Outcomes, outputs, costs and risks · ITIL-110 Lesson 5

When consumers decide whether a service is worth it, they weigh what it helps them achieve against what it costs them and what could go wrong. ITIL expresses this with four connected terms: outputs, outcomes, costs and risks. Getting them right changes how providers design, measure and talk about services. This lesson defines each term, shows how costs and risks can be removed from or imposed on consumers, and works through examples that put numbers on the balance.

Outputs and outcomes

ITIL defines an output as a tangible or intangible deliverable of an activity, and an outcome as a result for a stakeholder enabled by one or more outputs. The difference sounds subtle but has large consequences.

Outputs are what activities produce: a report, a configured laptop, a resolved ticket, a deployed software release, a training session delivered.
Outcomes are what stakeholders achieve because of those outputs: a manager makes a better decision, a new employee is productive on day one, a salesperson closes a deal, customers can pay bills online, staff can use a new system correctly.

Providers control outputs much more directly than outcomes. A service desk can resolve a ticket (output) without the user being able to work again, because the root problem is elsewhere (no outcome). A training team can run sessions (output) that do not change how people work (no outcome). Focusing only on outputs leads to the familiar situation of a provider proud of its activity while consumers remain unhappy.

A left-to-right chain of four boxes. Activities lead to outputs, such as a configured laptop. Outputs enable outcomes, such as a new employee working on day one. Outcomes contribute to value, as perceived by stakeholders. Under the chain, a bracket shows that the provider controls activities and outputs directly while outcomes and value are co-created with the consumer. — Activities produce outputs; outputs enable outcomes; outcomes contribute to perceived value.

Outputs are deliverables; outcomes are results for stakeholders.
Service	Output	Outcome
New starter setup	Laptop configured and accounts created	New employee productive on the first day
Reporting service	Monthly sales dashboard	Managers adjust prices and stock in time
Service desk	Ticket closed	User can continue their work
Online tax filing	Return submitted	Taxpayer meets the deadline and receives any refund sooner
Security awareness training	Course completed by 95 % of staff	Fewer people click on phishing emails

Worked problem

From output to outcome

A company reports that 98 % of staff completed security awareness training this year. In a simulated phishing test before training, 18 % of staff clicked a malicious link; after training, 15 % did. Evaluate the output and the outcome.

Show solution

Output: 98 % completion. Very high.
Outcome: phishing click rate fell from 18 % to 15 %, a drop of 3 percentage points.
Relative reduction: 3 ÷ 18 ≈ 0.17, or about 17 %.
The output looks excellent, but the outcome is modest: more than one in seven staff still click.

Answer: Strong output, limited outcome. The provider should redesign the training, for example with shorter, more frequent and more realistic exercises, and keep measuring the click rate.

\[\text{Relative change} = \frac{\text{new} - \text{old}}{\text{old}} = \frac{15 - 18}{18} \approx -17\,\%\]

Costs

ITIL defines cost as the amount of money spent on a specific activity or resource. From the consumer's point of view, there are two kinds of cost in a service relationship:

Costs removed from the consumer: things the consumer no longer pays for because the provider handles them. Examples include staff, hardware, software maintenance, facilities and specialist expertise.
Costs imposed on the consumer: what the consumer pays or spends to use the service. Examples include the price or charge, the cost of integrating the service, training users, managing the relationship with the provider and changing their own processes.

A service is attractive when the costs removed are greater than the costs imposed, once all the costs are counted honestly. Providers often understate imposed costs, such as the effort of migrating data or changing workflows, and consumers often understate the costs removed, such as the time staff spend maintaining an in-house system.

Moving email to a cloud provider: some costs disappear and others appear.
Costs removed from consumer	Costs imposed on consumer
Buying and refreshing servers	Subscription fees
Data center space, power and cooling	Data migration effort
Staff time for patching and upgrades	Training users on the new service
Specialist security expertise	Managing the supplier relationship
Disaster recovery site	Changing internal processes to fit the service

Worked problem

Comparing costs removed and imposed

A firm runs email in-house for 200 staff. Annual costs are: servers and licenses $18,000, a share of an administrator's time $30,000, backup and security tools $6,000. A cloud email service costs $7 per user per month. Migration is a one-time $12,000 project, and managing the supplier takes about $4,000 of staff time a year. Compare the annual costs from year 2 onward and the first-year cost.

Show solution

Costs removed each year: $18,000 + $30,000 + $6,000 = $54,000.
Subscription each year: 200 × $7 × 12 = $16,800.
Ongoing imposed costs each year: $16,800 + $4,000 = $20,800.
Annual saving from year 2: $54,000 − $20,800 = $33,200.
First year adds migration: imposed $20,800 + $12,000 = $32,800; saving $54,000 − $32,800 = $21,200.

Answer: Saving of about $21,200 in year 1 and $33,200 a year afterwards, assuming the administrator's time is redeployed to other valuable work.

Risks

ITIL defines risk as a possible event that could cause harm or loss, or make it more difficult to achieve objectives. Risk can also be described as uncertainty of outcome, which allows for positive as well as negative possibilities. Like costs, risks in a service relationship are either removed from or imposed on the consumer.

Risks removed from the consumer: for example, the risk of hardware failure, of falling behind on security patches or of losing a key specialist.
Risks imposed on the consumer: for example, the risk that the provider has an outage, goes out of business, suffers a data breach or changes its terms; or the risk of becoming dependent on one provider (often called lock-in).

Consumers also take part in managing risk. They contribute by clearly communicating their requirements and constraints, by making sure the provider has access to the resources it needs (such as accurate data or system access) and by monitoring the service. A consumer who keeps important requirements to itself, such as a legal need to store data within the country, increases the risk that the service will fail it.

Risks shift rather than disappear when a service is adopted.
Risks removed	Risks imposed
Local server failure	Provider-wide outage
Unpatched software vulnerabilities	Breach at the provider affecting many customers
Loss of the only in-house expert	Provider changes prices or terms
Inadequate backups	Difficulty leaving the provider (lock-in)
Running out of capacity at peak	Data stored in a jurisdiction that conflicts with requirements

Worked problem

An expected-loss comparison

An in-house system has an estimated 10 % chance per year of a major outage costing $200,000. A cloud service reduces that to a 2 % chance, but introduces a 1 % chance per year of a provider-wide incident costing the firm $300,000. Compare the expected annual losses.

Show solution

Expected loss in-house: 0.10 × $200,000 = $20,000 per year.
Expected loss with cloud, own outages: 0.02 × $200,000 = $4,000.
Expected loss with cloud, provider incidents: 0.01 × $300,000 = $3,000.
Total expected loss with cloud: $4,000 + $3,000 = $7,000 per year.

Answer: Expected loss falls from about $20,000 to $7,000 a year. The risk has shifted and partly changed in kind, but overall it is lower. Expected loss is only one view; organizations also consider the worst case.

\[\text{Expected loss} = \text{probability per year} \times \text{impact}\]

Putting it together: the value equation in words

A consumer perceives value when the outcomes facilitated are worth more to them than the costs imposed and risks imposed, taking into account the costs and risks removed. ITIL (Version 5) also emphasizes experience and sustainability as part of how value is judged; a service that achieves outcomes cheaply but frustrates users or causes environmental harm may still be seen as poor value.

A balance scale. The left pan holds outcomes facilitated, costs removed and risks removed. The right pan holds costs imposed and risks imposed. The scale tips to the left, labeled value perceived. Underneath, a note says experience and sustainability also influence perception. — Consumers weigh what a service enables and removes against what it imposes.

For providers, this suggests four ways to increase value: facilitate more important outcomes, remove more costs, remove more risks, or impose fewer costs and risks. Improving experience is a fifth lever, since a better experience reduces effort and raises perceived value even when the outcome is the same.

Six levers for increasing the value of a service.
Lever	Example action for a payroll service
Facilitate more outcomes	Add real-time pay statements on mobile
Remove more costs	Automate year-end tax slips so HR staff do not prepare them
Remove more risks	Automatic updates when tax rates change
Impose fewer costs	Simpler onboarding with data import from the old system
Impose fewer risks	Clear data residency commitments and exit assistance
Improve experience	Plain-language help and fewer clicks to submit changes

Outcomes belong to the consumer

Because outcomes are results for stakeholders, the provider cannot fully control them. A provider can offer a perfect reporting service, but if managers ignore the reports, the outcome of better decisions does not happen. This is why ITIL places outcomes on the consumer's side of the relationship and why value is co-created. A practical consequence is that providers should understand the consumer's outcomes in the consumer's own words, and should design outputs that make those outcomes as likely as possible. Asking "what will you be able to do differently because of this service?" is a simple way to uncover outcomes during requirement discussions.

Outcomes also form chains. An output (a configured laptop) enables an immediate outcome (the new employee can log in on day one), which enables a further outcome (the employee completes training in the first week), which supports an organizational objective (new hires become productive faster). Providers usually influence the first links most strongly; the later links depend more and more on the consumer. Measuring at least one outcome beyond the output keeps attention on value without holding the provider responsible for things it cannot affect.

Worked problem

Total cost of ownership over three years

A team compares keeping a file server in-house with moving to a cloud file service for 80 users over three years. In-house: a new server costs $15,000 up front, maintenance and power $3,000 a year, and administration $10,000 a year. Cloud: $9 per user per month, plus a one-time migration of $6,000 and supplier management of $1,500 a year. Compare three-year totals.

Show solution

In-house: $15,000 + 3 × ($3,000 + $10,000) = $15,000 + $39,000 = $54,000.
Cloud subscription: 80 × $9 × 36 months = $25,920.
Cloud other costs: $6,000 + 3 × $1,500 = $10,500.
Cloud total: $25,920 + $10,500 = $36,420.
Difference: $54,000 − $36,420 = $17,580 over three years.

Answer: The cloud option costs about $17,580 less over three years, provided the risks it imposes, such as lock-in and provider outages, are acceptable.

In short, a provider should be able to explain, for every service, which outcomes it supports and which costs and risks it moves.

Common mistakes

MistakeReporting outputs such as tickets closed as if they were outcomes.
InsteadAsk what result the stakeholder achieved because of the output.
MistakeCounting only the price as the cost of a service.
InsteadInclude migration, training, integration and relationship costs.
MistakeAssuming a service removes all risk.
InsteadIdentify the new risks it imposes, such as provider outages and lock-in.
MistakeKeeping important requirements from the provider.
InsteadCommunicate requirements and constraints clearly to help manage risk.
MistakeJudging value on cost and outcome alone.
InsteadConsider experience and sustainability as well.

Summary and key terms

An output is a tangible or intangible deliverable of an activity.
An outcome is a result for a stakeholder enabled by one or more outputs.
Cost is the amount of money spent on a specific activity or resource.
Services remove some costs from consumers and impose others.
Risk is a possible event that could cause harm or loss, or make objectives harder to achieve.
Services remove some risks and impose others; consumers help manage risk by communicating requirements.
Value reflects the balance of outcomes, costs and risks, influenced by experience and sustainability.

Output: A tangible or intangible deliverable of an activity.
Outcome: A result for a stakeholder enabled by one or more outputs.
Cost: The amount of money spent on a specific activity or resource.
Costs removed: Costs the consumer no longer bears because the provider handles them.
Costs imposed: Costs the consumer bears to use the service.
Risk: A possible event that could cause harm or loss, or make it more difficult to achieve objectives.
Risks removed: Risks the provider takes on for the consumer.
Risks imposed: New risks the consumer accepts by using the service.
Lock-in: Dependence on one provider that makes switching difficult or costly.
Expected loss: Probability of an event multiplied by its impact.

Practice problems

Work each problem on paper first, then reveal the answer to check.

Is "ticket resolved" an output or an outcome?
Show answer
An output.
Give an outcome that a resolved ticket should enable.
Show answer
The user can continue their work.
Define outcome.
Show answer
A result for a stakeholder enabled by one or more outputs.
Name two costs imposed on a consumer besides the price.
Show answer
For example migration effort and user training.
Name a risk removed and a risk imposed by cloud hosting.
Show answer
Removed: local hardware failure. Imposed: provider-wide outage.
Expected loss of a 5 % annual chance of a $400,000 event?
Show answer
0.05 × 400,000 = $20,000.
Annual subscription for 150 users at $6 per month?
Show answer
150 × 6 × 12 = $10,800.
How can a consumer help manage risk?
Show answer
By communicating requirements and constraints and giving the provider needed access.
Click rate falls from 20 % to 12 %. Relative reduction?
Show answer
8 ÷ 20 = 40 %.
Name two levers for increasing value.
Show answer
For example remove more costs and improve experience.