ITIL-140 · Lesson 12 of 12 · 32 min

Capstone: redesigning service support for an organization

This capstone brings the course together. You will diagnose the support practices of an invented organization, Juniper Ridge College, and design improvements across the service desk, incident, problem, service request, change enablement, monitoring and event management, and knowledge. The lesson works through the analysis step by step, with numbers you can check, and ends with a strategy for answering practice questions on the Foundation exam. Juniper Ridge College is fictional; any resemblance to a real institution is coincidental.

The organization

Juniper Ridge College is a public college in Ontario with 14,000 students and 1,600 staff across a main campus and two smaller campuses. Its IT department of 70 people supports a learning management system, a student information system, email and collaboration tools, campus Wi-Fi, classroom technology, a finance and HR system, and around 6,000 college-owned devices. As a public institution, it is covered by Ontario's Freedom of Information and Protection of Privacy Act (FIPPA) and the Accessibility for Ontarians with Disabilities Act (AODA), and it offers some programs in French.

Leadership is unhappy. A student survey rated IT support 2.9 out of 5. Faculty complain that classroom technology fails at the start of lectures. Two outages of the learning management system during exam weeks last year made the local news. The IT director has asked for a redesign of support practices within existing budget, with a business case for any investment.

Current state: the data

A month of data from the service management tool, interviews and a quick review of practices gives the following picture.

Juniper Ridge College support: current-state findings.
AreaCurrent state
Contacts9,000 a month: 55 % phone, 30 % email, 15 % portal; no chat; no knowledge base for students
Service desk12 agents on one shift 08:00–18:00; average speed of answer 4 minutes at peak; abandonment 14 % in the first two weeks of term
ResolutionFirst contact resolution 48 %; 40 % of tickets escalated to second line; ticket notes often say only "issue fixed"
Incidents4,100 a month, of which 9 % are logged as P1; the most common categories are password and account lockouts (1,250), Wi-Fi (640) and classroom projectors (410)
ProblemsProblem records exist for major incidents only; 23 open, average age 140 days; no trend analysis
RequestsSoftware installs and access requests are emailed to the desk and fulfilled manually; average fulfilment 4 business days; 18 % returned for missing information
ChangeAll changes go to a weekly CAB; 6 % are emergencies; changes during exam weeks are common; two exam-week outages followed untested changes
MonitoringInfrastructure monitoring with 2,300 alerts a week; staff estimate fewer than 5 % need action; the learning management system has no synthetic monitoring
KnowledgeScattered documents on a shared drive; no owners; agents rely on memory and colleagues

Step 1: Understand the vision and value

Following the continual improvement model from ITIL-120, start with the vision. Interviews show what students and staff value: being able to learn and teach without interruption, especially at the start of lectures and during assessments; quick help that does not require a phone call; and clear information when things go wrong. The IT director's goals are to raise satisfaction to at least 4 out of 5, eliminate exam-period outages and reduce cost per contact. These become the outcomes the redesign must serve.

Stakeholder value at Juniper Ridge College.
StakeholderWhat they valuePossible measure
StudentsFast help without phoning; stable systems during assessmentsSelf-service success; LMS availability in exam weeks; CSAT
FacultyClassroom technology working at the start of classClassroom incidents in the first 10 minutes of lectures
Administrative staffReliable finance, HR and student records systemsAvailability and P1/P2 resolution within target
IT leadershipHigher satisfaction, lower cost, fewer crisesCSAT, cost per contact, major incidents per term

Step 2: Diagnose with the practices

Each finding can be traced to a practice and a cause. The service desk is overloaded at term start partly because of avoidable contacts: 1,250 lockouts a month, most of which self-service could handle. First contact resolution is low because agents have no knowledge base. Nine per cent of incidents at P1 suggests priority inflation, which dilutes the attention genuine P1s get. Problem management is reactive and slow, so recurring Wi-Fi and projector issues never get fixed. Requests are manual and unstructured. Change enablement is both slow (everything waits for the weekly CAB) and unsafe (untested emergency changes in exam weeks). Monitoring produces noise without coverage of the most important service. Knowledge is effectively missing.

A diagram with three student and staff pain points on the left: long waits at term start, classroom failures at lecture start, exam-week outages. Arrows connect each to practice causes on the right: no self-service and no knowledge base, reactive problem management for projectors and Wi-Fi, weekly CAB with untested emergency changes and no LMS synthetic monitoring.
Linking pain points to practice causes.

Step 3: Design the improvements

Improvements are grouped by practice, prioritized by value and effort, and sequenced so that quick wins fund and build support for larger changes.

Improvement plan by practice.
PracticeImprovementExpected effect
Service request managementSelf-service password reset and account unlock; portal forms for software and access with role-based pre-approval and automated fulfilmentRemove most lockout contacts; cut fulfilment from days to minutes for standard items
Knowledge managementAdopt KCS; seed 150 articles for the top contact types; publish student-facing articles in the languages the college servesRaise first contact resolution and self-service success
Service deskAdd chat; extend hours to 20:00 in the first three weeks of term; staff by interval using Erlang CCut abandonment and wait at term start
Incident managementPublish concrete impact and urgency definitions; restrict P1 to critical services; create a major incident procedure for LMS and student systemsRestore attention to true P1s; faster, coordinated major incident response
Problem managementMonthly Pareto review; problems for Wi-Fi roaming and projector failures; protected problem time for second lineReduce recurring incidents in the top categories
Change enablementStandard change library; risk-based authority; freeze on non-essential changes to LMS and student systems in exam weeks; test evidence requiredFaster routine change; no untested exam-week changes
Monitoring and event managementSynthetic monitoring of LMS login and assignment upload; retune thresholds; deduplicate and correlate alertsDetect LMS issues before students; reduce alert noise

Worked problem

Prioritizing improvements

The team scores each improvement on value (1–5) and effort (1–5, where 5 is most effort). Self-service password reset: value 5, effort 2. KCS knowledge base: value 4, effort 3. Synthetic LMS monitoring: value 4, effort 1. Chat channel: value 3, effort 3. Rank them by value divided by effort.

Show solution
  1. Synthetic LMS monitoring: 4 ÷ 1 = 4.0.
  2. Self-service password reset: 5 ÷ 2 = 2.5.
  3. KCS knowledge base: 4 ÷ 3 ≈ 1.33.
  4. Chat channel: 3 ÷ 3 = 1.0.

Answer: Order: synthetic LMS monitoring, self-service password reset, KCS, then chat. The first two are quick wins that address the most visible pain.

Step 4: Quantify the case

The program below estimates the effect of the main improvements on monthly contacts, service desk workload and user experience, using the current-state data and assumptions agreed with the team. The assumptions are deliberately conservative and labelled so they can be challenged.

# Juniper Ridge College: before and after estimates (assumptions are illustrative)
contacts = 9000
lockouts = 1250
desk_minutes_per_contact = 9.0
agent_rate = 38.0                 # loaded cost per agent hour, dollars

# assumptions
reset_share_removed = 0.80        # lockouts handled by self-service reset
kcs_deflection = 0.10             # other contacts resolved by self-service articles
fcr_before, fcr_after = 0.48, 0.65
escalation_cost = 30.0            # second-line cost per escalated ticket, dollars

removed = lockouts * reset_share_removed
remaining = contacts - removed
deflected = (remaining) * kcs_deflection
desk_contacts_after = remaining - deflected

def monthly_cost(n, fcr):
    desk = n * desk_minutes_per_contact / 60 * agent_rate
    escalations = n * (1 - fcr) * 0.8      # 80% of unresolved first contacts escalate
    return desk + escalations * escalation_cost, escalations

cost_before, esc_before = monthly_cost(contacts, fcr_before)
cost_after, esc_after = monthly_cost(desk_contacts_after, fcr_after)
print(f"desk contacts per month:   {contacts:,} -> {desk_contacts_after:,.0f}")
print(f"escalations per month:     {esc_before:,.0f} -> {esc_after:,.0f}")
print(f"support cost per month:    ${cost_before:,.0f} -> ${cost_after:,.0f}")
print(f"monthly saving:            ${cost_before - cost_after:,.0f}")
investment = 85000.0               # password reset, portal forms, KCS training, synthetic monitoring
print(f"payback on ${investment:,.0f}: {investment / (cost_before - cost_after):.1f} months")
Output
desk contacts per month:   9,000 -> 7,200
escalations per month:     3,744 -> 2,016
support cost per month:    $163,620 -> $101,520
monthly saving:            $62,100
payback on $85,000: 1.4 months

Even with conservative assumptions, the improvements reduce desk contacts and escalations substantially and, on these assumptions, pay back within a few months. The figures should be presented with their assumptions, and the team should agree how each will be measured after implementation, so that the business case can be checked rather than just believed.

Step 5: Protect exam weeks

The most visible failures were outages during exams, so they deserve a specific design. Change enablement adds a freeze on non-essential changes to the learning management system and student systems for the two weeks before and during exams, published on the change schedule a term in advance. Any change in the freeze must be an emergency change with documented test evidence and approval from the service owner and the dean responsible for assessments. Monitoring and event management adds synthetic checks of login and assignment upload every two minutes, with alerts to on-call staff. Incident management defines an LMS major incident procedure with a communications template for students and faculty, and an agreed decision rule for when the college extends assessment deadlines. Problem management reviews last year's two outages and confirms that their causes are fixed.

Worked problem

Detection time with synthetic monitoring

Last year, LMS outages were first reported by students an average of 18 minutes after they began. Synthetic checks every 2 minutes alert after two consecutive failures. What is the worst-case detection time with the new checks, and how much earlier is that than before?

Show solution
  1. Worst case: a failure starts just after a successful check, so the first failed check comes 2 minutes later and the second 4 minutes later.
  2. Worst-case detection: about 4 minutes; on average about 3 minutes.
  3. Improvement: 18 − 4 = at least 14 minutes earlier, giving staff a head start before most students notice.

Answer: Detection falls to at most about 4 minutes, at least 14 minutes sooner than relying on student reports.

Step 6: Govern, measure and sustain

The improvements are governed through a monthly service review chaired by the IT director with student and faculty representatives. A balanced set of measures tracks progress: CSAT and self-service success for experience; first contact resolution, abandonment and fulfilment times for the service desk and requests; P1 share and major incidents per term for incident management; repeat incidents in the top categories for problem management; change failure rate and share of standard changes for change enablement; actionable alert share and share of incidents detected by monitoring for event management. Each measure has an owner and a target for the end of the academic year.

Baseline and targets for the redesign.
MeasureBaselineYear-end target
Student CSAT (out of 5)2.94.0
First contact resolution48 %65 %
Abandonment in first two weeks of term14 %5 %
Share of incidents logged as P19 %Under 2 %
Standard request fulfilment4 business daysSame day for automated items
Exam-week LMS outages2 last yearNone
Actionable share of alertsUnder 5 %Over 50 %

Privacy and accessibility shape the design. Articles and portal forms must meet AODA web accessibility requirements, which refer to WCAG. Student and staff personal information in tickets and in any AI tools must be handled in line with FIPPA, and the college should check with its privacy office before sending ticket data to external AI services. French-language articles and service should be offered for programs delivered in French.

Exam strategy for practice questions

Practice questions on the Foundation exam test whether you can recognize the purpose of each practice, apply key terms correctly and choose the best action in a short scenario. Several patterns recur.

Patterns for practice questions.
If the question is about…Look for the answer that…Trap to avoid
Incident managementRestores service as quickly as possible, even with a workaroundInsisting on root cause before restoring
Problem managementIdentifies causes and manages workarounds and known errorsConfusing a problem with an incident
Service deskCaptures demand and acts as the single point of contact, with empathyTreating it as a purely technical team
Service request managementHandles predefined, user-initiated requests in a user-friendly wayTreating requests as incidents or as normal changes
Change enablementMaximizes successful changes through risk assessment, authorization and schedulingChoosing answers that slow or block change by default
Change typesStandard = pre-authorized low risk; normal = assessed; emergency = expeditedCalling any urgent request an emergency change
Monitoring and event managementObserves and records significant changes of stateAssuming every event is an incident

Read each question for its key words: interruption or reduction in quality points to incidents; cause points to problems; predefined or routine points to service requests; risk and authorization point to change enablement; change of state points to events. When two options both look reasonable, prefer the one that matches the practice's purpose most directly and reflects the guiding principles, especially focus on value and keep it simple and practical. ITIL-160 provides full mock exams and timing advice.

Worked problem

Working a practice question

Question: "A user reports that the expense system displays an error when submitting claims. The service desk finds a documented workaround in the known error database. What should the service desk do next?" Options: (a) raise a problem record; (b) apply the workaround and link the incident to the known error; (c) escalate to the application team for a root cause fix; (d) raise a normal change.

Show solution
  1. Key words: user reports an error (incident), documented workaround in the known error database (problem already analysed).
  2. Incident management's purpose is to restore service quickly; the workaround does that.
  3. The problem already exists, so (a) duplicates it; (c) and (d) pursue the cause, which problem management already owns.

Answer: Option (b): apply the workaround and link the incident to the known error.

Reflection

The Juniper Ridge redesign shows how the practices in this course work together. No single practice fixes the college's problems. Self-service and knowledge reduce demand on the service desk; better prioritization and a major incident procedure focus attention; problem management removes recurring causes; risk-based change enablement makes routine change faster and protects critical periods; and well-designed monitoring detects failures before users suffer. Measurement ties the improvements to the outcomes stakeholders value. ITIL-141 continues with the delivery practices that complete the picture, such as service level, configuration and supplier management.

Common mistakes

  • MistakeFixing one practice in isolation.

    InsteadTrace pain points to causes across practices and improve them together.

  • MistakeStarting with the most expensive improvement.

    InsteadPrioritize by value and effort and deliver quick wins first.

  • MistakePresenting a business case without stating assumptions.

    InsteadLabel assumptions and agree how each will be measured afterwards.

  • MistakeTreating exam weeks like any other period.

    InsteadUse freezes, synthetic monitoring and a tailored major incident procedure for critical periods.

  • MistakeAnswering exam questions from habit rather than practice purpose.

    InsteadMatch the scenario to the practice purpose and its key terms.

Summary and key terms

  • Start a redesign from stakeholder value and measurable outcomes.
  • Diagnose by tracing each pain point to practice causes.
  • Design improvements across practices and prioritize by value and effort.
  • Quantify the case with clearly labelled assumptions and plan how to measure results.
  • Protect critical periods with change freezes, synthetic monitoring and major incident procedures.
  • Govern improvements through regular service reviews with balanced measures.
  • On the exam, match each scenario to the practice purpose and its key terms.
Capstone
A final project that integrates the knowledge and skills from a course.
Current-state assessment
An evidence-based description of how practices perform today.
Quick win
An improvement with high value and low effort that can be delivered early.
Value-to-effort ratio
A simple prioritization score dividing expected value by effort.
Business case
A justification for an investment, including costs, benefits, assumptions and risks.
Change freeze
A period when non-essential changes are avoided to protect critical business activity.
Synthetic check
A scripted transaction that tests a service as a user would.
Service review
A regular meeting to review service performance and agree improvements.
Baseline
The measured starting point against which improvement is judged.
Balanced measures
A set of metrics covering experience, efficiency, effectiveness and risk together.

Practice problems

Work each problem on paper first, then reveal the answer to check.

  1. What should a support redesign start from?

    Show answer

    The value stakeholders seek and the outcomes the organization wants.

  2. Why is 9 % of incidents at P1 a concern?

    Show answer

    It suggests priority inflation, which dilutes attention on genuinely critical incidents.

  3. An improvement has value 3 and effort 1; another has value 5 and effort 4. Which ranks higher by value ÷ effort?

    Show answer

    The first, at 3.0, against 1.25.

  4. Why include assumptions explicitly in a business case?

    Show answer

    So they can be challenged and later measured to check the benefits.

  5. Name three measures to protect exam weeks.

    Show answer

    A change freeze, synthetic monitoring of key functions and a major incident procedure with communication templates.

  6. Synthetic checks run every 3 minutes and alert after two failures. What is the worst-case detection time?

    Show answer

    About 6 minutes.

  7. Which practice would address 640 Wi-Fi incidents a month at the cause?

    Show answer

    Problem management.

  8. In an exam question, which practice do the words "predefined" and "user-initiated" point to?

    Show answer

    Service request management.

  9. What should the service desk do when a known error with a workaround matches an incident?

    Show answer

    Apply the workaround and link the incident to the known error.

  10. Why should privacy officers be consulted before sending ticket data to an AI service?

    Show answer

    Tickets contain personal information protected by privacy law, and external services may store or use it.

Lesson quiz · 5 questions

Score 60% or more to complete this lesson.

Take the quiz