ITIL SAM Guide

and the Business

Case for SAM
David Bicket, Senior Manager, Deloitte
dbicket@deloitte.com; +44 7779 648 544

Contents of ITIL Guide to SAM © Crown 2003

Other contents of presentation © Deloitte 2004
Publication Details

– Book
– Published 9 September 2003
– ISBN:0113309430
– Cost: £35
– CD
– ISBN:0113309449
– Cost: £60 + VAT
– Ordering
– TSO
– on-line: www.tso.co.uk
– phone: +44(0)870 243 0123
– itSMF (member discount!) and others

© 2004 Deloitte
Definition

Software Asset Management

(SAM) is all of the infrastructure
and processes necessary for the
effective management, control
and protection of the software
assets within an organisation,
throughout all stages of their
lifecycle

© 2004 Deloitte
Table of Contents

1 Introduction
2 Context
3 Making the business case
4 Organisation, roles and responsibilities
5 Process overview
6 Implementation overview
7 Tools and technology
8 Partners and SAM
9 Mapping SAM to ITIL and other approaches
10 Bibliography

© 2004 Deloitte
Appendices

A Terminology
B Software licensing overview
C Considerations in selecting SAM tools
D Possible SAM database contents
E Choosing a SAM partner
F The detailed contents of a SAM business case
G Example contents of a software policy

© 2004 Deloitte
Chapter 1: Introduction

• Written for directors and other members of senior management

with corporate governance responsibility
• PDF available from dbicket@deloitte.com
• Contents
– The need for SAM
– SAM principles
– Benefits
– Possible problems
– Costs
– Implementation approaches
– Minimum implementation recommendations

© 2004 Deloitte
SAM Principles: Overview

The development of a vision

and strategy for SAM

The development and

communication of an overall
SAM policy

Regular review
The development and and improvement
implementation of SAM
processes and procedures

Ongoing performance of SAM

processes with concurrent
maintenance of information

The SAM database

© 2004 Deloitte
Benefits

•Managing risks
•Controlling costs
•Obtaining competitive advantage
•Enhancing employee motivation and the workplace
environment

© 2004 Deloitte
Managing Risks

• Legal and financial exposure

• Damaged reputation
• Unexpected financial and workload impact
• Security breaches including unauthorised disclosure of
confidential information
• Unexpected problems with acquisitions/mergers/demergers
• Interruption of operations
• Unsupportable operations

© 2004 Deloitte
Controlling Costs

•IT Asset Management recognised by industry

analysts as enabler of significant benefits
–Gartner: cost savings of up to 30% per asset in
first year
–GIGA: up to 26% of total IT budget
•Observed cost benefits in some cases are even
greater

© 2004 Deloitte
Controlling Costs

• Better negotiating position

• Improved strategic infrastructure planning
• Prevention of software over-deployment
• Reduced hardware costs
• Improved software purchasing arrangements
• Reduced cost of internal licensing support
• Reductions in process and direct infrastructure costs
• Reductions in problem-resolution costs
• Potential tax benefits

© 2004 Deloitte
Obtaining Competitive Advantage

•Better quality decision-making

•Faster time-to-market
•Faster and easier integration after mergers and
acquisitions

© 2004 Deloitte
Chapter 5: SAM Process Overview

© 2004 Deloitte
Life-Cycle Overview
lncluding Externally Sourced Software

Retirement

Requirements
definition

Optimisation Design Evaluation

Operation Build Procurement

Deployment

© 2004 Deloitte
Receipt of Proof of License
End-User Organisation Reseller Manufacturer

Purchase order
Purchase
SAM Order
Database(s) Reseller order
Not used confirmation or
(note 1) pseudo-license
confirmation

Purchase Reseller invoice

Reseller for software
order
Invoice
copy

Match order and invoice Payment

then pay

Partitially
matched
documentation Follow up with
manufacturer if any
license
confirmations not
Copies
(note 2)
Match initial documentation received within a
(order and invoice) with
license confirmation
reasonable period
(say 2 monts)

Manufacturer
License license Confirmation
Confirmation

Notes: Note 1: Not used-not relevant for matching with invoice or order
Note 2: Copy all proof of license documents including license confirmation
© 2004 Deloitte
Chapter 8: Partners and SAM

• SAM guidance materials

• SAM consultancy
• Outsourcing of SAM functions
• Audits
• Certification
• Conferences and workshops
• Licensing advice
• Historical purchase records and effective licensing
• Current purchase records
• Directories and assessments of SAM tools
• SAM tools
• Implementation assistance for SAM tools

© 2004 Deloitte
The Business Case
for SAM
Chapter 3: Making the
Business Case for SAM
•The most important action step!
•SAM will impact on the entire organisation – do not
attempt it just as an IT project
•Do not view SAM as just selecting and installing a
tool

© 2004 Deloitte
Main Approaches

•Corporate Governance / Legal Risk Avoidance

•Operational Risk Avoidance
•Cost Savings

© 2004 Deloitte
Corporate Governance

•Typically Driven or Strongly Supported by Senior

Corporate Management
•License Compliance Typically a Priority
•Viewed as an Absolute Requirement; not driven by
Cost-Benefit Analysis
•ITIL not a major Driver

© 2004 Deloitte
Operational Risk Avoidance

•Typically Driven by both Operations and IT

Management
•Avoidance of Operational Problems Typically a
Priority
–Viruses, roll-out problems, support problems, etc
•Supported by Cost-Benefit Analysis, but as a
Secondary Consideration
•ITIL should be a Driver

© 2004 Deloitte
Cost Savings

•Typically Driven by IT Management

•Savings Perspective Primarily Driven by Internal IT
Savings – Not by Impact on End-User Departments
•Cost Savings Analysis is Primary Driver; Cost-Benefit
is Secondary
•ITIL not a major Driver

© 2004 Deloitte
Recommendations

•Link Business Case into Corporate Governance

requirements – the easiest ‘sell’
–Work with Corporate Management, Finance and Internal
Audit
–Leverage on Corporate Governance requirements in all
countries where your organisation has a presence
– See European Corporate Governance Institute website for link to
most national codes – www.ecgi.org/codes/all_codes.htm

© 2004 Deloitte
Recommendations (cont)

•Link into Corporate Governance (cont)

–You need to link what you do to corporate – and
corporate governance – objectives. Don’t expect a
corporate governance statement about IT Asset
Management.
–Link into ‘IT Corporate Governance’ for overall IT
– See Gartner et al
•Build ‘Operational Risk Avoidance’ and ‘Cost Savings’
arguments into ‘Corporate Governance’ business
case, for triple-win

© 2004 Deloitte
UK Combined Code

C.2 Internal Control

Main Principle
The board should maintain a sound system of internal control to
safeguard shareholders’ investment and the company’s assets.
Code Provision
C.2.1 The board should, at least annually, conduct a review of the effectiveness
of the group’s system of internal controls and should report to shareholders
that they have done so. The review should cover all material controls, including
financial, operational and compliance controls and risk management systems.

© 2004 Deloitte
Turnbull Guidance (Attached to Code)

• (16) The board of directors is responsible for the company’s

system of internal control. …
• (18) It is the role of management to implement board policies
on risk and control. …
• (19) All employees have some responsibility for internal control
as part of their accountability for achieving objectives. …

© 2004 Deloitte
German Corporate Governance Code

•(4.1.3) “The Management Board ensures that all

provisions of law are abided by and works to achieve
their compliance by group companies.”

© 2004 Deloitte
US Sarbanes-Oxley

•Section 404 establishes requirement for companies

to include in their annual reports a report of
management on the company’s internal control over
financial reporting
•Reinforced by latest PCAOB standard

© 2004 Deloitte
Questions?

© 2004 Deloitte
Contacts

•David Bicket, Senior Manager, Deloitte,

dbicket@deloitte.com
•Colin Rudd, Director, itEMS,
colinrudd@itemsltd.co.uk
•ITIL Service Desk, ServiceDesk@ogc.gsi.gov.uk,
tel no: 0845 000 4999

© 2004 Deloitte