1 Introduction

IT service management (ITSM) best practices are used globally by thousands of IT companies. Many IT companies consider ITSM as a key improvement target in the near future and consider it as a strategic tool for surviving in increasing competition. Successful ITSM requires coordination and control by IT service governance (ITSG). Poor ITSG may cause several types of challenges for IT service provider organizations (e.g. lack of the systematic measurement system, unclear decision making structure, and difficulties in showing that management is committed in ITSM).

Service governance models should be established to help IT service providers to create a governance function with a service management system that in turn enables organization to systematically improve its service operations. This paper extends the case study of our conference paper [1] by presenting a theory-based generic IT governance framework that addresses both ITSG and IT service management aspects. Additionally, this study shall present a broader roadmap of ITSM frameworks. ITSM is based on three main elements: people, process and information technology [2]. Skilled IT service management people are needed to provide customers with world-class service experiences. People assets can be seen both capabilities and resources. People can possess experiences, skills and knowledge [3]. In order to ensure continuous learning, IT service provider organizations should emphasize the People element through effective competence management. Managers should motivate employees to participate in ITSM training and reward people from service achievements. Training is a powerful way to decrease the change resistance of employees regarding ITSM.

The process element is needed to repeat daily work activities in the same order and to provide standardized outputs as a result of the process. The last element information technology enables effective ITSM-related knowledge capture, sharing and reuse. The use of technology in ITIL implementation projects can be seen as a critical activity [4] because processing thousands of service incidents per week manually does not make any sense. A cloud-based service [5] is a good example of an IT service where information technology plays a major role but skilled people are still needed to configure self-service portals. An IT service provider organization may use service management architecture [6] as a modeling tool for organizing service management tools, people and processes.

In this paper, we explore differences between IT service governance and ITSM within IT governance. The research topic is important because it distinguishes ‘enabling’ governance factors of IT services from daily ‘operating’ service management factors. Much has been written on implementation and improvement of ITSM processes. These IT service management studies have primarily focused on service design, service operation, service transition and continual service improvement. Studies on service design have dealt especially with service continuity management [7] and availability management [8]. IT service operation studies have focused on predicting incident management lifecycle [9], improving incident management processes [10], establishing knowledge base systems for problem management [11] and exploring problem management from the viewpoint of corrective maintenance [12].

Regarding service transition, IT service release management process has been discussed from the perspectives of product portfolio management [13] and integrated release and patch management [14]. Furthermore, there are studies that have addressed success factors in ITIL implementations [15, 16] and ITIL implementations failures [17]. One of the factors reported by Sharifi et al. [17] was the failure to assign process managers. This is directly related to service governance because top management should be responsible for assigning resources for ITSM processes.

Empirical studies on IT governance use terms ‘IT governance’, ‘IT management’, ‘service governance’, ‘IT service management’ in mixed ways. Brown et al. [18] defines IT governance as “application of governance to an IT organization and its people, processes and information to guide the way those assets support the needs of the business“. They propose a SOA governance model to create a bridge between corporate governance and IT governance. A study [19] on ICT management frameworks in the South African banking industry indicated that commonly used frameworks were COBIT, Information Technology Infrastructure Library (ITIL), Capability Maturity Model and CMMI. Through ICT management processes IT providers can manage, measure and improve their services and also calculate costs of services. Rajamäki and Vuorinen [20] have presented a framework for IT service governance that consists of service strategy, the cycle for planning, implementing and operating services, integrated supplier, measurement and scorecard. However, the framework is too generic for our purposes.

Based on IT service management literature, we have identified that many IT service providers are interested in using several IT service management frameworks, standards and models together. For example, De La Camara et al. [21] have dealt with integration between standards of governance and IT management in Projects in Controlled Environments (PRINCE2) framework. They report that the connection between these frameworks is especially visible in a project business case. Barafort, DiRenzo and Merlan [22] have studied the combined use of ISO/IEC 15504 with the Information Technology Infrastructure Library (ITIL). There are also studies that aim at integrating ITSM and CMMI approaches for process improvement [23]. Furthermore, Bin-Abbas and Bakry [24] have presented an integrated IT governance assessment framework based on ITIL [25], COBIT [26], ISO/IEC 20000 service management standard [27] and ISO 38500 corporate IT governance standard [28].

Significantly more academic research is needed to study the interface between IT service management and service governance. The research topic is valuable because service governance builds the foundation for ITSM processes in the form of service management system and sets direction in form of strategy, policies and objectives.

The main contribution of this study is to:

  • establish a framework for IT service governance based on the existing IT service management frameworks and standards,

  • identify which service quality models, frameworks and standards IT service provider organizations use,

  • discuss the differences of IT service management and service governance, and

  • provide lessons learnt from ITSM process improvement with multiple service quality frameworks and standards.

The results of this study can be used by IT service provider organizations to increase the understanding of service management frameworks, their content and purpose and to identify difference between service governance and service management.

The rest of the paper is organized as follows. In Sect. 2, a generic framework of IT governance is presented. In Sect. 3, we deal with the research problem and methodology. In Sect. 4, the results of the study and the roadmap of ITSM frameworks are presented. The results cover both the results from a case study and a constructive research. Section 5 is the discussion of the results. The conclusions are given in Sect. 6.

2 A generic framework of IT governance

In order to clarify the interface between ITSG and ITSM, a generic framework of IT service governance (see Fig. 1) was constructed to show the relationships between IT governance concepts and roles. Top level IT governance decisions are typically made by an IT steering group that consists of chief information officer, business leaders and potentially some business relationship managers. The IT steering group aims at setting plans and checking how corporate IT meets the requirements of corporate governance. Portfolio management collects and maintains information on the organization’s investments (programmes and projects). A programme is a temporary organizational unit that coordinates the implementation of projects that are needed to achieve the organization’s goals [29]. A programme office can be temporary or permanent depending on its purpose.

ITIL [25] defines three types of governance activities: evaluation, directing and monitoring activities. Evaluation consists of making an assessment on the IT service organization’s performance and business environment. Directing means delegating authorities and responsibilities for IT service management and communicating the service strategy to management that should further communicate it to employees. Monitoring involves creating a measurement system to check whether governance is effective. ITIL also relates establishment of a service management system to the service governance. An important part of service governance is to establish a service management system. In the service management system proposed by ISO/IEC 20000 [27], one can easily identify service governance elements, such as service resource management and governance of processes operated by other parties.

There is a wide set of best practices, standards, models and quality systems that can be used as part of IT service management. The most IT service provider organizations use IT Infrastructure Library (ITIL) framework to manage their IT services. ITIL defines the service lifecycle in the form of five key books: Service Strategy [30], Service Design [31], Service Transition [32], Service Operation [33] and Continual Service Improvement [2]. ITIL is a best practice framework, not a standard. Therefore, if an organization would like certify its service management, it needs to apply international service management standard. ISO/IEC 20000-1:2010 Part 1: Service management system requirements is propably the most used international IT service management standard [27]. ISO/IEC 20000-2:2011 Part 2: Guidance on the application of service management systems [34] provides more detailed description how requirements of Part I could be fulfilled.

Fig. 1
figure 1

A generic framework of IT service governance

Full size image

ITSM is more focused on operational excellence of IT services rather than governance of services. ITIL Service Strategy separates IT service governance and IT service management by addressing that governance aims at ensuring ITSM policies and strategy are implemented and employees follow the ITSM processes [3]. Additionally, Service Strategy indicates that service management and governance are different disciplines where management makes decisions and executes processes and governance creates the framework of decision rights. To our knowledge, the current service management literature does not provide much evidence on the concept of IT service governance. In this paper, we define IT service governance as “governance of people, information, technology and processes to provide quality IT services. Service governance defines key roles and responsibilities, allocates resources, creates authorization mechanisms and identifies key metrics for a service management system“.

3 Research problem and methodology

The research problem of this study is: How does IT service management differ from IT service governance? The research problem was further divided into the following research questions:

  • Which service quality, service management or IT governance models are used by IT service provider organizations?

  • How IT service management frameworks, IT governance frameworks and standards support the separation of service governance and service management?

  • How the difference between service governance and service management activities is visible in service providers’ operations?

A qualitative research approach with a constructive research method and a case study research method were used to answer the research problem. Research data consisted of well-known ITSM frameworks and standards and other process frameworks that IT service organizations used along with ITIL. In constructive research, our goal was to produce a construct that has value both for the research team and case organizations. We used a theoretical-conceptual approach to construct (1) a generic framework of IT governance and (2) a roadmap of IT service management and IT governance frameworks. Case study methods [35] were used to capture the circumstances and conditions how ITSG and ITSM are carried out by IT service provider organizations’ management and employees.

3.1 The case organization and data collection methods

We explored five case organizations’ ways to perform IT service management. Case organizations were selected from the pool of the ITSM research group’s industrial partners. They were considered as representative cases of their own business domain. The case organization A is an IT service provider company that produces data center services, workstation services, and service desk services for various industries in Finland. The case organization B is an IT service department of one of the largest banks in Finland. The case organization C offers application services in energy domain. The case organization D is an IT department of a government agency. The case organization E is an IT service provider company that provides ICT and medical technology services for municipalities and and public health care sector.

In order to maintain the anonymity of case results, we do not reveal details how different service management roles or service governance roles have answered to our questions during the case study. The following data collection methods and data sources were used during the study:

  • Documentation (ITSM process descriptions: incident, change, service request management; service descriptions)

  • Archives (support ticket records, emails related to ITSM process improvement, service trees and classifications)

  • Interviews/discussions (process managers, service directors, quality managers, product managers)

  • Participative observation (1 month process improvement period with each case organization)

  • Physical artefacts (ITSM tools and applications, configuration management tools, intranets).

3.2 Data analysis

Data for this study was collected from five Finnish IT service provider organizations with case study methods during an ITSM research project. The case material was analyzed by case comparison technique [36] by using researcher triangulation. Three researchers participated in data analysis. Each case study was reported as a case study report that was sent to the case organization in order to receive feedback and validate results. Research findings were further validated in project meetings with case organizations’ representatives.

Additionally, in order to create an innovative design for our ITSM framework roadmap, we used a blueprint of Helsinki Vantaa airport terminal and replaced the gates with service quality frameworks. We focused on service management and governance frameworks that were actively used by case organizations.

Yin [35] proposes four tests to evaluate the quality of case study design: construct validity, internal validity , external validity and reliability. Construct validity was maintained by using multiple sources of evidence in each case and creating a chain of evidence between data sources, findings and conclusions. However, we decided not to show results classified by case organizations from anonymity reasons because it would have been relatively easy to connect the findings to persons if we had mentioned their roles.

Internal validity was improved by using pattern matching. We utilized a pattern matching technique comparing empirically based patterns with predicted patterns. Predicted patterns (service governance frameworks in use, service governance methods, separation of service management and service governance) were created based on previous studies and ITSM frameworks. External validity was improved by applying replication logic for multiple cases involved in the study. We aimed at literal replication to find evidence from multiple cases confirming that IT service management and IT service governance are not considered as separate entities in IT service provider organizations. Reliability aspects were taken into account by using a case study datastore for managing the empirical evidence collected from case organizations and process improvement documentation created by the research group.

4 Relationships between IT service management and IT governance frameworks

In this section, we discuss the relationships between IT service management and IT governance from two perspectives: theoretical-conceptual perspective and empirical case study perspective. A theoretical-conceptual perspective was used to construct the roadmap of IT service management frameworks. The empirical case study perspective aimed at providing valuable insights into IT service providers’ daily service management focusing on which service Management and IT governance frameworks they use to manage and govern their IT services. In the following subsections, we present our research findings categorized according to our three research questions.

4.1 Which service quality, service management or IT governance models are used by IT service provider organizations?

Figure 2 shows the ITSM and IT governance frameworks used in an “ITSM terminal“ roadmap. The frameworks were captured by using researcher triangulation (three ITSM researchers). During the case study, we observed that the service provider organizations used or showed interest also other frameworks and standards than those of ITSM, such as project management, IT governance and software development frameworks. However, we limited the scope of study to ITSM frameworks and standards.

Fig. 2
figure 2

Roadmap of IT service management frameworks

Full size image

According to our theory-based and empirical findings, the most commonly used IT service management frameworks and their purpose are:

  • ISO/IEC 20000-1:2010 Part 1: Service management system requirements [27] defines mandatory requirements for service management systems.

  • ISO/IEC 20000-2:2011 Part 2: Guidance on the application of service management systems [34] provides guidelines how the requirements of Part 1 can be fulfilled.

  • ISO/IEC TS 15504-8:2012 process assessment model [37] provides a systematic framework to measure capability of service management processes.

  • IT Infrastructure Library v3 and v3 2011 edition defines the service lifecycle in the form of five key books: Service Strategy [30], Service Design [31], Service Transition [32], Service Operation [33] and Continual Service Improvement [2]. benefits, key concepts, process activities, metrics, roles and responsibilities as well as interfaces to other processes.

  • IT Infrastructure Library v2 2002 consists of service delivery [38] and service support [39] process areas. The processes are documented in a similar way than ITIL v3.

  • Control Objectives for IT and Related Technology 5 (COBIT 5) provides a comprehensive framework that assists enterprises in achieving their objectives for the governance and management of enterprise IT.

  • Capability Maturity Model Integration (CMMI) for Services [40] is a process maturity model for IT service provider organizations.

  • Plan-Do-Check-Act [3] is a quality management method that defines an improvement cycle. improvement cycle in ISO/IEC 20000:1.

4.2 How IT service management frameworks, IT governance frameworks and standards support the separation of service governance and service management?

Next, we discuss how service governance issues are addressed by these frameworks and standards. First, ISO/IEC 20000-1:2010 Part 1 and ISO/IEC 20000-2:2011 define requirements for a Service Management System. The service management system aims to direct and control the service management activities of the service provider [27]. We consider the Service management system general requirements of ISO/IEC 20000 to be part of service governance. These requirements address: Governance of processes operated by other parties, Establish the SMS, Documentation management, Resource management, and Management responsibility.

In ISO/IEC TS 15504-8:2012 process assessment model [37], service governance issues can be found, for example, in the section SMS.8 SMS Establishment and improvement that is divided into following subsections: SMS.8.1 Establish service requirements in response to business needs, SMS.8.2 Identify the objectives and requirements for service management. SMS.8.3 Establish SMS processes, and SMS.8.4 Improve effectiveness and efficiency. ISO/IEC TS 15504-8:2012 has a close relationship to ISO/IEC 20000, thus it involves the process assessment model for most ISO/IEC 20000 service management processes.

The value of ISO/IEC 15504-8 is in clearly defined process inputs and outputs and in a process capability model that is lighter than CMM. Additionally, it was originally designed for IT service provider organizations but could be used by any service provider organization. ISO/IEC 15504-8 can be used to assess the maturity of a single IT service management process. Capability Maturity Model Integration (CMMI) for Services [40] is the CMMI subtype that is especially designed for ITSM processes of IT service management.

ITIL v3 Service Strategy [30] emphasizes several practices that are related to service governance such as identifying critical success factors for service management processes, strategic planning and development. Service strategy highlights the importance of Service Portfolio. In ITIL v2, the service governance is highly visible in Planning to Implement publication in areas Creating a Service Management vision, Communicating the vision, and Empowering others to act on the vision.

The Plan Do Check Act method is an improvement cycle that can be found both in ITIL [3] and ISO/IEC 20000 standard [27]. In the Plan phase, goals and measurements for improvement are established. In the Do phase, the organization carries out the development and implementation of an improvement project. The Check phase focuses on comparing implementation to success measures defined in the Plan phase. In the Act phase, the organization evaluates whether further work is required to close remaining gaps and what would be the content of further work.

4.3 How the difference between service governance and service management activities is visible in service providers’ operations?

The IT service change management process was used as an example to demonstrate the difference between IT service governance and IT service management. Change management was selected because most of the service management process frameworks, service quality frameworks, IT governance frameworks and service management standards include it. IT service change management aims to ensure that new services and changes to services will be deliverable and manageable at the agreed cost and service quality [41]. Our study included five case organizations that provided us valuable information on differences between IT service governance and IT service management. Service governance-related issues are marked with SG. The rest represent IT service management issues. The following observations were made:

  • There are no standardized set of ITSM process metrics (SG).

  • Deployment of change management in practice is difficult.

  • People do not identify changes.

  • ITSM requires hundreds of roles with a large set of responsibilities. A small organization does not have enough people to fill those roles (SG).

  • Updating a service level agreement or a service agreement should be considered as a change (SG).

  • At the current situation, corrections go through incident management, not change management.

  • At the beginning, process focus should be put on only clear changes.

  • Process owners in our organization do not know their responsibilities or how to perform them in practice (SG).

  • Change advisory board should deal with changes that are important for customers, are important for a service provider, and are important for everybody.

  • One should clarify what is the role of a customer representative and a product manager in change management (SG).

  • Changes shall be accepted if they are prepared carefully, risks have been assessed, and the benefits of change can be demonstrated.

  • The duration of processing a change may take a long time, even an year.

  • Some of changes go through the process in 15 min. Changes with a long duration shall be implemented as projects.

  • The number of changes is rapidly increasing but who is going to plan them or find money for them? (SG)

  • Release management and release windows play an important role in change management because there is a limited access to some facilities and devices.

  • A major change was added to an organization’s change categories (SG).

  • While processing standard changes, specialists may not be able to carry out adequate risk management.

5 Discussion

The analysis of this study was based on both theoretical and empirical results. Regarding the first research question, our theoretical results based on the ITSM literature showed that IT Infrastructure Library (ITIL) is the primary ITSM framework. We observed that our case organizations had experience both in ITIL version 2 and version 3. One of our cases was actively using ISO/IEC 20000 standard as a quality framework and in one case managers had set a goal to achieve ISO20K within few years.

In all cases, management was aware of COBIT. In one of the cases, authors were specifically advised to hide the ITIL theories to the background and to proceed with practical approach. In two case organizations, discussion on integrating Projects in Controlled Environments (PRINCE2) and ITIL occurred in daily basis during the research period. PRINCE2 was one the non-ITSM frameworks we found during case studies. Cases showed that PRINCE2 framework was needed to implement changes as projects and for managing the design and transition of new IT services.

ISO 27001:2013 [42] is the International Standard for Information Security Management Systems (ISMS). That standard was used by case organizations to extend the information security management process of ITIL. Lean Six Sigma [43] adresses many common features of Lean and Six Sigma, such as an emphasis on customer satisfaction, a culture of continuous improvement, the search for root causes, and comprehensive employee involvement. One of our organization had planned to apply Lean Six Sigma to Problem Management. In one case Lean approach had been used to decrease the throughput time of workstation orders.

We also observed that the role of value-oriented IT service management is becoming more and more important in case organizations. Examples of these cover value-oriented IT governance framework Val IT [44], Management of Value and Management of Benefits. Our findings support earlier research that there is a need to integrate or use IT service governance frameworks (ITIL, COBIT, ISO/IEC 20000) together [24].

Regarding the second research question, the analysis of theoretical frameworks revealed that service governance areas in IT service management frameworks address management commitment, creation of service management policies, defining authorities, responsibilities and constructing communication mechanisms for IT service management, as well as assigning management representatives for IT service management boards. Table 1 illustrates how service governance and service management are visible in IT service management frameworks.

Table 1 Service governance versus service management
Full size table

IT service management frameworks, IT governance frameworks and standards seem to support the separation of service governance and service management. In our study, we found that IT service management standards address service governance issues especially in the following areas: (1) establishment and improvement of a service management system, (2) establishment of service requirements in response to business needs and customer needs, (3) identification of the objectives and requirements for service management, establishment of SMS processes, (4) improvement of effectiveness and efficiency, (5) resource management and (6) management responsibilities.

Concerning the third research question, management commitment and support for service management mentioned by Pollard and Cater-Steel [16] was visible in our cases in several ways: auditorium talks by management, intranet news, promoting employees that had participated in ITSM training and could act as a change agent. Authorities and responsibilities were documented in one case by RACI charts. Our results support the findings of Sharifi et al. [17] that considered the failure to assign process managers as one of the barriers for ITIL implementation. In two case organizations, certain process manager roles were not assigned to staff. A research team also found that in some cases the process managers had no time to carry out a process manager role. Reflecting to the findings of Stelzer and Mellis [45], we found that in all of our five case organizations management commitment and support was highly visible to employees.

6 Conclusion

This paper dealt with the research problem: How does IT service management differ from IT service governance? A constructive research method was used to create (1) a generic framework of IT governance and (2) a roadmap of IT service management and IT governance frameworks. Empirical case study research methods were used to study how service management frameworks and service governance frameworks are used in five Finnish IT service provider organizations. Differences between service governance and service management were illustrated through findings on case organizations’ IT service change management processes.

Our theory-based findings show that IT service governance issues can be found both in IT service management process frameworks such as ITIL Service Strategy (Evaluation, Direct and Monitor) and COBIT (control objectives for ITSM processes), and service management standards such as ISO/IEC 20000: 1 (Requirements for a Service Management System) and 15504-8 standard (SMS 1-8 areas, for instance, SMS.8 SMS Establishment and improvement). Our case study findings revealed that service governance challenges were related to unclear roles and responsibilities, lack of process metrics for certain processes or limited resources for improvement. This study provided both implications for research and implications for practice. Implications for research include a need for better IT governance frameworks that would define, for example, the structure of service management system, activities of continual service improvement, a reference model for a decision making structure and a service measurement system.

Implications for practice include recommendations for IT service provider organizations to define the roles and responsibilities of ITSM clearlier, create more transparent accountability structures for service management, create a clearer governance structures (for example, for service change acceptance), establish a measurement system with critical success factors, key performance indicators and metrics, show the management commitment through multiple channels for employees, and strengthen the service culture.

There are certain limitations related to this case study. First, we used qualitative approach to analyze case organizations’ service operation activities. Quantitative data could have provided new viewpoints to the research topic. Second, case studies are not designed for statistical generalization of results. However, Yin [35] reports that case studies allow generalizing the results to some broader theory. Third, reliability of the case studies was improved by using an improvement roadmap. As stated earlier, this study was exploratory one and can be used as an input for further case studies on IT service governance.