The Risk of Confusing Compliance with Value Creation in ITIL

# ITIL

# Service Management

ITIL delivers its greatest benefits when organizations prioritize value creation and user experience over mere process compliance and KPI achievement

August 11, 2026

Yurguen Penaranda Thomas

The Risk of Confusing Compliance with Value Creation in ITIL

Introduction: When Everything Seems to Work, but No One Is Satisfied

It is not unusual to find a paradoxical situation in ITSM environments: On one hand, the compliance targets defined in SLAs are shown as “green.” Audits are satisfactory, with no findings identified. Overall compliance is reflected in the operational KPIs displayed in dashboards and reports. Management technology tools are properly configured and operate without major issues; there are no significant outages or performance problems.

But, on the other hand, customers and service users are dissatisfied with the service they receive. They do not clearly understand how to use the functionalities provided by the service because they consider the platform interface to be confusing and not intuitive. They are not entirely sure which channels are the official ones for contacting the provider, so alternative channels are used, causing these interactions not to be properly recorded in the statistics.

The Origin of the Problem: ITIL Misinterpreted

The situation described above is mainly due to the organization having misunderstood the objective of ITIL when adopting its practices. It mistakenly assumes that adopting this framework means adopting a set of processes within the organization “out of the box” as described in the ITIL Practice Guides, producing extensive documentation, defining KPIs, and then focusing solely on ensuring that these processes are executed exactly as documented and that indicator targets are achieved.

This approach to ITIL adoption has several shortcomings. On one hand, ITIL practices are not intended to be implemented “out of the box” exactly as described in the Official Practice Guides. These guides should instead be viewed as a reference, while each organization should adapt them according to its context, maturity level, size, and available resources (to mention just a few criteria, although the list could be much longer).

Another incorrect approach is to view ITIL as a framework of rigid processes and to believe that the purpose is to comply with defined processes and KPI targets, complete forms, generate reports, and pass audits. Instead, ITIL should be viewed as a flexible set of recommendations aimed at generating value for customers and users of the provided service.

How the Culture of Compliance Emerges

A culture of compliance generally does not originate intentionally; rather, it emerges when processes, controls, and metrics become more important than the outcomes and value that are intended to be delivered. Below are some behaviors that can lead an organization to develop a culture of compliance:

Measuring Activity Instead of Results

Metrics are primarily focused on measuring items such as the number of tickets closed and the number of changes implemented. However, there are no indicators that measure customer experience, nor is there any analysis of whether implemented changes reduced business impact or improved user navigation within the interface.

Turning Processes into an End in Themselves

People perceive processes as rigid, “written in stone,” and expected to be followed to the letter, without clearly understanding the objective of the process or the value it adds to the organization.

This causes continual improvement to be neglected, as people do not question whether there are mandatory fields in forms that are no longer necessary, activities that could be simplified, approvals that no longer add value, or reports that no one uses anymore and could therefore be discontinued.

With this mindset, people may develop a negative perception of ITIL processes, seeing them as administrative tasks with no value, carried out simply to avoid audit non-compliance. This increases the likelihood that people will find ways to “bypass” the processes, which can create risks for the organization.

Obsession with Metrics

A KPI should be a support tool that indicates how well a target is being achieved. However, KPIs can become distorted when they stop being a tool and become an end in themselves.

This causes people to lose sight of what the KPI actually represents and view the target merely as a number that must be achieved, sometimes even engaging in inappropriate practices to meet it.

For example, in a metric focused on resolving tickets on time, people may start closing tickets as quickly as possible, even when the requester’s need has not been addressed. They may also engage in the practice of unjustifiably “pausing” the elapsed time on a ticket to create the impression that it was resolved faster than it actually was. They may even avoid registering certain cases that could negatively affect KPI performance.

These kinds of behaviors distort KPI results and therefore make the data less reliable for analysis and decision-making.

Signs That an Organization Has Fallen into the Compliance Trap

Below are some signs that indicate an organization is becoming focused on a culture of compliance:

Teams talk more about SLAs than about user experience.

There are indicators for everything, but few explain the value generated.

Processes are difficult to modify.

Audits become the main driver of change.

People follow the process without understanding its purpose.

Success is declared because the procedure was followed, even when the result for the user was poor.

What ITIL Actually Proposes

ITIL 4 introduced the Guiding Principles (which are reinforced in ITIL Version 5). The seven principles are recommendations that guide organizations in all circumstances. As presented below, taking these principles into account can help prevent organizations from focusing primarily on compliance when adopting ITIL practices.

Focus on Value

By keeping in mind, the value expected by customers and other stakeholders, the focus shifts from asking, “Are we complying with the process?” to asking, “Are we generating value for stakeholders?”

This change in mindset causes processes to stop being viewed as something that must be executed in an imposed manner and instead be perceived as guidance for delivering value in a more structured and standardized way.

Think and Work Holistically

Taking this principle into account when adopting ITIL allows the organization to consider its context, strengths, and limitations. In this way, the organization can comprehensively evaluate which practices, activities, and controls provide value within its specific context, avoiding the inclusion of unnecessary elements or the neglect of particular needs within its environment.

Keep It Simple and Practical

This principle seeks to combat the perception that ITIL-derived processes are rigid rules that cannot be modified. It encourages questioning the value generated by each activity performed within these processes.

This type of questioning makes it possible to identify, for example, controls that exist only because they have always existed, but are no longer necessary in practice. Mandatory fields in forms that were needed in the past but whose information is no longer used, making forms more complex than necessary. Reports that someone once analyzed and used for decision-making but that have since become irrelevant, resulting in resources being spent on producing reports that nobody uses.

Identifying these low-value or non-value-adding activities enables processes to be simplified, generating benefits such as time and resource savings. It also helps people see processes as flexible elements that are not executed simply for compliance purposes but because of the value generated by their activities.

How to Balance Compliance and Value

It is important to understand that compliance and value should not be viewed as opposites. The problem arises when compliance becomes the primary objective.

Adapting ITIL Practices to the Context of Each Organization

Using the ITIL Practice Guides as a reference enables organizations to leverage internationally recognized best practices while maintaining the flexibility needed to align them with the organization's objectives, needs, and capabilities.

Maintaining Traceability Between Activities and Value

Conducting periodic reviews of processes and value streams makes it possible to identify improvement actions such as controls that are no longer necessary, activities that can be streamlined, reports that can be eliminated, and forms and workflows that can be simplified.

This promotes continual improvement, ensuring that processes adapt to changes in the organization's internal and external environment.

Understanding the Benefit of Process Audits

Audits are often associated solely with compliance verification. However, when used appropriately, they can also become a source of improvement for the organization.

Beyond identifying deviations from the defined process, an audit can highlight controls that no longer provide value, activities that generate rework, or practices that could be simplified. From this perspective, the objective should not be limited to verifying whether a process was executed as defined, but also to analyzing whether that process continues to contribute to value creation for the organization and its stakeholders.

Combining Operational and Experience Indicators

At the beginning of this article, it was mentioned that one common mistake is focusing exclusively on measuring activity compliance rather than results.

Operational indicators focused on response times, resolution times, workload volume, and compliance are highly valuable from an internal perspective. They make it possible to analyze resource capacity, service demand, and achievement of objectives, thereby supporting planning activities, resource allocation, and even the justification for additional resources.

Therefore, the key is not to abandon these indicators altogether, but rather to complement them with experience indicators that allow organizations to analyze customer and user satisfaction levels, their perception of expected versus received value, and even the types of improvement opportunities identified by customers when consuming services.

The combined analysis of both operational and experience indicators provides a broader view from both internal and external perspectives, enabling a more robust analysis of the service.

Communicating the Purpose Behind the Practices

If people understand the objective of each activity, process, and practice, they are more likely to adopt a positive attitude toward process execution. This reduces the perception that processes are merely bureaucratic administrative procedures with no value and encourages people to see them as a way of performing work in a more organized, faster manner while helping reduce the likelihood of errors.

Conclusion

A mature organization is not one that merely demonstrates that its processes are executed as defined. It is one that can demonstrate that those processes contribute to generating value for the business, users, and other stakeholders of its services.

The situation presented at the beginning of this article, where operational indicators show satisfactory results while users remain dissatisfied, demonstrates that compliance and value creation are not always equivalent.

When executing ITIL practices, compliance is important, but it must not replace value creation. When these two concepts come into conflict, the question should not be whether the process was executed correctly, but whether the outcome expected by stakeholders was achieved.

Enjoyed this post? Join the conversation by leaving a comment or sharing your thoughts below, we’d love to hear your experiences and perspectives. Don’t forget to explore our upcoming events for more opportunities to learn and connect, and visit the forum to continue the discussion.

Where conversation, connection, and real-world practices come together.