Get FREE 12-month access to the AI-Powered Knowledge Base worth $450
with your ISO 27001 toolkit purchase
Limited-time offer – ends June 27, 2024

ITIL Supplier Management and Service Level Management – How to put the two in balance

The luxury of having vast availability of technology opens another issue – you can’t do it all by yourself. Namely, it’s a rare situation that a company provides and/or supports service(s) and has all necessary competences to maintain it. The usual situation is that you have a supplier who is supporting you. In such a way, you can ensure the expertise and high level of knowledge needed to provide services to your customers.

All of this works well during periods of “peace.” But, once it gets tough (incidents, problems, changes, etc. occur) – well, your support organization is tested. And that wouldn’t be a problem if you had a signed agreement with your customers. A written agreement means a fixed and measurable obligation. ITIL has two processes that can help. OK, maybe not in all situations, but mostly – yes.

Who is doing what?

Relationship between service provider, customer, supplier, and internal groupFigure: Relationship between service provider, customer, supplier, and internal group

If you take a look at the figure you will notice that activities are going on in three directions: towards your customers, internally inside your organization, and towards third parties. Activities towards your customers and internal groups are the job of Service Level Management (SLM). SLM is basically responsible for ensuring that you deliver services according to agreed targets. Agreed targets are documented in the Service Level Agreement (SLA), which is your contractual obligation towards customers.

The latter ones, i.e., third parties, are usually the ones who can get you into trouble. They include HW/SW vendors and organizations providing services. You usually use them to support you in providing services to your customers. What you need from them is equipment or expertise. The supplier management process is the one that takes care of them. Just as your customer wants you to sign an agreement with them, so you will sign an agreement with your suppliers. According to ITIL, this should be an Underpinning Contract (UC); but, honestly, I have never seen that wording in use. It’s always, again, an SLA. Which is somehow logical. If you look at this from your supplier’s point of view – you are the customer for them. What do you sign (even according to ITIL) with your customer? An SLA.

You can learn more about the various types of agreements in ITIL in the article SLAs, OLAs and UCs in ITIL and ISO 20000.

How to fit in?

The fact that someone else (your supplier) is supporting you while maintaining your services does not excuse you from your responsibility towards your customer(s). That means that you, and only you, are responsible in the eyes of the customer. That could be quite OK if you have influence over your supplier. But, it gets tricky once you have a supplier who is big enough to set their own rules. I experienced that with a major ERP vendor who provides only “best effort”  as a service level. And that puts you (a service provider) in an unpleasant situation. Your customer wants you to agree on the service level you will provide, and you can’t get anything “tangible” from your supplier. And, there is no way to make everyone happy. The usual situation is that the service provider takes a risk, which means that he signs the SLA with the customer. Life is not pleasant sometimes, is it?

It could be a bit easier if the client has chosen a particular supplier (usually, then the customer has an understanding of the service level that the supplier provides). But, even in that case, the service provider is responsible for managing that supplier. That’s a good opportunity to play the role of a trusted partner to your customer.

Why is management of suppliers that important? Imagine, as an example, that you have signed an SLA with your customer, and in that SLA you set the target for priority 2 incidents to be resolved in, e.g., four hours. But, to resolve that particular category of incidents you need the help of your suppliers. What you should do is set stricter targets (for the same type of incidents) towards your suppliers, e.g., 3.5 hours. The point is that the supplier supports you in achieving service level targets, and they have to fit into the service targets you agreed to with your customer and included in the SLA. Read the article Incident Management in ITIL – solid foundations of operational processes.

There are a few more elements of the SLA that should be transferred into the agreement with the supplier. One of them is the difference between incidents and problems. It would be excellent if you could define, in the SLA, both incidents and problems. The reason is that with incidents, you have to provide the customer with the service as soon as possible; whereas with problems, you need to find the root cause of that incident. That means that Problem Management needs much more time. So, if you define that in the SLA, your customer will not expect you to find the root cause in a few hours, if that’s not realistic. But, if you agree on the difference between incidents and problems with your customers – transfer that into the supplier’s agreement as well.

Another issue could be penalties. If you have penalties in your SLA – these should be present in the supplier’s contract as well. Otherwise, you will have to pay even if it’s your supplier’s fault.

Theory and practice

As you can see, managing suppliers differs depending on services, customers, your own organization… etc. So far, I have mentioned several parameters that are important and can be managed. I also noticed that tools can help. Either you record activities towards suppliers in your incident log, or you open a new ticket for every incident escalated to your supplier. In that way, the evidence about “what, who, and when” is transferred to the supplier. Because, once an incident occurs, the clock is ticking and it only stops once you resolve the ticket. And you need to control that process.

But, whatever the parameters or tools, the fact is that you have a responsibility to your customers. And you can have the best (or worst) possible suppliers, but your customer doesn’t care. What they see are the services you provide and the invoices you send. And, believe me, there is a dependency between these two. Further on, there is a third parameter – customer perception. Once they are in balance – your life is pleasant. Otherwise…

Use this free  ITIL Gap Analysis Tool to see how your SLM and Supplier Management processes fit to ITIL requirements.

Advisera Branimir Valentic
Branimir Valentic
Branimir is an expert in IT service management (consultancy, training and tools), IT governance (training and consulting), project management and consultancy in IT and telecommunication. He holds the following certificates: ITIL Expert, ISO 20000, ISMS Lead Auditor and PRINCE2.