ITIL-140 · Lesson 12 of 12 · 32 min
Capstone: redesigning service support for an organization
This capstone brings the course together. You will diagnose the support practices of an invented organization, Juniper Ridge College, and design improvements across the service desk, incident, problem, service request, change enablement, monitoring and event management, and knowledge. The lesson works through the analysis step by step, with numbers you can check, and ends with a strategy for answering practice questions on the Foundation exam. Juniper Ridge College is fictional; any resemblance to a real institution is coincidental.
The organization
Juniper Ridge College is a public community college in Minnesota with 14,000 students and 1,600 staff across a main campus and two smaller campuses. Its IT department of 70 people supports a learning management system, a student information system, email and collaboration tools, campus Wi-Fi, classroom technology, a finance and HR system, and around 6,000 college-owned devices. Student records are protected by the Family Educational Rights and Privacy Act (FERPA), the college must meet accessibility requirements under the ADA and Section 504, and it offers support in Spanish and Somali for many students.
Leadership is unhappy. A student survey rated IT support 2.9 out of 5. Faculty complain that classroom technology fails at the start of lectures. Two outages of the learning management system during exam weeks last year made the local news. The IT director has asked for a redesign of support practices within existing budget, with a business case for any investment.
Current state: the data
A month of data from the service management tool, interviews and a quick review of practices gives the following picture.
| Area | Current state |
|---|---|
| Contacts | 9,000 a month: 55 % phone, 30 % email, 15 % portal; no chat; no knowledge base for students |
| Service desk | 12 agents on one shift 08:00–18:00; average speed of answer 4 minutes at peak; abandonment 14 % in the first two weeks of term |
| Resolution | First contact resolution 48 %; 40 % of tickets escalated to second line; ticket notes often say only "issue fixed" |
| Incidents | 4,100 a month, of which 9 % are logged as P1; the most common categories are password and account lockouts (1,250), Wi-Fi (640) and classroom projectors (410) |
| Problems | Problem records exist for major incidents only; 23 open, average age 140 days; no trend analysis |
| Requests | Software installs and access requests are emailed to the desk and fulfilled manually; average fulfillment 4 business days; 18 % returned for missing information |
| Change | All changes go to a weekly CAB; 6 % are emergencies; changes during exam weeks are common; two exam-week outages followed untested changes |
| Monitoring | Infrastructure monitoring with 2,300 alerts a week; staff estimate fewer than 5 % need action; the learning management system has no synthetic monitoring |
| Knowledge | Scattered documents on a shared drive; no owners; agents rely on memory and colleagues |
Step 1: Understand the vision and value
Following the continual improvement model from ITIL-120, start with the vision. Interviews show what students and staff value: being able to learn and teach without interruption, especially at the start of lectures and during assessments; quick help that does not require a phone call; and clear information when things go wrong. The IT director's goals are to raise satisfaction to at least 4 out of 5, eliminate exam-period outages and reduce cost per contact. These become the outcomes the redesign must serve.
| Stakeholder | What they value | Possible measure |
|---|---|---|
| Students | Fast help without phoning; stable systems during assessments | Self-service success; LMS availability in exam weeks; CSAT |
| Faculty | Classroom technology working at the start of class | Classroom incidents in the first 10 minutes of lectures |
| Administrative staff | Reliable finance, HR and student records systems | Availability and P1/P2 resolution within target |
| IT leadership | Higher satisfaction, lower cost, fewer crises | CSAT, cost per contact, major incidents per term |
Step 2: Diagnose with the practices
Each finding can be traced to a practice and a cause. The service desk is overloaded at term start partly because of avoidable contacts: 1,250 lockouts a month, most of which self-service could handle. First contact resolution is low because agents have no knowledge base. Nine percent of incidents at P1 suggests priority inflation, which dilutes the attention genuine P1s get. Problem management is reactive and slow, so recurring Wi-Fi and projector issues never get fixed. Requests are manual and unstructured. Change enablement is both slow (everything waits for the weekly CAB) and unsafe (untested emergency changes in exam weeks). Monitoring produces noise without coverage of the most important service. Knowledge is effectively missing.
Step 3: Design the improvements
Improvements are grouped by practice, prioritized by value and effort, and sequenced so that quick wins fund and build support for larger changes.
| Practice | Improvement | Expected effect |
|---|---|---|
| Service request management | Self-service password reset and account unlock; portal forms for software and access with role-based pre-approval and automated fulfillment | Remove most lockout contacts; cut fulfillment from days to minutes for standard items |
| Knowledge management | Adopt KCS; seed 150 articles for the top contact types; publish student-facing articles in the languages the college serves | Raise first contact resolution and self-service success |
| Service desk | Add chat; extend hours to 20:00 in the first three weeks of term; staff by interval using Erlang C | Cut abandonment and wait at term start |
| Incident management | Publish concrete impact and urgency definitions; restrict P1 to critical services; create a major incident procedure for LMS and student systems | Restore attention to true P1s; faster, coordinated major incident response |
| Problem management | Monthly Pareto review; problems for Wi-Fi roaming and projector failures; protected problem time for second line | Reduce recurring incidents in the top categories |
| Change enablement | Standard change library; risk-based authority; freeze on non-essential changes to LMS and student systems in exam weeks; test evidence required | Faster routine change; no untested exam-week changes |
| Monitoring and event management | Synthetic monitoring of LMS login and assignment upload; retune thresholds; deduplicate and correlate alerts | Detect LMS issues before students; reduce alert noise |
Worked problem
Prioritizing improvements
The team scores each improvement on value (1–5) and effort (1–5, where 5 is most effort). Self-service password reset: value 5, effort 2. KCS knowledge base: value 4, effort 3. Synthetic LMS monitoring: value 4, effort 1. Chat channel: value 3, effort 3. Rank them by value divided by effort.
Show solution
- Synthetic LMS monitoring: 4 ÷ 1 = 4.0.
- Self-service password reset: 5 ÷ 2 = 2.5.
- KCS knowledge base: 4 ÷ 3 ≈ 1.33.
- Chat channel: 3 ÷ 3 = 1.0.
Answer: Order: synthetic LMS monitoring, self-service password reset, KCS, then chat. The first two are quick wins that address the most visible pain.
Step 4: Quantify the case
The program below estimates the effect of the main improvements on monthly contacts, service desk workload and user experience, using the current-state data and assumptions agreed with the team. The assumptions are deliberately conservative and labeled so they can be challenged.
# Juniper Ridge College: before and after estimates (assumptions are illustrative)
contacts = 9000
lockouts = 1250
desk_minutes_per_contact = 9.0
agent_rate = 38.0 # loaded cost per agent hour, dollars
# assumptions
reset_share_removed = 0.80 # lockouts handled by self-service reset
kcs_deflection = 0.10 # other contacts resolved by self-service articles
fcr_before, fcr_after = 0.48, 0.65
escalation_cost = 30.0 # second-line cost per escalated ticket, dollars
removed = lockouts * reset_share_removed
remaining = contacts - removed
deflected = (remaining) * kcs_deflection
desk_contacts_after = remaining - deflected
def monthly_cost(n, fcr):
desk = n * desk_minutes_per_contact / 60 * agent_rate
escalations = n * (1 - fcr) * 0.8 # 80% of unresolved first contacts escalate
return desk + escalations * escalation_cost, escalations
cost_before, esc_before = monthly_cost(contacts, fcr_before)
cost_after, esc_after = monthly_cost(desk_contacts_after, fcr_after)
print(f"desk contacts per month: {contacts:,} -> {desk_contacts_after:,.0f}")
print(f"escalations per month: {esc_before:,.0f} -> {esc_after:,.0f}")
print(f"support cost per month: ${cost_before:,.0f} -> ${cost_after:,.0f}")
print(f"monthly saving: ${cost_before - cost_after:,.0f}")
investment = 85000.0 # password reset, portal forms, KCS training, synthetic monitoring
print(f"payback on ${investment:,.0f}: {investment / (cost_before - cost_after):.1f} months")desk contacts per month: 9,000 -> 7,200 escalations per month: 3,744 -> 2,016 support cost per month: $163,620 -> $101,520 monthly saving: $62,100 payback on $85,000: 1.4 months
Even with conservative assumptions, the improvements reduce desk contacts and escalations substantially and, on these assumptions, pay back within a few months. The figures should be presented with their assumptions, and the team should agree how each will be measured after implementation, so that the business case can be checked rather than just believed.
Step 5: Protect exam weeks
The most visible failures were outages during exams, so they deserve a specific design. Change enablement adds a freeze on non-essential changes to the learning management system and student systems for the two weeks before and during exams, published on the change schedule a term in advance. Any change in the freeze must be an emergency change with documented test evidence and approval from the service owner and the dean responsible for assessments. Monitoring and event management adds synthetic checks of login and assignment upload every two minutes, with alerts to on-call staff. Incident management defines an LMS major incident procedure with a communications template for students and faculty, and an agreed decision rule for when the college extends assessment deadlines. Problem management reviews last year's two outages and confirms that their causes are fixed.
Worked problem
Detection time with synthetic monitoring
Last year, LMS outages were first reported by students an average of 18 minutes after they began. Synthetic checks every 2 minutes alert after two consecutive failures. What is the worst-case detection time with the new checks, and how much earlier is that than before?
Show solution
- Worst case: a failure starts just after a successful check, so the first failed check comes 2 minutes later and the second 4 minutes later.
- Worst-case detection: about 4 minutes; on average about 3 minutes.
- Improvement: 18 − 4 = at least 14 minutes earlier, giving staff a head start before most students notice.
Answer: Detection falls to at most about 4 minutes, at least 14 minutes sooner than relying on student reports.
Step 6: Govern, measure and sustain
The improvements are governed through a monthly service review chaired by the IT director with student and faculty representatives. A balanced set of measures tracks progress: CSAT and self-service success for experience; first contact resolution, abandonment and fulfillment times for the service desk and requests; P1 share and major incidents per term for incident management; repeat incidents in the top categories for problem management; change failure rate and share of standard changes for change enablement; actionable alert share and share of incidents detected by monitoring for event management. Each measure has an owner and a target for the end of the academic year.
| Measure | Baseline | Year-end target |
|---|---|---|
| Student CSAT (out of 5) | 2.9 | 4.0 |
| First contact resolution | 48 % | 65 % |
| Abandonment in first two weeks of term | 14 % | 5 % |
| Share of incidents logged as P1 | 9 % | Under 2 % |
| Standard request fulfillment | 4 business days | Same day for automated items |
| Exam-week LMS outages | 2 last year | None |
| Actionable share of alerts | Under 5 % | Over 50 % |
Privacy and accessibility shape the design. Articles and portal forms must be accessible under the ADA and Section 504, and the Department of Justice's 2024 rule for state and local government websites points to WCAG 2.1 AA, with compliance dates that were later extended. Student records in tickets and in any AI tools must be handled in line with FERPA and Minnesota law, and the college should check with its privacy office before sending ticket data to external AI services. Articles in Spanish and Somali should be offered for common student issues.
Exam strategy for practice questions
Practice questions on the Foundation exam test whether you can recognize the purpose of each practice, apply key terms correctly and choose the best action in a short scenario. Several patterns recur.
| If the question is about… | Look for the answer that… | Trap to avoid |
|---|---|---|
| Incident management | Restores service as quickly as possible, even with a workaround | Insisting on root cause before restoring |
| Problem management | Identifies causes and manages workarounds and known errors | Confusing a problem with an incident |
| Service desk | Captures demand and acts as the single point of contact, with empathy | Treating it as a purely technical team |
| Service request management | Handles predefined, user-initiated requests in a user-friendly way | Treating requests as incidents or as normal changes |
| Change enablement | Maximizes successful changes through risk assessment, authorization and scheduling | Choosing answers that slow or block change by default |
| Change types | Standard = pre-authorized low risk; normal = assessed; emergency = expedited | Calling any urgent request an emergency change |
| Monitoring and event management | Observes and records significant changes of state | Assuming every event is an incident |
Read each question for its key words: interruption or reduction in quality points to incidents; cause points to problems; predefined or routine points to service requests; risk and authorization point to change enablement; change of state points to events. When two options both look reasonable, prefer the one that matches the practice's purpose most directly and reflects the guiding principles, especially focus on value and keep it simple and practical. ITIL-160 provides full mock exams and timing advice.
Worked problem
Working a practice question
Question: "A user reports that the expense system displays an error when submitting claims. The service desk finds a documented workaround in the known error database. What should the service desk do next?" Options: (a) raise a problem record; (b) apply the workaround and link the incident to the known error; (c) escalate to the application team for a root cause fix; (d) raise a normal change.
Show solution
- Key words: user reports an error (incident), documented workaround in the known error database (problem already analyzed).
- Incident management's purpose is to restore service quickly; the workaround does that.
- The problem already exists, so (a) duplicates it; (c) and (d) pursue the cause, which problem management already owns.
Answer: Option (b): apply the workaround and link the incident to the known error.
Reflection
The Juniper Ridge redesign shows how the practices in this course work together. No single practice fixes the college's problems. Self-service and knowledge reduce demand on the service desk; better prioritization and a major incident procedure focus attention; problem management removes recurring causes; risk-based change enablement makes routine change faster and protects critical periods; and well-designed monitoring detects failures before users suffer. Measurement ties the improvements to the outcomes stakeholders value. ITIL-141 continues with the delivery practices that complete the picture, such as service level, configuration and supplier management.
Common mistakes
MistakeFixing one practice in isolation.
InsteadTrace pain points to causes across practices and improve them together.
MistakeStarting with the most expensive improvement.
InsteadPrioritize by value and effort and deliver quick wins first.
MistakePresenting a business case without stating assumptions.
InsteadLabel assumptions and agree how each will be measured afterwards.
MistakeTreating exam weeks like any other period.
InsteadUse freezes, synthetic monitoring and a tailored major incident procedure for critical periods.
MistakeAnswering exam questions from habit rather than practice purpose.
InsteadMatch the scenario to the practice purpose and its key terms.
Summary and key terms
- Start a redesign from stakeholder value and measurable outcomes.
- Diagnose by tracing each pain point to practice causes.
- Design improvements across practices and prioritize by value and effort.
- Quantify the case with clearly labeled assumptions and plan how to measure results.
- Protect critical periods with change freezes, synthetic monitoring and major incident procedures.
- Govern improvements through regular service reviews with balanced measures.
- On the exam, match each scenario to the practice purpose and its key terms.
- Capstone
- A final project that integrates the knowledge and skills from a course.
- Current-state assessment
- An evidence-based description of how practices perform today.
- Quick win
- An improvement with high value and low effort that can be delivered early.
- Value-to-effort ratio
- A simple prioritization score dividing expected value by effort.
- Business case
- A justification for an investment, including costs, benefits, assumptions and risks.
- Change freeze
- A period when non-essential changes are avoided to protect critical business activity.
- Synthetic check
- A scripted transaction that tests a service as a user would.
- Service review
- A regular meeting to review service performance and agree improvements.
- Baseline
- The measured starting point against which improvement is judged.
- Balanced measures
- A set of metrics covering experience, efficiency, effectiveness and risk together.
Practice problems
Work each problem on paper first, then reveal the answer to check.
What should a support redesign start from?
Show answer
The value stakeholders seek and the outcomes the organization wants.
Why is 9 % of incidents at P1 a concern?
Show answer
It suggests priority inflation, which dilutes attention on genuinely critical incidents.
An improvement has value 3 and effort 1; another has value 5 and effort 4. Which ranks higher by value ÷ effort?
Show answer
The first, at 3.0, against 1.25.
Why include assumptions explicitly in a business case?
Show answer
So they can be challenged and later measured to check the benefits.
Name three measures to protect exam weeks.
Show answer
A change freeze, synthetic monitoring of key functions and a major incident procedure with communication templates.
Synthetic checks run every 3 minutes and alert after two failures. What is the worst-case detection time?
Show answer
About 6 minutes.
Which practice would address 640 Wi-Fi incidents a month at the cause?
Show answer
Problem management.
In an exam question, which practice do the words "predefined" and "user-initiated" point to?
Show answer
Service request management.
What should the service desk do when a known error with a workaround matches an incident?
Show answer
Apply the workaround and link the incident to the known error.
Why should privacy officers be consulted before sending ticket data to an AI service?
Show answer
Tickets contain personal information protected by privacy law, and external services may store or use it.
Lesson quiz · 5 questions
Score 60% or more to complete this lesson.
Create a free account to save your progress, take quizzes and earn a certificate.