a practice focused on providing a single point of contact for users, while Incident Management is a separate practice focused on managing the lifecycle of incidents.
The Service Desk is often the team that logs and routes incidents, so beginners think they are one practice. The exam tests this distinction directly.
Mistake
Management practices are optional for an organisation; they are just best practice guidelines.
Correct
Management practices are essential organisational capabilities. Without them, an organisation cannot consistently deliver services or manage its operations.
ITIL is framed as a set of 'best practices,' which sounds optional. In reality, the framework describes practices that are necessary for any organisation to function effectively, regardless of whether they use the ITIL terminology.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
There are 34 management practices in ITIL 4. They are divided into three categories: general management practices, service management practices, and technical management practices.
No. The exam only expects you to know the purpose and key terms of the most common practices, such as Incident Management, Problem Management, Change Control, Service Desk, and Service Request Management.
A process is a set of sequenced steps to achieve a goal. A management practice is broader because it includes not only the process, but also the people, technology, and information needed to make that process work effectively.
Resources are the four components that make up a practice: people (roles and competencies), process (procedures and workflows), technology (tools and software), and information (data and knowledge). All four are required for a practice to function.
A trigger is an event that initiates the start of a practice or an activity within a practice. For example, an alert from a monitoring tool is a trigger that starts the Incident Management practice.
The change was made to emphasise that effective management requires more than just process steps. It also requires the right people, technology, and information. Using the term 'practice' reflects this holistic view.
You've finished Introduction to ITIL Management Practices. Continue through the ITIL4F study guide to build a complete picture of the exam.
Done with this chapter?