How ISO/IEC19770-1 certification can help achieve management buy-in

One of the highest perceived benefits of ISO/IEC19770-1 certification for ITAM was the management of internal stakeholders.

Before setting out to create a certification scheme for the ISO/IEC19770-1 standard, the ITAM forum conducted a business impact survey to get insight in the perceived benefits of organizational certification. The highest scoring benefit was the management of internal stakeholders, stating “It will enable us to demonstrate good governance to internal stakeholders such as senior management or other IT departments or business units. 

That was in 2021, but does that statement still hold up after the first certifications have been awarded in 2023? The answer, like usual with ITAM, is yes and no. The certification itself as well as the road towards it can be successfully used as communication tools for internal stakeholders. That much we’ve shown by now. But there is something else going on that wasn’t part of the initial survey and that is the re-activation of the ITAM process owner. 

In many of the process implementations we do with our clients we see a similar pattern emerge, where after the initial enthusiasm around ITAM the interest of senior management dwindles after the most urgent issues are under control, and the external audits have been fought off successfully. That leaves the ITAM team with a problem, as most, if not all their RACI matrices depend on the separation of the ITAM process Manager having an operational/tactical responsibility on the one side, and the ITAM process owner providing management support, funding and an escalation path to support. And guess what? That ITAM process owner just logged off. 

ITAM Process Owner (A strategic role, sometimes referred to as the program lead): 

• Accountable and responsible for corporate sponsorship, commitment for ITAM, achieving the ITAM management objectives and for managing the ITAM related risks

Needs to approve ITAM Corporate Management Statement, Strategic ITAM plan, ITAM Policies, ITAM processes etc. 

ITAM Process Manager (A tactical role):

• Effective and efficient operation of the ITAM processes, managing the ITAM team
• Identifying risks
• Delivering results against the ITAM improvement plan;
• Developing and proposing all documents the ITAM Process Owner is responsible for (See above) 

And that is where the previously unexpected effect comes into play: Throughout the High-Level Structure of the ISO/IEC 19770-1 standard, there are built-in checks to keep the PDCA (plan/do/check/act) cycles going:

• Progress- and improvement documents need to be signed off by management.
• Management needs to be involved in strategical reviews.
• Policies and KPI’s for ITAM need to support those of the organization as a whole.

… and most importantly: The evidence for these checks needs to be accessible for the auditor. So, the audit trail needs to be next-to flawless. This places the ITAM process owner/senior management in the center of the ITAM process implementation, because failing to participate would jeopardize the certification. And by that, one of the most common questions from our customers is answered: “how to keep senior management interested in ITAM?”