Why should I measure my ITAM maturity?

Measuring ITAM improvement

In ITAM we’re fortunate that we can usually measure success and evidence our improvements by looking at the amount of money we’ve saved, or costs that we’ve avoided… but as many ITAM managers will know, while cost savings and cost avoidance can be high in the first few years, after a while it becomes more and more difficult to find them as you start running a leaner and meaner ship. The other issue is that (believe it or not) not all organisations have saving money as their primary driver for ITAM. Some of them are focused on supporting information security or being able to demonstrate they comply with regulatory requirements, while others may be focused on providing high levels of service to their employees and customers, so that no one gets stuck in the position of not being able to work because the approvals for equipment or software they need haven’t come through yet.

While these things can be measured, it is much harder, and often ITAM only plays a small part in achieving these business outcomes. Performing regular process maturity and process capability assessment gives you a baseline to measure improvement from one year to another, not only showing that you’ve improved during that period, but also showing where you’ve improved, so you can demonstrate you’re focusing on the right areas.

Longer term, we’re planning to offer the ability to benchmark your ITAM system against the results of other organisations, so you can see where you sit by industry, organisation size etc.

Tailoring your improvement efforts

Not only does a maturity and capability assessment help you benchmark and evidence your improvement over time, it can also help you identify areas where you could potentially do better. This is particularly the case if you have a clear picture of what your organisational goals are, then compare the detail of your assessment results against the processes which support those organisational goals.

To help you do this, we’ve identified 6 strategic ITAM related goals that your organisation may be working towards. These are:

• Cost control and cost savings and avoidance
• Business agility
• Information security
• Employee satisfaction
• Sustainability

We’ve aligned our questions with each of these business drivers, so you can see how your process maturity and capability scores tee up. Cross-reference this against your processes, and you can identify which processes you should be actively improving to ensure that you have true alignment between your ITAM activities and the reasons your organisation is asking you to manage your IT assets in the first place.

Demonstrating that direct connection between your organisation’s strategic ITAM drivers and the processes that support their achievement will also help justify and build the business case for implementing future process improvements.

Demonstrating regulatory compliance

Organisations in highly regulated businesses, such as finance or health care are often audited for information security and operational resilience capabilities by regulators and customers (as a result of know-your-supplier requirements). A high level of process maturity, where you have document your processes and actively measure conformance makes it much easier to evidence compliance with regulatory requirements and demonstrate that assets are effectively controlled and managed.

Working towards ISO19770-1 certification

ISO19770-1 is the International Standard for IT Asset Management. It is possible for organisations to certify themselves against the Standard. The ISO readiness add-on is designed to measure how well your IT asset management system is aligned to the Standard, and provide a cost effective way to identify areas where additional work could be completed before beginning the certification process.

According to the ITAM Forum, which helped establish the ISO19770-1 certification programme, the benefits of ISO19770-1 include the ability to:

• Demonstrate good governance to internal stakeholders – because ISO19770-1 is certified by external parties, certification demonstrates to senior managers that an effective ITAM system is in place.
• Demonstrate good governance to external stakeholders – while regulators are the most obvious external stakeholders, customers and shareholders also have an interest in understanding how well IT assets are managed.
• Monitor for/ prevent future risks – an effective IT asset management system incorporates risk management processes to identify and mitigate potential risks such as software licensing compliance and / or information security risks before they become issues. Poor ITAM poses organisational level risks such as financial risk, reputational risk and operational resilience.
• Raise your organisation’s profile – certification demonstrates the commitment of your organisation to ITAM, making it easier to recruit ITAM staff, and it may also carry incidental benefits, as reducing the chance of a software audit, as your certification is strong evidence that your IT assets are well managed and controlled.