IT Service & Risk Assessment

Most companies don't have an IT problem they can name.

The symptoms are usually felt even when the underlying problem is not visible: recurring incidents, supplier costs that are difficult to justify against the service received, software licences with unclear ownership or utilisation, access rights nobody is entirely confident about, and projects that expose weaknesses in day-to-day IT operations.

These are rarely isolated problems. More often, they are symptoms of an IT environment that grew with the business without its operating model, ownership and management processes developing at the same pace. Services, suppliers and tools accumulated, while responsibilities became fragmented and important parts of the day-to-day operation remained undocumented. What is not documented is difficult to measure, and what cannot be measured is difficult to manage.

The result is unnecessary cost, operational friction and unmanaged risk. Services without clear ownership, licences without proper oversight, unmanaged devices and tools, poorly controlled access, and unclear handling of company data all create exposure. The challenge is identifying where that exposure actually sits, what matters, and what is worth fixing.

In six steps, through five to six weeks.

1. Initial discussion We spend 3–4 hours onsite with your key people and stakeholders, to understand the pain points in their words and to agree where to look first — including anything driven by a compliance or tender requirement.
2. Data gathering and interviews Duration: One week. Based on the initial discussion, we send targeted questionnaires to the relevant people and conduct short interviews with employees to understand their day-to-day experience of IT. We consolidate the responses before moving into the assessment.
3. Requirement clarification Duration: 2-3 hours. We walk management and key stakeholders through the initial findings and agree the final focus of the assessment. The result is an Assessment Scope Statement defining the six processes to be assessed, their stakeholders and systems, the expected deliverables and the assessment criteria. From this point, the scope is fixed and changes only by written change order.
4. Process assessment Duration: 2-3 weeks. We examine how the six agreed processes actually work in practice, compare them against relevant ITIL 4 and COBIT practices, and identify where cost, risk, delay and unnecessary effort enter the operation.
5. Analysis and recommendations Duration: One week. We consolidate the findings into the final assessment report, build the risk register and develop a practical strategy for addressing the identified gaps.
6. Presentation and handover Duration: 2–4 hours with all stakeholders present. We present the findings to management and the relevant stakeholders, hand over the complete assessment package and walk through the recommended strategy, priorities and next steps.

By default, the assessment covers six processes: request, incident, change, risk, data and asset management. Any of these can be replaced during the initial discussion if the problems identified point elsewhere.

• Entry — IT health check An independent assessment of your current IT environment, resulting in an IT Health Report and Gap Analysis. Designed to answer one question: Where are we now?
• Standard — the full assessment Everything in the IT Health Check, plus a Risk Register, IT Strategy and Process Descriptions — giving you a prioritised plan for what should change, why, and in what order.
• Premium — assessment plus implementation support Everything in the Full Assessment, plus hands-on support implementing the three highest-priority improvements identified during the assessment.
• Custom For larger or more complex environments: additional locations, more processes, multiple IT providers, or requirements that fall outside the standard scope.