Leveraging-SharePoint to implement ITIL

IT executives and managers looking for practical SharePoint tools and content that can be quickly implemented to support ITIL adoption.

Rather than start from the beginning, let’s jump right into something you might find useful.

1) At some point in your ITIL journey, you will run into IT Risk Management and the requirement to classify IT risks based on characteristics from 2 or more dimensions.

2) As you already know, a SharePoint list is an ideal repository to manage items and conditional and Boolean functions in SharePoint calculated columns are useful to automatically categorize items.

3) What happens when we combine 1) and 2)?

For example, consider the following IT risk characteristics:

Impact:

• High (H) – Significant impact
• Medium (M) – Moderate impact
• Low (L) – Low impact

Likelihood:

• High (H) – Likely to occur and/or has already occurred
• Medium (M) – May occur
• Low (L) – Low possibility of occurring

Mitigation Planning:

• High (H) – Full mitigation plan in place, implementation underway
• Medium (M) - Partial mitigation plan in place, implementation may or may not be underway
• Low (L) – Mitigation plan under development

The different combinations of these IT risk characteristics may be summarized in the following matrix:

Risk Assessment Codes

The 3 Risk Assessment Codes (RAC) are defined as follows:

RAC 1 – High risk: medium to high impact, medium to high likelihood of occurrence & partial or no mitigation plan in place
RAC 2 – Medium risk: partial or no mitigation plan in place
RAC 3 – Low risk: partial or complete mitigation plans in place

How can we use a SharePoint calculated column to automatically select from the matrix the correct Risk Assessment Code based on the values selected for Impact, Likelihood and Mitigation Planning?

We will first need to re-sort the RAC table and group the rows by RAC score. Why? Because we will group all combinations of Impact, Likelihood and Mitigation Planning that result in the same RAC score under the same conditional IF function in the calculated column to return that RAC score. It's easiest to use Microsoft Excel to do this sorting. After re-sorting, the RAC table from Part 1 will look like this:

The formula for the SharePoint calculated column to select the correct RAC score is:

=IF(OR(AND(Impact="Low",Likelihood="Low",OR(Mitigation="Medium",Mitigation="High")),AND(Impact="Low",Likelihood="Medium",OR(Mitigation="Medium",Mitigation="High")),AND(Impact="Low",Likelihood="High",OR(Mitigation="Medium",Mitigation="High")),AND(Impact="Medium",Likelihood="Low",OR(Mitigation="Medium",Mitigation="High")),AND(Impact="Medium",Mitigation="High",OR(Likelihood="Medium",Likelihood="High")),AND(Impact="High",Mitigation="High",OR(Likelihood="Low",Likelihood="Medium",Likelihood="High"))),"3",IF(OR(AND(Likelihood="Low",Mitigation="Low",OR(Impact="Low",Impact="Medium",Impact="High")),AND(Impact="Low",Mitigation="Low",OR(Likelihood="Medium",Likelihood="High")),AND(Impact="Medium",Mitigation="Medium",OR(Likelihood="Medium",Likelihood="High")),AND(Impact="High",Likelihood="Low",Mitigation="Medium")),"2",IF(OR(AND(Impact="Medium",Mitigation="Low",OR(Likelihood="Medium",Likelihood="High")),AND(Impact="High",Likelihood="Medium",OR(Mitigation="Low",Mitigation="Medium")),AND(Impact="High",Likelihood="High",OR(Mitigation="Low",Mitigation="Medium"))),"1")))

As brutal as this looks, the organizing principles behind it can be used in any scenario where you need to select a value from a matrix with two or more dimensions. We will review these in the next part.

Using the re-sorted table, we can separate and breakdown the different sections of the formula for the SharePoint calculated column as follows:

For RAC 3

"=IF(OR(AND(Impact=”Low”,Likelihood=”Low”,OR(Mitigation=”Medium”,Mitigation=”High”))," which means "if Impact and Likelihood are Low and Mitigation is either Medium or High...then RAC is 3"

"AND(Impact=”Low”,Likelihood=”Medium”,OR(Mitigation=”Medium”,Mitigation=”High”))," which means "if Impact is Low and Likelihood is Medium and Mitigation is either Medium or High...then RAC is 3"

"AND(Impact=”Low”,Likelihood=”High”,OR(Mitigation=”Medium”,Mitigation=”High”))," which means "if Impact is Low and Likelihood is High and Mitigation is either Medium or High...then RAC is 3"

"AND(Impact=”Medium”,Likelihood=”Low”,OR(Mitigation=”Medium”,Mitigation=”High”))," which means "if Impact is Medium and Likelihood is Low and Mitigation is either Medium or High...then RAC is 3"

"AND(Impact=”Medium”,Mitigation=”High”,OR(Likelihood=”Medium”,Likelihood=”High”)), " which means "if Impact is Medium and Mitigation is High and Likelihood is either Medium or High...then RAC is 3"

"AND(Impact=”High”,Mitigation=”High”,OR(Likelihood=”Low”,Likelihood=”Medium”,Likelihood=”High”))),”3″" which means "if Impact is High and Mitigation is High and Likelihood is either Low, Medium or High...then RAC is 3"

For RAC 2

"IF(OR(AND(Likelihood=”Low”,Mitigation=”Low”,OR(Impact=”Low”,Impact=”Medium”,Impact=”High”))," which means "if Likelihood and Mitigation are Low and Impact is either Low, Medium or High...then RAC is 2"

"AND(Impact=”Low”,Mitigation=”Low”,OR(Likelihood=”Medium”,Likelihood=”High”))," which means "if Impact and Mitigation are Low and Likelihood is either Medium or High...then RAC is 2"

"AND(Impact=”Medium”,Mitigation=”Medium”,OR(Likelihood=”Medium”,Likelihood=”High”))," which means "if Impact and Mitigation are Medium and Likelihood is either Medium or High...then RAC is 2"

"AND(Impact=”High”,Likelihood=”Low”,Mitigation=”Medium”)),”2″" which means "if Impact is High and Likelihood is Low and Mitigation is Medium...then RAC is 2"

For RAC 1

"IF(OR(AND(Impact=”Medium”,Mitigation=”Low”,OR(Likelihood=”Medium”,Likelihood=”High”))," which means "if Impact is Medium and Mitigation is Low and Likelihood is either Medium or High...then RAC is 1"

"AND(Impact=”High”,Likelihood=”Medium”,OR(Mitigation=”Low”,Mitigation=”Medium”))," which means "if Impact is High and Likelihood is Medium and Mitigation is either Low or Medium...then RAC is 1"

"AND(Impact=”High”,Likelihood=”High”,OR(Mitigation=”Low”,Mitigation=”Medium”))),”1″)))" which means "if Impact and Likelihood are High and Mitigation is either Low or Medium...then RAC is 1"

In practice, use Conditional Formatting in SharePoint Designer to color code the RAC value as desired. See the example below.

And use the same sorting and grouping principles to select values from complex matrices with more than 3 dimensions.