LUẬN VĂN THẠC SĨ ĐẨY MẠNH HOẠT ĐỘNG QUẢN TRỊ CNTT(MIS) TẠI NGÂN HÀNG TMCP VIỆT NAM THỊNH VƯỢNG (VPBANK) MỤC LỤC DANH MỤC CÁC CHỮ VIẾT TẮT ii DANH MỤC CÁC HÌNH VẼ .iii DANH MỤC CÁC BẢNG BIỂU iv DANH MỤC CÁC BIỂU ĐỒ v PHẦN MỞ ĐẦU CHƯƠNG 1: CƠ SỞ LÝ LUẬN CHƯƠNG 2: THỰC TRẠNG VỀ QUẢN TRỊ HỆ THỐNG CÔNG NGHỆ THÔNG TIN TẠI VPBANK 25 CHƯƠNG 3: CÁC KIẾN NGHỊ ĐỀ XUẤT .53 KẾT LUẬN64 TÀI LIỆU THAM KHẢO 65 PHỤ LỤC 67 Page i DANH MỤC CÁC CHỮ VIẾT TẮT Danh mục viết tắt tiếng anh ISO International Standards Organisation ITC Information Technology Central ITGI Information Technology Governance Institute ITIL Information Technology Infrastructure Library ITSM Information Technology Service Management SDP Services Desk Plus COBIT Control Objectives for Information and related Technologies VPBank Vietnam Prosperity Joint-Stock Commercial Bank OGC Office of Government Commerce MIS Management of information Technology ATM Automatic teller machine CRM Customer relationship management Page ii DANH MỤC CÁC HÌNH VẼ Hình 1.1.1: Mơ hình hệ thống thơng tin Hình 1.1.2: Các thành phần hệ thống thơng tin Hình 1.2.3: Mơ hình PDCA 10 Hình 1.5.4: Một số tiêu chuẩn, phương pháp quản trị hệ thống CNTT 13 Hình 1.5.5: Bốn phạm vi mục tiêu .16 Hình 1.5.6: Mơ hình định hướng quản lý vận hành CNTT 20 Hình 1.6.7: Các yếu tố tương tác quản trị hệ thống CNTT 22 Hình 2.1.8: Mơ hình tổ chức khối cơng nghệ thơng tin 28 Hình 2.2.9: Mơ hình hoạt động cung cấp dịch vụ công nghệ thông VPB 48 Page iii DANH MỤC CÁC BẢNG BIỂU Bảng 2.2.1: Phân loại trình độ chun mơn 34 Bảng 2.2.2: Tỷ lệ áp dụng tiêu chí quản trị hệ thống 36 Bảng 2.2.3: Mức độ trưởng thành quy trình quản trị 46 Bảng 2.2.4: Thực trạng hoạt động cung cấp dịch vụ khối cồng nghệ thông tin 49 Bảng 2.3.5: Bảng quy trình áp dụng 50 Bảng 3.2.6: Lợi ích tính theo số trung bình 56 Page iv DANH MỤC CÁC BIỂU ĐỒ Page v PHẦN MỞ ĐẦU Tính cần thiết đề tài Quản trị hệ thống công nghệ thông tin chủ đề nóng bỏng tổ chức doanh nghiệp nào, đặc biệt doanh nghiệp mà hoạt động doanh nghiệp phụ thuộc vào công nghệ thông tin lĩnh vực tài ngân hàng Ngân hàng loại hình doanh nghiệp mà hoạt động kinh doanh dựa tảng công nghệ thông tin Hoạt động ngân hàng hoạt động cung cấp dịch vụ Ngân hàng sử dụng công nghệ thông tin để cung cấp dịch vụ ngân hàng cho khách hàng đến việc dụng công nghệ thông tin công cụ hỗ trợ vận hành hoạt động, hỗ trợ định quản lý … Ngân hàng có tạo lợi cạnh tranh hay không khả ứng dụng công nghệ thông tin Việc quản trị hệ thống công nghệ thông tin theo khung quản trị hay theo quy trình tiêu chuẩn điều cần thiết tổ chức nào, đặc biệt lĩnh vực cung cấp dịch vụ tảng công nghệ thông tin ngân hàng, nhiên việc nghiên cứu áp dụng tiêu chuẩn, khung quản trị công nghệ thông tin Ngân hàng chưa có nhiều nghiên cứu áp dụng việc quản trị CNTT ngân hàng bất cập dẫn đến tổng thất gián đoạn hệ thống, tần suất xảy lỗi hệ thống q nhiều, khách hàng khơng hài lòng với dịch vụ mà ngân hàng cung cấp… Nghiên cứu triển khai quy trình quản trị hệ thống cơng nghệ thông tin theo tiêu chuẩn, khung quản trị ITIL, COBIT… nghiên cứu triển khai công cụ hỗ trợ quản trị hệ thống công nghệ thông tin mục tiêu mà ngân hàng hướng đến để đẩy mạnh công tác quản trị hệ thống CNTT theo hướng quy trình hố, tiêu chuẩn hố nhằm đo lường, kiểm sốt cơng việc cung cấp dịch vụ, kiểm soát rủi ro …đem đến hài lòng cho khách hàng sử dụng dịch vụ ngân hàng tảng công nghệ thông tin Page Với tầm quan trọng quản trị hệ thống công nghệ thông tin nêu để giải khó khăn tác giả đề xuất nghiên cứu đề tài “Đẩy mạnh hoạt động quản trị hệ thống công nghệ thông tin (MIS) Ngân hàng TMCP Việt Nam Thịnh Vượng (VPBank)” Câu hỏi nghiên cứu Để đạt kết nghiên cứu đề tài này, câu hỏi sau - giải Những vấn đề tồn thách thức quản trị hệ thống công nghệ thông tin - Ngân hàng gì? Những vấn đề cần giải để cơng tác quản trị hệ thống công - nghệ thông tin đem lại hiệu Những tác động đẩy mạnh công tác quản trị hệ thống công nghệ thông tin Mục đích đề tài Hệ thống hố sở lý thuyết quản trị hệ thống công nghệ thông tin Đi sâu phân tích thực tiễn cơng tác quản trị việc áp dụng quy trình tiêu chuẩn theo khung quản trị công nghệ thông tin Ngân hàng VPBank để - chỗ chưa hợp lý nguyên nhân để đẩy mạnh công tác quản trị Từ kết phân tích đề xuất việc áp dụng triển khai quy trình tiêu chuẩn, - công cụ hỗ trợ quản trị hệ thống công nghệ thông tin phù hợp cho ngân hàng Đối tượng phạm vi đề tài Nghiên cứu quản trị hệ thống công nghệ thông tin Khối công nghệ thông tin – - Ngân hàng thương mại cổ phần Việt Nam Thịnh Vượng (VPBank) Về không gian, tập trung vào quản trị vận hành hoạt động hệ thống công nghệ Khối công nghệ thông tin – Ngân hàng thương mại cổ phần Việt Nam - Thịnh Vượng (VPBank) Về thời gian, nghiên cứu khuôn khổ năm trở lại đề xuất cho số năm Phương pháp nghiên cứu Sử dụng phương pháp phân tích so sánh tổng hợp, phân tích mơ tả (Descriptive analysis) Kết cấu đề tài Kết cấu đề tài bao gồm: Phần giới thiệu: Page Trong phần nêu bối cảnh việc ứng dụng công nghệ thông tin doanh nghiệp ngân hàng nói riêng từ thấy cần thiết đề tài nghiên cứu, mục đích nghiên cứu, đối tượng phạm vi nghiên cứu, phương pháp nghiên cứu đề tài Chương 1: Cơ sở lý luận Chương trình bầy khái quát vấn đề sơ lý luận liên quan đến hệ thống công nghệ thông tin, để người đọc hiểu hệ thống cơng nghệ vai trò tầm quan trọng hệ thống công nghệ thông tin doanh nghiệp Tiếp đến khái quát quản trị nói chung quản trị hệ thống công nghệ thông tin nói riêng, mơ hình, tiêu chuẩn phổ biến thường áp dụng quản trị hệ thống cơng nghệ thơng tin nói chung đặc biệt lĩnh vực tài ngân hàng nói riêng Chương 2: Thực trạng quản trị công nghệ hệ thống công nghệ thông tin Ngân hàng VPBank: Trong chương trình bầy tổng quan ngân hàng VPB phân tích thực trạng ứng dụng cơng nghệ thơng tin quản trị hệ thống công nghệ thông tin ngân hàng, để làm rõ ngân hàng VPBank sử dụng hệ thống thông tin vào lĩnh vực tầm quan trọng hệ thống ngân hàng đồng thời làm rõ thực trạng quản trị hệ thống công nghệ thông tin nào, sử sử dụng mô hình quản trị, quy trình quản trị, kiểm sốt, đo lường dịch vụ công nghệ thông tin sao…Từ nêu lên điểm đạt chưa đạt cần cải tiến nêu lợi ích việc cải tiến cơng tác quản trị hệ thống công nghệ thông tin Chương 3: Các đề xuất giải pháp Trong chương từ kết nghiên cứu trên, nhằm đẩy mạnh công tác quản trị hệ thống công nghệ hiệu tác giả đề xuất số giải pháp nhằm nâng cao hiệu công tác quản trị hệ thống công nghệ thông tin Ngân hàng VPBank Page CHƯƠNG 1: CƠ SỞ LÝ LUẬN 1.1 Công nghệ thông tin hệ thống thông tin Ngày phát triển mạnh mẽ công nghệ thông tin, tất tổ chức đẩy mạnh ứng dụng công nghệ thông tin vào hoạt động cách triển khai hệ thống thông tin, hệ thống công nghệ thơng tin khơng đơn để hỗ trợ tự động hóa các giao dịch, tác nghiệp mà tạo lợi Page M 44 Are you actively monitoring trends in customer satisfaction? M 45 Are you feeding customer survey information into the service improvement agenda? M 46 Are you monitoring the customer's value perception of the services provided to them? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions FAIL Biểu mẫu công cụ đánh giá mức độ trưởng thành quy trình quản lý cấu hình ITIL Service Support Self Assessment: Configuration Management (Y)es or (N)o Level 1: Pre-requisites M Are at least some configuration management activities established within the organisation, e.g registering Configuration Items (CIs)? M Have you identified some of the CI attributes, e.g location, current status, service component relationships? Is there existing configuration data held in hard copy, local spreadsheets or databases? Is there a high level configuration management plan? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' FAIL Level 1.5: Management Intent M Has the purpose and benefits of configuration management been disseminated within the organisation? Has the scope of configuration management activity been established within the organisation? Is there a suitable budget for configuration management tools and a commitment to resource configuration management activities? Does the organisation have procedures covering the registration of CIs? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' Level 2: Process Capability M Have responsibilities for various configuration management activities been assigned? M 10 Have configuration item naming conventions been agreed? M 11 Are there procedures for identifying, controlling, updating, auditing and analysing configuration item information? 12 Is configuration data routinely used in performing impact assessments? 13 Are CIs recognised in terms of service component relationships? Page 70 FAIL 14 Is configuration data used routinely when building or releasing new CIs? 15 Are there procedures covering housekeeping, licence management, archiving and retention periods for CIs? 16 For planned releases, is the configuration baseline determined in advance? 17 Are the configuration management activities reviewed on a regular basis? 18 Are configuration audits performed on a regular basis? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' FAIL Level 2.5: Internal Integration M 19 Have measure been taken to avoid duplication and anomalies with CI records? 20 Is configuration data used routinely for capacity planning purposes, e.g to ascertain the actual growth of CI's within the organisation? 21 Is there interface control between configuration management and third parties? 22 Are there links and interfaces between configuration management and other Service Management systems? 23 Do service support and service delivery personnel regularly retrieve configuration data to facilitate their activities? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' FAIL Level 3: Products M 24 Are standard reports concerning CI information produced regularly? 25 Is there a configuration management database? 26 Are there controlled environments available within which CI's are manipulated? 27 Are build and release schedules produced on the basis of the CI records? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' FAIL Level 3.5: Quality Control M 28 Are the standards and other quality criteria applicable for the registration of CIs made explicit and applied? M 29 Are the personnel responsible for configuration management activities suitably trained? 30 Does the organisation set and review either targets or objectives for Configuration Management? 31 Does the organisation use any tools to support the configuration management process? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' Level 4: Management Information M 32 Do you provide management with information concerning configuration items affected by major changes? M 33 Do you provide management with information concerning information on the achievement of targets and objectives set for Configuration Management? 34 Do you provide management with information concerning database and record growth usage? 35 Do you provide management with information concerning exceptional problems regarding specific CIs / types of CI? 36 Do you provide management with information concerning nonconformance to standards? Page 71 FAIL Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' FAIL Level 4.5: External Integration M 37 Do you hold regular meetings with interested parties in which Configuration Management matters are discussed? M 38 Do you receive notification from, or provide information to Change management relating to every CI to be changed or introduced? M 39 Is information exchanged with Release Management in order to keep the Definitive Software Library (DSL) consistent with the CMDB? 40 Is configuration information made available to the Service Desk regarding new CIs? 41 Does Configuration Management exchange information with Problem Management concerning details of CIs relating to problems, suppliers, customers and changes? 42 Does Configuration Management exchange information with Financial Management for IT Services regarding new cost and charging codes and other attributes? 43 Is configuration information made available to IT Service Continuity Management regarding CIs and backup details, and other security and contingency matters? 44 Is configuration information made available to Capacity Management concerning growth estimates based on the CMDB? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' FAIL Level 5: Customer Interface M 45 Do you check with the customer that the activities performed by Configuration Management adequately support their business needs? M 46 Do you check with the customer that they are happy with the services provided? M 47 Are you actively monitoring trends in customer satisfaction? M 48 Are you feeding customer survey information into the service improvement agenda? M 49 Are you monitoring the customers value perception of the services provided to them? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions FAIL Biểu mẫu công cụ đánh giá mức độ trưởng thành quy trình quản lý thay đổi ITIL Service Support Self Assessment: Change Management (Y)es or (N)o Level 1: Pre-requisites M Are at least some change management activities established in the organisation, e.g logging of change requests, change assessments, change planning, change implementation reviews? Are change management activities assigned to specific individuals or functional areas? Is there a procedure for raising and issuing requests for change? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' Level 1.5: Management Intent M Has the purpose and benefits of change management been disseminated within the organisation? Page 72 PASS Has the scope of change management activity been established within the organisation? Does the organisation have standards or other quality criteria for the raising and registering of changes? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' PASS Level 2: Process Capability M Have responsibilities for various change management activities been assigned? M Are the procedures for initiating change always adhered to? Is there a procedure for approving, verifying and scheduling changes? 10 Are the business and technical impacts of changes always assessed? 11 Is change progress monitored adequately by Change Management? 12 Is the successful implementation of a change confirmed by Change Management? M 13 Is there a procedure for the review of all changes? 14 Are adequate change management reports produced? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' PASS Level 2.5: Internal Integration M 15 Are all changes initiated through the agreed change management channels, for example a Change Advisory Board? M 16 Are changes planned and prioritised, centrally or by common agreement? 17 Are change records maintained to reflect the progress of changes? 18 Are the reasons for change failure explicitly recorded and evaluated? 19 Are successful changes reviewed against the original business needs? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' PASS Level 3: Products M M 20 Are formal change records maintained? 21 Is a change schedule of approved changes routinely issued? 22 Are standard reports on changes produced on a regular basis? 23 Are there established standards for documenting changes? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' PASS Level 3.5: Quality Control M 24 Are there standards and other quality criteria for the documentation of change made explicit and applied? M 25 Are the personnel responsible for change management activities suitably trained? 26 Does the organisation set and review either targets or objectives for Change Management? 27 Does the organisation use any tools to support the change management process? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' Level 4: Management Information M 28 Does Change Management provide pertinent information concerning requests for change received (e.g a breakdown of reasons for changes)? M 29 Does Change Management provide pertinent information concerning the change schedule? Page 73 FAIL 30 Does Change Management provide pertinent information concerning number and % of changes? 31 Does Change Management provide pertinent information concerning number of successful and failed changes? 32 Does Change Management provide pertinent information concerning business impact of changes? 33 Does Change Management provide pertinent information concerning change slippage (including backlogs and bottlenecks)? 34 Does Change Management provide pertinent information concerning number of problem record initiated changes? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' FAIL Level 4.5: External Integration M 35 Do you hold regular meetings with interested parties in which Change Management matters are discussed? M 36 Does CM exchange information with Configuration Management regarding change progress and change closure? M 37 Does CM exchange information with Configuration Management regarding change impact assessment on configuration items? M 38 Does CM exchange information with Problem Management regarding changes required to resolve problems / known errors? 39 Does CM exchange information with Problem Management regarding progress reporting and for receiving problem escalation reports? 40 Does CM exchange information with Problem Management regarding obtaining problem information relating to change? M M 41 Does CM exchange information with the Service Desk for notification of change progress? 42 Does CM exchange information with the Service Desk for notification of change schedule? 43 Does CM exchange information with the Service Desk for assessing impact of change on Service Desk support levels? 44 Does CM exchange information with the Service Desk for obtaining information concerning incidents and calls relating to change? 45 Does CM exchange information with Release Management concerning change implementation? 46 Does CM exchange information with Release Management concerning the notification and scheduling of software and hardware releases? 47 Does CM exchange information with Service Level Management regarding the change schedule? 48 Does CM exchange information with Service Level Management regarding potential change impact on service level agreements? 49 Does CM exchange information with IT Service Continuity Management for notification of change schedule? 50 Does CM exchange information with IT Service Continuity Management for assessing impact of change on contigency plans? 51 Does CM exchange information with Capacity Management regarding performance and capacity issues relating to change? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' Level 5: Customer Interface M 52 Do you check with the customer if the activities performed by Change Management adequately support their business needs? M 53 Do you check with the customer that they are happy with the services provided? M 54 Are you actively monitoring trends in customer satisfaction? Page 74 FAIL M 55 Are you feeding customer survey information into the service improvement agenda? M 56 Are you monitoring the customers value perception of the services provided to them? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions FAIL Biểu mẫu công cụ đánh giá mức độ trưởng thành quy trình quản lý thay đổi ITIL Service Delivery Self Assessment: Incident Management (Y)es or (N)o Level 1: Pre-requisites Are incident records maintained for all reported incidents? Are incidents currently assessed and classified by the Service Desk prior to referring them to a specialist? Is there an incident manager responsible for managing and escalating incidents? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' FAIL Level 1.5: Management Intent Is the business committed to reducing the impact of incidents by their timely resolution? Have management commitment, budget and resource been made available for incident management? Have Incident Management been made aware of the business drivers and needs which will drive the priority for dealing with incidents? Has an education and training programme been conducted for the Service Desk and incident managers outlining their relationships and interfaces with each other and with problem, change and configuration management? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' FAIL Level 2: Process Capability Is an incident database maintained recording details for all reported incidents? Are all incidents managed in conformance with the procedures documented in SLAs? 10 Is there a procedure for classifying incidents, with a detailed set of classification, prioritisation and impact codes? 11 Is there a procedure for assigning, monitoring and communicating the progress of incidents? 12 Does incident management provide the Service Desk or Customer/User with progress updates on the status of incidents? 13 Is there a procedure for the closure of incidents? 14 Does incident management provide the Service Desk with management information and recommendations for service improvement? 15 Are incident managers empowered to enforce agreed customer service levels with second line support and third party suppliers? 16 Do incident managers co-ordinate problem management, support staff and IT services management when a major incident occurs? 17 Has a study of the workload mix been conducted to determine the required staff levels, skill type and the associated costs of incident management? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' Level 2.5: Internal Integration Page 75 FAIL 18 Does incident management match incidents against the problem and known error database? 19 Does incident management inform the Service Desk and problem management of work-arounds? 20 Are incidents which breach agreed service level targets identified and the incident resolution team informed of the breach? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' FAIL Level 3: Products 21 Are incident records maintained for all reported incidents (including resolution and/or workaround)? 22 Are requests for changes produced, if necessary, for incident resolution? 23 Are resolved and closed incident records updated and clearly communicated to the Service Desk, customers and other parties? 24 Are reports regularly produced for all the teams contributing to the incident resolution process, concerning incident status? 25 Is a workload analysis produced to help determine staffing levels? 26 Are management reviews held to highlight escalated incident details? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' FAIL Level 3.5: Quality Control 27 Are the standards and other quality criteria applicable for the registration of incidents and for call handling made clear to the incident management team? 28 Are Service Level Agreements available and understood by incident management? 29 Are the personnel responsible for incident management suitably trained? 30 Does the organisation set and review either targets or objectives for incident management? 31 Are there suitable tools in use to support the Incident Management function? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' FAIL Level 4: Management Information 32 Do you provide management with information concerning trend analysis in incident occurrence and resolution? 33 Do you provide management with information concerning escalated incidents? 34 Do you provide management with information concerning percentage of Incidents handled within agreed response time 35 Do you provide management with information concerning percentage of incidents closed by Service Desk without reference to other levels of support Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' Level 4.5: External Integration 36 Do you hold regular meetings with the Service Desk to discuss incidents raised, progressed, escalated and closed? 37 Have the interfaces between the Service Desk and incident management been defined and communicated? 38 Does incident management exchange information with Problem Management concerning related problems and / or known errors? 39 Does incident management exchange information with Configuration Management regarding ease of use of configuration records, configuration anomalies and the potential flagging of configuration item, e.g as 'failed' (or equivalent)? Page 76 FAIL 40 Does incident management receive information from Change Management regarding impending changes to services? 41 Does incident management exchange information with Change Management regarding the details of possible changes to resolve particular incidents / problems? 42 Does incident management exchange information with Service Level Management concerning breaches in service level agreements and the service and support commitments they contain? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answers 'Y' FAIL Level 5: Customer Interface 43 Do you check with the customer if the activities performed by Incident Management Management adequately support the business needs? 44 Do you check with the customer that they are happy with the services provided? 45 Are you actively monitoring trends in customer satisfaction? 46 Are you feeding customer survey information into the service improvement agenda? 47 Are you monitoring the customers value perception of the services provided to them? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions FAIL Biểu mẫu công cụ đánh giá mức độ trưởng thành quy trình quản lý thay đổi ITIL Service Support Self Assessment: Service Desk (Y)es or (N)o Level - Pre-requisites Does a Service Desk exist which manages, co-ordinates and resolves incidents reported by customers? Is the Service Desk the recognised point of contact for all customer/user queries? Does the Service Desk provide information to customers regarding planned changes? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' FAIL Level 1.5 - Management Intent Is the business need for a Service Desk clearly identified and understood? Is there sufficient management commitment, budget provision and resource available for the effective operation of the Service Desk? Is the Service Desk perceived as a strategic function by Senior Managers? Has the purpose and benefits of the Service Desk been disseminated within the organisation? Has an education and/or training programme been conducted for customers and users in the use of the Service Desk and its benefits Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' Level - Process Capability Have the functions of the Service Desk been agreed? 10 Do Service Desk operators have a procedure or strategy for obtaining the required information from customers whilst call handling? 11 Does the Service Desk provide the customer/user with information on service availability, an incident number or reference for use in follow-up communications, and progress updates on any request being managed by the service team? Page 77 FAIL 12 Does the Service Desk make an initial assessment of all requests received, attempting to resolve appropriate requests or referring them to someone who can, based on agreed service levels? 13 Does the Service Desk communicate planned and short-term changes of service levels to customers? 14 Does the Service Desk provide a status update to the customer on the closure of incidents? 15 Does the Service Desk provide management information and make recommendations for service improvement? 16 Has a study of the workload mix been conducted to determine the required staff levels, skill type and the associated costs of the Service Desk? 17 Are customer satisfaction surveys carried out by the Service Desk? 18 Is the Service Desk notified of new services or changes to existing services? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answers 'Y' FAIL Level 2.5 - Internal Integration 19 Does the Service Desk provide a single point of contact for all customer queries? 20 Does the Service Desk have access to a library of all product, hardware and software documentation and reference material used by customer / users? 21 Are major incidents/problems/changes from the previous week reviewed with customers? 22 Does a customer list exist and is it used to monitor customer satisfaction levels? 23 Are second-line support staff involved in the Service Desk, either on a full time or a rotational basis? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answers 'Y' FAIL Level - Products 24 Is a single source of customer / user and supplier details maintained? 25 Are standard pro-forma's available for capturing customer / user details and identification? 26 Are the services offered by the Service Desk clearly defined for customers and other parties? 27 Are reports regularly produced for all the teams contributing to the service provision process, concerning types of customer contacts? 28 Is a workload analysis produced to help determine staffing levels? 29 Are weekly management reviews held to highlight service availability, customer satisfaction and major incident areas? 30 Do management review Service Desk’s recommendations for service improvements? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' FAIL Level 3.5 - Quality Control 31 Are the standards and other quality criteria applicable for the registration of incidents and for call handling made clear to Service Desk operators? 32 Are Service Level Agreements available and understood by Service Desk operators 33 Are the personnel responsible for Service Desk activities suitably trained? 34 Does the organisation set and review either targets or objectives for the Service Desk? 35 Are there suitable tools in use to support the Service Desk function? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' Level - Management Information Page 78 FAIL 36 Do you provide management with information concerning customer satisfaction with services? 37 Do you provide management with information concerning operational performance of the Service Desk? 38 Do you provide management with information concerning customer awareness/ training needs? 39 Do you provide management with information concerning trend analysis in incident occurrence and resolution? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' FAIL Level 4.5 - External Integration 40 Do you hold regular meetings with interested parties in which Service Desk matters are discussed? 41 Does the Service Desk control the Incident Management function and have the interfaces between the Service Desk and Incident management been defined and communicated? 42 Does the Service Desk receive information from Change Management regarding impending changes to services? 43 Does the Service Desk exchange information with Service Level Management concerning breaches in service level agreements and the service and support commitments they contain? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' FAIL Level - Customer Interface 44 Do you check with the customer if the activities performed by the Service Desk adequately support their business needs? 45 Do you check with the customer that they are happy with the services provided? 46 Are you actively monitoring trends in customer satisfaction? 47 Are you feeding customer survey information into the service improvement agenda? 48 Are you monitoring the customer's value perception of the services provided to them? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions FAIL Biểu mẫu công cụ đánh giá mức độ trưởng thành quy trình quản lý thay đổi ITIL Service Delivery Self Assessment: Service Level Management (Y)es or (N)o Level - Pre-requisites Are at least some service level management (SLM) activities established within the organisation, e.g service definition, negotiation of SLA's etc? Have you identified the customers for your IT services? Are service attributes identified? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' FAIL Level 1.5 - Management Intent Has the purpose and benefits of service level management been disseminated within the organisation? Has the appropriate data on which to base service levels been determined? Are there agreed procedures by which Service Level Agreements are negotiated and reviewed? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' Level - Process Capability Page 79 FAIL Have responsibilities for service level management activities been assigned? Has a catalogue of existing services been compiled? Are there mechanisms for monitoring and reviewing existing service levels? 10 Does the service catalogue give a clear and accurate picture of all services being provided? 11 Are all customer service requests verified? 12 Do you have a mechanism leading to service improvement? 13 Are services prioritised in the service catalogue? 14 Do you have a mechanism for scheduling service implementations? 15 Are the majority of services covered by SLAs? 16 Have all existing SLAs been reviewed and agreed by customers? 17 Do the majority of SLAs have underpinning contracts and OLAs in place? 18 Are there mechanisms in place to monitor and measure all items in existing SLAs? 19 Are SLAs reviewed on a regular basis? 20 Are the majority of SLAs, OLAs and underpinning contracts current? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answers 'Y' FAIL Level 2.5 - Internal Integration 21 Do you compare service provision with the agreed service levels? 22 Do you have a mechanism for keeping your service catalogue in line with new/changed services? 23 Do you use service records to provide management and customers with meaningful information on the quality of service? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' FAIL Level - Products 24 Are standard service reports produced regularly? 25 Are the services and their components explicitly defined and what is excluded documented in SLA's? 26 Do SLAs have clearly identified key targets for service hours, availability, reliability, support, response times and change handling? 27 Are service components identified as configuration items (CIs)? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answers 'Y' FAIL Level 3.5 - Quality Control 28 Are the standards and other quality criteria for SLM documented? 29 Are the personnel responsible for SLM activities suitably trained? 30 Does the organisation set and review either targets or objectives for SLM? 31 Does the organisation use any tools to support SLM? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' Level - Management Information 32 Do you provide management with information concerning service targets and actual performance? 33 Do you provide management with information concerning trends in service level breaches? 34 Do you provide management with information concerning standard service offerings? 35 Do you provide management with information concerning number of requests for new/changed services? 36 Do you provide management with information concerning trends in service level request? Page 80 FAIL 37 Are SLA monitoring charts provided to give an overview of how achievements have measured up to targets? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' FAIL Level 4.5 - External Integration 38 Does SLM actively involve Availability Management regarding service levels? 39 When negotiating service levels does SLM consult other service delivery and support areas like Capacity Management, Financial Management for IT Services, Service Desk and Change Management? 40 Is SLM consulted by Change Management concerning potential impact of changes to agreed service levels? 41 Does SLM ensure that the service catalogue is integrated and maintained as part of the Configuration Management database (CMDB)? 42 Does SLM ensure that the incident and problem handling targets included in SLAs are the same as those in the Service Desk tools? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answers 'Y' FAIL Level - Customer Interface 43 Do you check with the customer if the activities performed by Service Level Management adequately support their business needs? 44 Do you check with the customer that they are happy with the services provided? 45 Are you actively monitoring trends in customer satisfaction? 46 Are you feeding customer survey information into the service improvement agenda? 47 Are you monitoring the customers value perception of the services provided to them? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions FAIL Biểu mẫu công cụ đánh giá mức độ trưởng thành quy trình quản lý thay đổi ITIL Service Delivery Self Assessment: Capacity Management (Y)es or (N)o Level 1: Pre-requisites Are at least some capacity management activities established within the organisation, e.g monitoring of usage and performance, capacity planning, sizing of service elements etc? Are capacity management activities assigned to specific individuals or functional areas? Are monitors available for hardware, software, networking & peripherals and does Capacity Management have access to them? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' FAIL Level 1.5: Management Intent Have the purpose and benefits of capacity management been disseminated within the organisation? Has the scope of capacity management been determined? Is the organisation committed to a corporate capacity management plan which includes future business requirements? Is the organisation committed to producing a Capacity Plan? Is the organisation committed to the proactive management of the capacity of the network, servers and desk-top equipment? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' Level 2: Process Capability Page 81 FAIL Have responsibilities for capacity management activities been assigned? 10 Is there a process in place to ensure future business requirements for IT services are incorporated into capacity management plans? 11 Does the organisation have a process to ensure that there is sufficient capacity to support planned services? 12 Are services detailed in SLA's monitored, measured and growth/performance predicted? 13 Are there mechanisms for analysing system usage and for reporting on performance? 14 Are service elements both defined and sized for new services? 15 Is actual performance against agreed service levels recorded? 16 Do you model systems behaviour under various workloads and provide tuning recommendations? 17 Is Capacity Management incorporated into all change and project planning processes? 18 Is the utilisation of each resource and service monitored on an on-going basis? 19 Are end-to-end service response times monitored? 20 Is trend analysis conducted to predict future resource management? 21 Do you perform market testing of new and emerging technologies? 22 Does the capacity management process provide input to the business continuity process? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' FAIL Level 2.5: Internal Integration 23 Do you analyse business plans to ensure that there is sufficient capacity to support planned services in anticipated time-scales? 24 Do you analyse usage and performance data in order to optimise resource utilisation? 25 Are required service levels and forecasts used to define and size service elements? 26 Do you identify variances, trends and deviations from plans in the utilisation of resources? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' FAIL Level 3: Products 27 Do you have a Capacity Management Database? 28 Do you maintain a Capacity Plan? 29 Is the Capacity Management Database aligned with the Configuration Management Database? 30 Are standard reports concerning performance produced on a regular basis? 31 Are standard reports concerning the use and allocation of key resources produced on a regular basis? 32 Do you produce forecasts of new workloads and their resource requirements? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answers 'Y' Level 3.5: Quality Control 33 Are the standards and other quality criteria applicable to capacity management activities explicit and applied? 34 Are the personnel responsible for capacity management activities suitably trained? 35 Does the organisation set and review either targets or objectives for capacity management? 36 Does the organisation have suitable tools to support capacity management activities? Page 82 FAIL Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' FAIL Level 4: Management Information 37 Does Capacity Management provide information concerning resource utilisation? 38 Does Capacity Management provide information concerning infrastructure requirements for maintaining service levels? 39 Does Capacity Management provide information concerning performance trends? 40 Does Capacity Management provide information concerning utilisation of chargeable resources? 41 Does Capacity Management provide information concerning details of proposed new workloads? 42 Does Capacity Management provide information concerning recommendations based on technology trends / emerging technology? 43 Does Capacity Management provide information concerning variances between planned and actual capacity utilisation? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answer 'Y' FAIL Level 4.5: External Integration 44 Do you hold regular meetings with interested parties in which capacity management matters are discussed? 45 Does Capacity Management exchange information with Service Level Management concerning services and workloads to be monitored? 46 Does Capacity Management exchange information with Service Level Management concerning proposed service levels for new workloads? 47 Does Capacity Management exchange information with Financial Management for IT Services concerning chargeable resource utilisation? 48 Does Capacity Management exchange information with Configuration Management to obtain details of IT components and workload deployment across them? 49 Does Capacity Management exchange information with Change Management for details of any changes proposed to existing workloads and to feed back the results of a performance impact analysis? 50 Does Capacity Management exchange information with IT Service Continuity Management to incorporate ITSCM requirements for all recovery options into the Capacity Plan? 51 Does Capacity Management exchange information with IT Service Continuity Management to assess the impact of RFCs on recovery options? 52 Does Capacity Management share use of the CMDB and other common tools for planning, monitoring and alerting with Availability Management? 53 Does Capacity Management exchange information with Applications Management regarding the development of new and existing systems? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions + other answers 'Y' FAIL Level 5: Customer Interface 54 Do you check with the customer if the activities performed by Capacity Management adequately support their business needs? 55 Do you check with the customer if they are happy with the services provided? 56 Are you actively monitoring trends in customer satisfaction? 57 Are you feeding customer survey information into the service improvement agenda? 58 Are you monitoring the customers value perception of the services provided to them? Minimum score to achieve this level: 'Y' for all mandatory ('M') questions Page 83 FAIL Page 84 ... Nghiên cứu quản trị hệ thống công nghệ thông tin Khối công nghệ thông tin – - Ngân hàng thương mại cổ phần Việt Nam Thịnh Vượng (VPBank) Về không gian, tập trung vào quản trị vận hành hoạt động hệ... theo dõi kiểm soát hoạt động CNTT tổ chức trở thành chức quản trị thiếu quản trị doanh nghiệp Quản trị CNTT tránh nhiệm nhà quản lý, ban giám đốc, hội đồng quản trị, quản trị CNTT góp đảm bảo... ngân hàng Công nghệ thơng tin có vai trò quan trọng hoạt động doanh nghiệp, đặc biệt lĩnh vực ngân hàng, với ngân hàng tồn nghiệp vụ ngân hàng tin học hóa mức cao cung cấp dịch vụ Page ngân hàng