ITIL 4 Framework: Key Concepts for CISA Candidates
Understand the ITIL 4 framework, its service value system, and key practices relevant to the CISA exam.
ITIL 4 (Information Technology Infrastructure Library) is a widely adopted framework for IT service management (ITSM). While COBIT focuses on governance, ITIL concentrates on delivering and managing IT services effectively. CISA candidates should understand ITIL's core concepts and how they relate to IT governance and audit objectives.
What Is ITIL 4?
ITIL 4 provides a practical framework for managing IT services throughout their lifecycle. Released in 2019, ITIL 4 evolved from earlier versions to embrace modern practices such as Agile, DevOps, and Lean. It focuses on co-creating value through IT services rather than simply delivering technology.
The Service Value System (SVS)
The ITIL 4 Service Value System is the central framework component. It describes how all the components and activities of the organization work together to facilitate value creation. The SVS includes:
- Guiding principles: Recommendations that guide an organization in all circumstances
- Governance: The means by which an organization is directed and controlled
- Service value chain: A set of interconnected activities that create value
- Practices: Sets of organizational resources designed for performing work
- Continual improvement: A recurring organizational activity performed at all levels
The Seven Guiding Principles
ITIL 4's guiding principles help organizations adopt and adapt the framework:
- Focus on value: Everything should link back to value for stakeholders
- Start where you are: Assess the current state before making changes
- Progress iteratively with feedback: Work in manageable increments with feedback loops
- Collaborate and promote visibility: Work across boundaries with transparency
- Think and work holistically: No service or practice stands alone
- Keep it simple and practical: Eliminate unnecessary complexity
- Optimize and automate: Use technology and automation to maximize efficiency
The Service Value Chain
The service value chain consists of six activities that transform demand into value:
- Plan: Ensure a shared understanding of direction and current status
- Improve: Ensure continual improvement across all dimensions
- Engage: Understand stakeholder needs and maintain relationships
- Design and transition: Ensure services meet stakeholder expectations
- Obtain/build: Ensure service components are available when needed
- Deliver and support: Ensure services are delivered and supported according to agreed specifications
Key ITIL 4 Practices for CISA
ITIL 4 defines 34 practices organized into three categories. The most relevant for CISA candidates include:
- Information security management: Protecting information and managing security risks
- Change enablement: Maximizing successful IT changes while managing risk
- Incident management: Minimizing the negative impact of incidents
- Problem management: Reducing the likelihood and impact of incidents by identifying root causes
- Service level management: Setting clear business-based targets for service levels
- IT asset management: Planning and managing the full lifecycle of IT assets
ITIL and IT Governance
While ITIL is primarily a service management framework, it supports IT governance by providing structured processes that can be audited and measured. IS auditors often evaluate ITIL process maturity as part of IT governance reviews.
CISA Exam Tips
The CISA exam does not test ITIL in depth, but you should understand the relationship between ITIL and governance frameworks like COBIT. Know the key ITIL practices (especially change, incident, and problem management) and how they contribute to IT control objectives. Questions may ask which ITIL practice addresses a specific operational scenario.