Select Two (Multi-Select) Questions

Security and compliance teams operate in strict silos, failing to collaborate with business operations ('Collaborate and promote visibility').

Siloed security and compliance teams cannot surface the operational realities that drive non-compliance, so failures persist unseen. The 'collaborate and promote visibility' principle directly addresses this root cause by requiring shared information and cross-functional cooperation, exposing where policies break down in practise.

Policies may be overly bureaucratic and impractical, causing employees to create workarounds and shadow IT ('Keep it simple and practical').

Overly bureaucratic policies push staff towards workarounds and shadow IT, which bypass controls entirely and generate compliance failures. Applying 'keep it simple and practical' removes unnecessary complexity, making compliant behaviour the path of least resistance rather than an obstacle to be circumvented.

Risk management policies may be disconnected from customer and business value streams, making them appear as arbitrary roadblocks ('Focus on value').

When risk policies are detached from value streams, employees perceive them as arbitrary roadblocks and disengage from them. The 'focus on value' principle reconnects controls to business and customer outcomes, so compliance is understood as enabling value rather than obstructing it.

Teams artificially inflate ticket counts or close trivial tasks rapidly to boost productivity numbers.

Inflating ticket counts or rapidly closing trivial tasks shows the KPI rewards volume rather than outcomes. This is a classic dysfunctional metric, where staff optimise the number instead of resolving genuine issues, distorting reporting and degrading real service quality across the value stream.

Employees hide service failures or delays to avoid negative impact on their departmental scorecard.

Concealing failures and delays to protect a departmental scorecard indicates the KPI punishes transparency. When metrics drive blame rather than improvement, staff suppress bad news, so leadership loses visibility of real performance and problems compound undetected until they become critical.

A department meets all its local KPIs while the overall enterprise strategic goals fail.

Local KPIs being met while enterprise strategic goals fail demonstrates sub-optimisation: departments optimise their own measures at the expense of end-to-end value. A well-designed framework aligns departmental metrics with enterprise outcomes, so this divergence signals the KPIs are measuring activity rather than strategic contribution.

Linking cloud infrastructure investments directly to business agility, revenue growth, and risk reduction.

A value-based framework must connect cloud spend to outcomes leadership cares about. Linking infrastructure investment to business agility, revenue growth and risk reduction shifts measurement away from consumption metrics towards strategic impact, satisfying the requirement that the framework accurately captures business value rather than technical activity.

Tracking user adoption and productivity gains rather than simply counting migrated virtual machines.

Counting migrated virtual machines measures activity, not value. Tracking user adoption and productivity gains captures whether migration actually changed how work gets done, satisfying the framework's requirement to reflect genuine business value. This outcome-oriented axis distinguishes a value-based measurement framework from a purely inventory-based migration tally.

Measuring total cost of ownership (TCO) alongside financial return rather than just initial migration costs.

Initial migration costs alone understate the full financial picture. Measuring total cost of ownership alongside financial return captures ongoing operational, licensing and support expenses, satisfying the requirement that the framework accurately reflect business value. This prevents apparently cheap migrations from masking higher long-term running costs.

Focusing the training on how risk management enables secure, continuous software delivery ('Focus on value').

Framing risk management training around secure, continuous delivery directly applies 'focus on value', tying every risk activity to the outcome engineers actually deliver. This satisfies the committee's need for practices aligned to ITIL 4 guiding principles rather than abstract compliance.

Designing short, practical, scenario-based training modules embedded directly into the developer onboarding workflow ('Keep it simple and practical').

Short, scenario-based modules embedded in onboarding embody 'keep it simple and practical', removing unnecessary complexity and fitting training into existing workflow rather than adding separate overhead. This satisfies the stem's requirement for a practice aligned with ITIL 4 guiding principles.

Co-creating the training content with both security experts and software engineers ('Collaborate and promote visibility').

Co-creating content with security experts and software engineers directly enacts 'Collaborate and promote visibility' by breaking silos between disciplines. Cross-functional input surfaces real risks engineers face, improving relevance and adoption. This satisfies the stem's requirement for practices aligned with ITIL 4 guiding principles, specifically the collaboration principle.

Estimated implementation effort, cost, and resource requirements.

Effort, cost and resource requirements form the feasibility axis of ITIL prioritisation, letting the manager filter 50 opportunities against deliverable capacity. Pairing this with business value balances what is worth doing against what can realistically be resourced, preventing an unachievable backlog.

Expected business value and return on investment (ROI).

Expected business value and ROI supply the benefit axis, ranking each opportunity by the outcomes it delivers rather than by ease of delivery. This satisfies the stem's need to prioritise 50 candidates objectively, ensuring investment flows to improvements with demonstrable return.

Failing to align operational metrics and daily tasks with strategic goals.

Operational metrics and daily tasks drifting from strategic goals break the execution link, so staff optimise local activity that delivers no strategic outcome. This pitfall directly causes failure during operational planning, where translation of intent into measurable work determines whether the strategy is actually delivered.

Treating strategy as a one-time static event rather than an ongoing adaptive process.

Strategy must adapt as conditions change; treating it as a static one-time event means plans are never revisited, so execution diverges from reality. During operational planning this pitfall prevents the iterative review and adjustment that keeps delivery aligned with evolving strategic objectives.

Lack of visible commitment and ongoing support from executive leadership.

Without visible executive commitment and sustained sponsorship, operational planning loses prioritisation, funding and authority, so initiatives stall. This pitfall directly undermines execution because middle management cannot resolve competing demands or secure resources without demonstrable leadership backing.

Eliminating redundant approval steps that do not add measurable risk mitigation or business value.

Redundant approval steps consume effort without reducing risk or adding value, so removing them directly embodies Keep it simple and practical. This satisfies the compliance scenario because the framework retains genuine risk mitigation while eliminating bureaucratic layers that slow delivery and dilute focus.

Focusing on the absolute vital few controls that manage the greatest threats rather than trying to control everything equally.

Prioritising the vital few controls concentrates finite resources on the threats posing the greatest risk, which directly satisfies the 'simple and practical' principle by avoiding unmanageable control sprawl. Treating every control with equal rigour dilutes effort and creates bureaucracy, so this targeted approach keeps the framework workable and proportionate to actual enterprise risk exposure.

Designing clear, straightforward policies that frontline staff can easily understand and execute.

Clear, straightforward policies directly satisfy the simplicity principle by reducing cognitive load on frontline staff, who must execute controls without specialist compliance training. Complex wording creates ambiguity and workarounds, undermining the framework's practical adoption. This option therefore addresses the stem's demand for practical, executable guidance rather than theoretical completeness.

It integrates direction, planning, and improvement into a universal approach applicable across the entire SVS.

DPI unifies direction, planning and improvement into one approach spanning the whole Service Value System, not a single practice or lifecycle stage. This matches the stem's scope-and-purpose constraint by confirming universal applicability across all SVS components.

It equips practitioners with practical methods to align strategy with daily operations.

DPI bridges the gap between strategic intent and operational delivery, equipping practitioners with practical methods to translate high-level objectives into daily work. This directly satisfies the stem's requirement for a statement describing the module's scope and purpose, since alignment of strategy with operations is DPI's core focus.

Average cycle time from improvement idea intake to final implementation.

Cycle time measures improvement velocity directly, tracking how quickly ideas progress from intake through to implementation. It satisfies the velocity half of the balanced assessment, complementing value-realisation metrics such as outcome achievement and ROI that address the other dimension.

Percentage of completed improvement initiatives that successfully achieved their pre-defined target outcomes.

Tracking the percentage of completed initiatives meeting pre-defined target outcomes measures value realisation, confirming improvements delivered intended benefits rather than merely being implemented. It satisfies the value half of the balanced assessment, complementing velocity metrics such as cycle time.

Calculated Return on Investment (ROI) or cost savings generated by implemented improvements.

Calculated ROI or cost savings quantifies the financial value realised from implemented improvements, evidencing tangible benefit rather than activity alone. It satisfies the value-realisation dimension of the balanced assessment, complementing velocity metrics such as cycle time.

Allocating necessary resources, funding, and talent for tactical execution.

Allocating resources, funding, and talent ensures tactical execution is resourced rather than aspirational, which is vital when operational plans cascade from strategy. Without this, plans stall at intent; it directly satisfies the stem's execution consideration.

Establishing feedback loops to monitor progress and adjust tactical steps.

Feedback loops provide the iterative control mechanism that links strategic intent to tactical execution, enabling plans to be adjusted as conditions change. This satisfies the cascade requirement by ensuring operational steps remain aligned with the digital transformation strategy rather than drifting once set.

The value streams, products, and services delivered to customers

Value streams, products and services define what direction, planning and improvement actually cover, since DPI scopes these activities around the customer-facing outputs an organisation delivers. This satisfies the requirement to bound scope by what creates and delivers stakeholder value.

The governance structures, policies, and risk thresholds of the organization

Governance structures, policies and risk thresholds define the boundaries within which direction, planning and improvement operate, directly satisfying the scope-setting constraint in the stem. They determine decision rights and acceptable risk, ensuring strategic agility stays aligned with organisational control.

The overarching organizational strategy, vision, and stakeholder expectations

Strategy, vision and stakeholder expectations supply the long-term destination and value criteria that direction, planning and improvement must serve. Without them, scope definition lacks the alignment anchor the stem requires, so this factor directly satisfies the constraint.

Pause low-value projects to free up stakeholder bandwidth for critical transformations.

Pausing low-value projects releases scarce stakeholder time and attention, directly restoring the bandwidth consumed by competing initiatives. This satisfies the change-fatigue constraint because fatigue stems from cumulative demand exceeding capacity, so reducing non-critical workload preserves energy for the transformation.

Prioritize and sequence change initiatives based on organizational absorptive capacity.

Sequencing initiatives according to absorptive capacity paces change to what the organisation can genuinely absorb at any point. This satisfies the change-fatigue constraint by preventing overlapping demands that exhaust stakeholders, spreading transformation effort across a realistic timeline rather than compressing everything simultaneously.

Workflow assignees and status transition rules (e.g., To Do, In Progress, Done).

Workflow assignees and status transition rules assign ownership at each stage and control how items move between To Do, In Progress and Done, directly delivering the accountability and transition management the stem requires for improvement items.

Custom fields for Value, Effort, and Strategic Alignment scores.

Custom fields capturing Value, Effort and Strategic Alignment scores let the organisation rank and prioritise improvement items objectively. They support scoring and comparison of backlog entries, complementing workflow controls by quantifying which improvements merit attention.

Internal Business Processes Perspective

The Internal Business Processes perspective assesses operational capabilities and process effectiveness, satisfying the stem's constraint of evaluating internal capabilities rather than financial or customer results. It pairs with Learning and Growth, which covers future readiness, while Financial and Customer perspectives address results.

Learning and Growth Perspective

The Learning and Growth Perspective measures the intangible enablers of future performance: employee skills, training, information systems and organisational culture. It satisfies the stem's requirement for a perspective assessing future readiness, rather than the financial or customer outcome perspectives.

Publish regular updates on the Continual Improvement Register, highlighting completed initiatives and realized value.

Publishing register updates directly satisfies the transparency requirement: stakeholders see which improvements are complete and the value realised, sustaining engagement across the enterprise-wide campaign. Visibility of outcomes builds trust and demonstrates that improvement effort converts into measurable business benefit.

Celebrate milestones and recognize teams that contribute valuable improvement ideas.

Celebrating milestones and recognising contributors satisfies the engagement requirement by reinforcing desired behaviour. Visible recognition sustains momentum across an enterprise-wide campaign, showing teams their improvement ideas are valued and adopted, which encourages continued participation and idea generation.

Trusted local peers and direct supervisors are often the most effective messengers for change.

Change adoption depends on credible messengers: trusted local peers and direct supervisors carry more influence than distant senior leaders because they understand local context and consequences. This satisfies the stem's principle that communication effectiveness hinges on the sender's proximity and credibility.

Messages should be delivered through multiple, reinforced communication channels.

Reinforcing messages across multiple channels increases reach, repetition and accessibility, countering the noise and selective attention that erode change communication. This satisfies the stem's requirement for a core principle that sustains awareness and understanding throughout organizational change.

Eliminating non-value-adding activities and reducing waste.

Lean value stream optimisation targets the elimination of non-value-adding activities and waste, directly increasing flow efficiency and reducing lead time. This satisfies the critical consideration of maximising delivered value by stripping out steps the customer would not pay for.

Analyzing the flow of work to locate bottlenecks and constraints.

Analysing work flow exposes bottlenecks and constraints that throttle throughput, allowing planners to address the limiting factor rather than optimising non-critical stages. This satisfies the optimisation requirement by focusing improvement where it actually accelerates end-to-end value delivery.

Identifying what creates value from the perspective of the customer.

Value must be defined by the customer's perception, not internal assumptions, otherwise optimisation improves activities that deliver nothing the customer wants. This satisfies the critical consideration by anchoring the entire value stream around externally validated outcomes.

Integrating risk and compliance professionals directly into agile scrum teams as active participants.

Embedding risk and compliance specialists within scrum teams satisfies the stem's agile delivery constraint by shifting governance from periodic gatekeeping to continuous, collaborative engagement. This aligns with ITIL 4's collaborate-and-promote-visibility principle, letting compliance expertise shape backlog decisions in real time rather than arriving as late-stage audit findings.

Designing lightweight, risk-based compliance gates that scale according to the business criticality of the application.

Risk-based gates scaled to application criticality satisfy the stem's need to reconcile regulatory rigour with agile speed. Rather than uniform heavyweight controls, proportionality directs scrutiny where business impact is greatest, embodying ITIL 4's progress-iteratively-with-feedback and keep-it-simple-and-practical principles while preserving compliance assurance.

Replacing annual monolithic compliance audits with continuous, automated compliance monitoring.

Continuous automated monitoring replaces point-in-time annual audits, satisfying the stem's agile delivery constraint by detecting drift as it occurs rather than months later. This embodies ITIL 4's progress-iteratively-with-feedback principle, embedding compliance evidence generation into delivery pipelines and reducing the remediation burden of retrospective monolithic audits.

SLAs measure internal technical milestones rather than true end-user business outcomes and experience.

SLAs tracking internal technical milestones can be met while user experience stays poor, because they measure component performance rather than end-to-end business outcomes. This disconnect explains high satisfaction gaps despite 99% compliance, satisfying the stem's request for likely reasons.

SLAs may be set based on what IT finds easy to measure rather than what matters to the customer.

SLAs built around metrics IT can easily instrument, such as uptime or ticket closure counts, may omit the customer's actual service outcomes. Meeting 99% of internally defined targets therefore fails to translate into satisfaction, because the measured axis does not reflect perceived value or experience.

Taking the opportunity to clean up and simplify outdated, bureaucratic control procedures during the migration ('Keep it simple and practical').

Legacy GRC tools accumulate redundant, bureaucratic controls that would otherwise be replicated wholesale into ServiceNow. Applying 'keep it simple and practical' during migration lets the organisation retire obsolete procedures rather than porting them, reducing configuration effort and future maintenance overhead while satisfying the stem's demand for critical guiding principle considerations.

Phasing the migration module by module (e.g., Policy compliance first, then Risk, then Vendor Risk) ('Progress iteratively with feedback').

Migrating every GRC module simultaneously creates a single, high-risk cutover with no opportunity to learn. Delivering Policy compliance first, then Risk, then Vendor Risk generates feedback at each stage that informs subsequent modules, directly enacting 'progress iteratively with feedback' and reducing the blast radius of design errors.

Assessing existing controls and data structures in the legacy tool before planning the migration ('Start where you are').

Mapping existing controls, data structures and relationships in the legacy platform before designing the ServiceNow target prevents loss of institutional knowledge and avoids rebuilding what already works. This directly applies 'start where you are', grounding migration decisions in the organisation's actual current state rather than an idealised greenfield design.