ITIL 4 Foundation exam objective 2.3 asks you to explain the purpose and key activities of three specific service management practices. Without these three practices, an organisation would have no idea what technology it owns, no way to tell when something breaks, and no clear list of what IT services are available — think of a company where nobody knows who has which laptop, where no one gets paged when the website crashes, and where employees have to guess how to request printer access.
Jump to a section
A simple way to picture Service Management Practices (Part 4): IT Asset, Monitoring and Event, and Service Catalogue Management
A car fleet manager keeps a detailed log of every vehicle the company owns. This log includes the car's make, model, number plate, purchase date, warranty expiry, service history, and current driver. IT Asset Management (ITAM) works exactly like this: it tracks every piece of technology the organisation owns — laptops, servers, software licences, network switches — and records who uses each item, when it was bought, and when it needs replacing. The manager also updates the log when a car is sold or a new one is acquired.
Now, think about that fleet manager's real-time monitoring system. GPS trackers in each car report speed, fuel level, and engine warnings. A dashboard flags unusual activity — 'Car 12 has been idling for three hours' or 'Car 7's tyre pressure is low.' This is Monitoring and Event Management. The IT version watches servers, applications, and network traffic, sending alerts when something unusual happens (an event) — like a website becoming slow or a hard drive filling up. An event might be routine ('system is fine') or a warning ('disk space at 85%') or outright bad ('server offline'). The IT team responds based on the type of event.
Finally, imagine a central registry where every employee can look up 'Which cars are available for Tuesday's sales trip?' or 'What is the policy for booking a van?' That registry lists all services the fleet provides, with descriptions and how to request them. This is the Service Catalogue. In IT, the service catalogue tells employees: 'Here are all the IT services you can use — email, cloud storage, printer setup, VPN access — and here’s how to get them.' Together, these three practices (ITAM, Monitoring and Event Management, and Service Catalogue Management) give the organisation full visibility over IT assets, IT service health, and IT service offerings.
Let's break down each of the three practices one by one. They are separate but connected: IT Asset Management (ITAM) tells you what you have. Monitoring and Event Management tells you what is happening to it. Service Catalogue Management tells everyone else what they can ask for.
IT Asset Management (ITAM) is the practice of tracking and managing all the technology items (assets) that an organisation owns or uses. An IT asset can be hardware (like a laptop, server, router, or mobile phone), software (like a licence for Microsoft Office or Adobe Photoshop), or even cloud subscriptions (like a monthly AWS account). The core purpose is financial and physical control — knowing what you have, where it is, who uses it, when it was bought, and when it needs upgrading or retiring. Key activities include recording each asset in a database (often called a Configuration Management Database or CMDB), assigning a unique identifier (like a serial number tag), tracking its lifecycle from acquisition through deployment, maintenance, and finally disposal (decommissioning). ITAM replaces the old chaotic approach where departments bought their own laptops with no central record, leading to wasted money on duplicate purchases and security risks from unmanaged devices. For example, if an employee leaves, ITAM tells the IT team which laptop they used, so it can be wiped and reassigned.
Monitoring and Event Management is the practice of watching IT systems (servers, networks, applications) and responding to events that occur. An event is any change of state that has significance for the management of an IT service or configuration item — this could be a server going offline, a hard drive reaching 90% capacity, a user logging in, or a scheduled backup completing successfully. The purpose is to ensure normal service operation by detecting problems early and triggering the right response. Key activities include setting up monitoring tools (like SolarWinds, Nagios, or Datadog) to collect metrics (CPU usage, memory, response time). These tools generate alerts when certain thresholds are crossed. Events are categorised into three types:
Informational events — routine occurrences like 'Backup completed successfully' or 'User logged in.' No action needed, but they are logged for records.
Warning events — unusual situations that may need attention, like 'Disk space at 80%' or 'CPU usage above 80% for 10 minutes.' The IT team checks but may not act immediately.
Exception events — critical failures like 'Server offline' or 'Application crash.' These trigger immediate incident management (a separate practice) to fix the problem.
Monitoring and Event Management replaces the old 'wait for a user to call and complain' approach. Instead of discovering a website is down when a customer complains, the IT team sees the alert and fixes it before most users notice.
Service Catalogue Management is the practice of maintaining a single, accurate list of all IT services that are available to customers. A service is something that delivers value to customers by facilitating outcomes they want to achieve (like email, file storage, or customer support software). The service catalogue is the single source of information on all services in the live environment — it tells customers what services they can request, how to request them, how much they cost (if there is chargeback), and what service levels they can expect (like uptime guarantees). Key activities include defining services in clear, non-technical language (no jargon: 'Email service' not 'Exchange 2019 on-prem'), keeping the catalogue up to date when services change, and making it easily accessible (often via a company intranet or portal). The service catalogue has two views: the customer-facing view (what users see) and the supporting view (technical details for IT staff). Service Catalogue Management replaces the old situation where employees had to email their IT friend to ask 'How do I get a VPN?' or 'Is there a project management tool I can use?' — now they just look in the catalogue.
These three practices work together. ITAM tracks the assets that underpin services. Monitoring and Event Management watches those assets and the services they support. The Service Catalogue tells users what they can expect from those services. All three are essential for ITIL 4 Foundation candidates to understand because they appear frequently in exam questions about service management practices.
Step 1: Inventory all IT assets (ITAM)
The organisation creates a complete list of every technology item it owns or uses. This includes hardware (laptops, servers, switches), software (operating systems, applications), and cloud subscriptions. Each asset gets a unique identifier (serial number or asset tag) and its details are recorded in an asset database, often part of a Configuration Management Database (CMDB). This step is the foundation for ITAM — without knowing what you have, you cannot manage it.
Step 2: Track the asset lifecycle (ITAM)
For each asset, the IT team records key lifecycle dates: purchase date, warranty start/end, last service date, current status (in use, spare, decommissioned), and assigned user. When an asset is transferred to a new user, the record is updated. When it is disposed of (e.g., sold or recycled), the record is closed with a disposal date and method. This lifecycle tracking helps control costs (no unnecessary purchases) and manage security risks (no lost devices with sensitive data).
Step 3: Define what to monitor and set thresholds (Monitoring and Event Management)
The IT team decides which services and components need monitoring — typically critical servers, core applications, network links, and customer-facing websites. They set thresholds: for example, 'Alert if CPU usage exceeds 80% for 10 minutes' or 'Alert if website response time exceeds 2 seconds.' This step also defines what counts as an informational event (e.g., backup completed), a warning event (e.g., disk 80% full), and an exception event (e.g., server offline). Clear thresholds prevent alert fatigue from too many false alarms while ensuring real problems are caught.
Step 4: Monitor and respond to events (Monitoring and Event Management)
Monitoring tools (like Zabbix, Datadog, or Nagios) continuously collect metrics from monitored components. When a metric crosses a threshold, the tool generates an event and categorises it (information, warning, exception). For warning events, the IT team investigates but may not act immediately. For exception events, the team creates an incident ticket (using a separate incident management practice) and takes action to restore service. All events are logged for audit and trend analysis.
Step 5: Build and maintain the Service Catalogue (Service Catalogue Management)
The IT team identifies all live services (email, file storage, VPN, printer support, etc.) and writes a description for each in simple, user-friendly language. They add details: how to request the service (e.g., a web form), expected turnaround time (e.g., 'password reset within 2 hours'), cost (if any), and eligibility (e.g., 'available to all employees'). The catalogue is published on an intranet or self-service portal. It is regularly reviewed to add new services, retire old ones, and update details. This step ensures employees know what IT offers and how to get it without calling the helpdesk for basic information.
Step 6: Align the three practices (ITAM, Monitoring, Catalogue)
The final step is ensuring these practices work together. ITAM data tells the monitoring team which assets to watch (e.g., 'We have five database servers — monitor all of them'). Monitoring data can reveal assets that need updating (e.g., 'Server X has been offline for days — its asset record should be checked'). The Service Catalogue may reference assets ('The file storage service uses Server Y and Z'). In a mature organisation, these systems are integrated so that a change in one practice updates the others automatically.
Let's walk through a realistic scenario at a mid-sized company called 'BrightBooks', which sells educational software to schools. BrightBooks has 500 employees and runs its own servers in a small data centre.
Step 1: ITAM in action. The IT manager, Priya, uses a spreadsheet (later migrating to a proper ITAM tool like ServiceNow). She records every laptop: serial number, assigned employee, purchase date (2022-09-15), warranty expiry (2025-09-15), and software installed. When Sarah joins the finance team, Priya assigns her a Dell Latitude laptop from the 'spare' stock. The asset record moves from 'spare' to 'in use — Sarah.' When Sarah leaves six months later, Priya retrieves the laptop, updates the record to 'decommissioned,' and wipes the hard drive. Without ITAM, the laptop would be lost, and BrightBooks might buy a new one unnecessarily.
Step 2: Monitoring and Event Management in action. BrightBooks's main website runs on two web servers (Web-01 and Web-02). Priya sets up a free monitoring tool called Zabbix. It checks every five minutes that the servers respond to a ping (a simple test to see if the server is alive). One Tuesday at 2:03 p.m., Zabbix detects that Web-01 is not responding. This is an exception event. Zabbix sends an email alert to Priya's phone. She checks and finds Web-01 has crashed due to a memory leak. She restarts the server — the whole thing takes 12 minutes. If there were no monitoring, the first sign of trouble would be a customer email at 3:00 p.m. saying 'Your site is down!' — by which time BrightBooks has lost sales and credibility.
Step 3: Service Catalogue Management in action. BrightBooks's employees use a self-service portal built with a tool like Jira Service Management. The portal shows a list of all IT services:
Email and Calendar (Microsoft 365) — request a new account or password reset.
File Storage (SharePoint) — request a new team site or extra storage.
VPN Access — request for remote work (requires manager approval).
Printer Setup — request for a new printer or toner cartridge.
Software Requests — list of approved applications (Microsoft Office, Adobe Acrobat, Slack) that employees can install with one click.
When the marketing team needs a new project management tool (say, Asana), they first check the service catalogue. It lists 'Project Management Software' and notes that Asana is available but requires manager approval and a budget code. Without a catalogue, the marketing manager would email Priya: 'Can we get Asana?' Priya would then have to figure out if they already have it, what it costs, and whether it's approved — wasting both their time.
The ITIL 4 Foundation exam expects you to recognise that these three practices are part of the 'General Management Practices' (ITAM) and 'Service Management Practices' (Monitoring and Event Management, Service Catalogue Management). They are not just theory — they are what IT teams do every day.
ITIL 4 Foundation exam questions on these three practices usually fall into a few predictable patterns. The exam tests your ability to match the practice name to its PURPOSE (the 'why') and its KEY ACTIVITIES (the 'what you do'). You rarely need to memorise detailed steps — just the core concept.
Common question types:
Definition matching: They give you a short scenario and ask 'Which practice does this describe?' Example: 'An IT team records the purchase date, warranty status, and current user of all company laptops.' The answer is IT Asset Management. Trap: candidates sometimes confuse ITAM with Configuration Management (CMDB) — ITAM focuses on lifecycle and financial control, while Configuration Management focuses on relationships between components.
Purpose identification: They ask you to select the correct purpose statement for a practice. For Monitoring and Event Management, the purpose is 'to systematically observe services and service components and to detect and respond to events.' Trap: they might include a distractor like 'to resolve incidents' — that is Incident Management, not Monitoring and Event Management. Monitoring detects, but Incident Management resolves.
Activity listing: They ask 'Which is a key activity of Service Catalogue Management?' Correct answer: 'Maintaining a single, accurate view of all live services and their details.' Trap: they might list 'adding new services to the catalogue' (which is correct) but also 'removing assets that are no longer needed' (which is ITAM).
Concepts the exam loves to test:
The three event types: informational, warning, exception. You will get a question like 'A monitoring tool sends an alert that disk space is at 75%. What type of event is this?' Answer: Warning (because it is unusual but not yet critical; 95% might be exception). Trap: they might call it 'informational' — but informational events are routine, like 'backup completed successfully.'
The Service Catalogue's two views: customer-facing view (simple language) and supporting view (technical details). The exam may ask 'Which view contains technical specifications?' Answer: Supporting view.
The difference between an asset and a configuration item (CI). An asset is something you manage financially (cost, depreciation). A CI is something you manage technically (how it connects to other things). For ITIL4F, know that ITAM manages assets, but service management practices also use configuration management (not in this chapter).
Key definitions to memorise for the exam:
IT Asset Management: 'The practice of planning and managing the full lifecycle of all IT assets to maximise value, control costs, manage risks, and support decision-making.'
Monitoring and Event Management: 'The practice of systematically observing services and service components and of detecting and responding to events.'
Service Catalogue Management: 'The practice of providing a single source of consistent information on all services and ensuring that it is available to those who are authorised to access it.'
Traps to watch for:
The exam sometimes pairs Monitoring and Event Management with Incident Management in a scenario. Remember: Monitoring detects events; Incident Management fixes incidents. An event can become an incident (e.g., a server crash event triggers an incident ticket). But they are separate practices.
ITAM is sometimes confused with 'Software Asset Management' (SAM). ITAM covers all assets (hardware and software). SAM is a subset. The exam may use the general term 'IT Asset Management' unless it specifies SAM.
Service Catalogue Management is not the same as 'Service Portfolio Management.' The portfolio includes all services (including those in development or retired), while the catalogue only includes live, available services. The exam tests this distinction.
Study tip: create flashcards for each practice: one side says the name, the other side says the purpose and two key activities. Practice matching scenarios to practices. Real exam questions often start with 'A company wants to...' and then you pick the practice.
IT Asset Management tracks all technology assets (hardware, software, cloud) through their full lifecycle from purchase to disposal to control costs and reduce risk.
Monitoring and Event Management systematically watches IT services and components to detect informational, warning, and exception events so the team can respond proactively.
Service Catalogue Management provides a single, accurate, user-friendly list of all live IT services with details on how to request and expect from each one.
An 'event' in ITIL is any change of state that matters — it can be routine (informational), unusual (warning), or critical (exception), and only exception events typically trigger incident management.
The Service Catalogue has two views: the customer-facing view (simple language, what users see) and the supporting view (technical details for IT staff).
ITAM, Monitoring and Event Management, and Service Catalogue Management work together to give the organisation visibility over what IT has, what IT is doing, and what IT offers — filling the biggest gaps in unmanaged IT environments.
Real IT teams use tools like ServiceNow, SolarWinds, and Jira Service Management to implement these practices, but the core concepts (lifecycle tracking, event classification, service listing) are what the ITIL4F exam tests.
Candidates commonly confuse Monitoring and Event Management with Incident Management — remember: monitoring detects, incident management resolves.
ITAM is not just for hardware; software licences and cloud subscriptions must be tracked or the organisation risks paying for unused resources or facing audit fines.
The purpose of Service Catalogue Management is to provide consistent, accessible information — not just to list services but to ensure everyone uses the same process to request them.
These come up on the exam all the time. Here's how to tell them apart.
IT Asset Management (ITAM)
Focuses on financial value and lifecycle (purchase, depreciation, disposal)
Tracks individual assets (laptops, software licences, cloud accounts)
Answers: 'What do we own, how much is it worth, and where is it?'
Configuration Management
Focuses on technical relationships and dependencies between components
Manages configuration items (CIs) and their links to each other
Answers: 'If we change Server A, which databases and services will be affected?'
Monitoring and Event Management
Detects and categorises events (informational, warning, exception)
Does not fix problems — only observes and alerts
Its purpose is to systematically observe and detect changes of state
Incident Management
Resolves incidents that disrupt normal service operation
Takes action (restart server, restore backup) to restore service
Its purpose is to minimise negative impact by restoring normal service as quickly as possible
Service Catalogue
Only includes live services that are available for use
Provides operational details (how to request, costs, service levels)
Is the view that customers and users interact with directly
Service Portfolio
Includes all services (pipeline, live, and retired)
Provides strategic and planning information for service management
Is used by IT managers and planners, not typically by end users
Mistake
IT Asset Management is just about tracking hardware like laptops and servers.
Correct
IT Asset Management tracks all types of technology assets, including software licences, cloud subscriptions, and digital certificates — anything with a financial value and lifecycle.
Beginners often think only physical hardware matters, but software licences can be the most expensive part of an IT budget and are a major source of audit risk if not tracked.
Mistake
Monitoring and Event Management is the same as Incident Management because both deal with problems.
Correct
Monitoring and Event Management detects events (including routine events like a backup completion) and triggers alerts. Incident Management is a separate practice that handles the actual disruption to a service — they work together but are distinct.
The exam deliberately blurs these two practices because in real life they are closely connected. Candidates must remember that monitoring observes, incident management fixes.
Mistake
The Service Catalogue is just a list of software that IT supports, like a menu.
Correct
The Service Catalogue includes all IT services (hardware, software, support, cloud services, facilities like remote access) and provides details on how to request them, service levels, costs, and eligibility — it is more like a full menu with descriptions, prices, and ordering instructions.
Beginners simplify the catalogue to a software list because that is the most visible part, but ITIL defines it broadly to include every service that delivers value to customers.
Mistake
IT Asset Management and Configuration Management are the same thing.
Correct
IT Asset Management focuses on financial lifecycle and asset value (cost, depreciation, disposal), while Configuration Management focuses on relationships between components and their technical attributes (e.g., which server connects to which database).
Both use a database (often a CMDB), but the data they store and the purpose are different. The exam may test this distinction by asking which practice would handle a software licence expiry vs. a server connectivity issue.
Mistake
Monitoring only matters for servers and networks, not for applications or services.
Correct
Monitoring and Event Management covers every service component, including applications (web servers, email software, databases), user experience (load times, error rates), and even physical infrastructure (temperature in server rooms).
Beginners think of monitoring as a server-only activity because it was traditionally done for hardware, but modern IT monitors everything from API response times to battery backups.
Mistake
If you have a good ITAM tool, you do not need a separate Service Catalogue Management practice.
Correct
ITAM tracks assets; Service Catalogue Management tracks services. An asset (like a server) may support multiple services (email, web hosting, database). The catalogue describes what users experience, not what hardware is underneath. They are complementary but separate.
Candidates sometimes merge these because both involve 'cataloguing' things, but the subject is different — assets vs. services.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
An asset is any resource with financial value that the organisation manages through its lifecycle (e.g., a laptop, a software licence). A configuration item is something that is managed as part of the IT infrastructure and has relationships with other CIs (e.g., a server, a database, a network switch). In ITIL 4, IT Asset Management focuses on assets, while Configuration Management focuses on CIs and their relationships.
No. Monitoring and Event Management only detects and categorises events. If an exception event occurs (like a server crash), the monitoring tool triggers an alert, but the actual fixing of the server is handled by Incident Management or Problem Management practices.
The exam tests three event types: informational (routine, e.g., backup successful), warning (unusual but not critical, e.g., disk 80% full), and exception (critical failure, e.g., server offline). You must be able to identify which type a given scenario describes.
No. The Service Catalogue only includes services that are live and available for use. The Service Portfolio includes all services — including those in the pipeline (being developed) and those that have been retired. The catalogue is a subset of the portfolio.
No. The ITIL 4 Foundation exam never asks about specific vendor tools (like ServiceNow or SolarWinds). It tests the practices — the purpose, key activities, and concepts. Tools are just examples for understanding, but you will not be tested on them.
Without ITAM, an organisation does not know which devices hold sensitive data, which software is outdated (unpatched and vulnerable), or which devices are lost or stolen. This creates security gaps that attackers can exploit. ITAM provides the inventory needed to apply security patches, enforce encryption, and manage device disposal properly.
No, an event is categorised as one of the three types based on its severity. A warning (e.g., disk at 80%) is not yet an exception (disk at 95% or drive failure). However, a warning event may escalate to an exception if ignored — but the initial event category is determined at detection time.
You've finished Service Management Practices (Part 4): IT Asset, Monitoring and Event, and Service Catalogue Management. Continue through the ITIL4F study guide to build a complete picture of the exam.
Done with this chapter?