 have implemented firm-wide cyber resilience at a time when the average data breach exceeds $3 million USD. The Information Technology Infrastructure Library (ITIL) framework is an essential way to get secure.

The ITIL framework is a set of best-practice procedures and processes for IT and digital service management. It is a framework used by a huge range of organizations to ensure IT services are fully aligned with an organization's key goals. It's a vital tool in the modern digital workplace and provides a clear structure for achieving 

. Its latest edition — version 4 — was launched in 2019, with requirements added in 2023, ensuring the framework provides solutions to the reality of today's IT service industry.

The benefits and impact of the ITIL framework

How the ITIL framework supports IT governance and risk management

A set of practices for delivering IT services that align with business needs.

The ITIL framework is a collection of best practices that offers structured guidance on managing the IT service lifecycle, including service strategy, design, transition, operation and continual improvement. Organizations can use the adaptable models and procedures to improve efficiency while delivering quality services.

The ITIL Framework helps an organization:

Produce a clear model for ongoing success.

It is used to improve core IT service processes and is flexible to each organization’s unique requirements. A modular structure means implementation and improvements can be made in stages.

ITIL was created in the 1980s by the UK’s Central Computer and Telecommunications Agency (CCTA), a government agency providing IT support to other departments. It was originally created to standardize the processes for IT support and service management. It consisted of a group of IT service management processes outlined in a library of books. ITIL is now owned by a partnership between the UK Cabinet Office and Capita called AXELOS.

Over the years, the ITIL Framework has been streamlined and adapted to reflect a rapidly changing digital landscape. It has evolved alongside changes in technology and IT services and is currently in its fourth iteration. ITIL 4 provides organizations with the tools needed to deal with rapidly changing and varied 

Today, the ITIL Framework is one of the most popular IT service frameworks in the world. It's recognized internationally for setting the standard for IT service delivery. The ITIL framework is aligned with international quality system standards such as the ISO 20000 standards. Because of its widespread adoption, ITIL definitions and concepts act as a common language between IT service providers.

Organizations can use the ITIL framework to assess and improve their end-to-end delivery of digital services and products. It encourages a holistic approach to improving processes across the entire organization. These procedures can support digital change, introduce new ways of working and streamline current IT service processes.

The third version of the ITIL framework, ITIL 3, introduced a more lifecycle-based approach to IT service management, focusing on five key stages:

 Defining the organization’s approach to delivering IT services that meet business goals and customer needs.

 Creating effective and efficient IT services, processes and policies that align with the strategic objectives.

 Managing changes to services, including development, testing and deployment, with minimal risk and disruption.

 Overseeing the day-to-day delivery and management of IT services to ensure reliability and user satisfaction.

 Ongoing evaluation and enhancement of IT services and processes to drive performance and business value.

ITIL v3 emphasized aligning IT services with business goals and improving service delivery and customer satisfaction. Although it’s largely been succeeded by ITIL 4, many organizations still use ITIL 3 as a foundation for their ITSM practices.

ITIL 4, a version of the ITIL framework, was launched in 2019 and has built on the success of the previous version. ITIL 3 had streamlined IT service management processes and was aligned with international service management standard ISO 20000.

ITIL 4 has a renewed focus on customer experience and digital transformation. It engages with the reality of modern-day IT governance, such as cloud-based services or machine learning. Digital technology is rapidly changing, and ITIL 4 provides the tools and insight to react to and mitigate risk. The ITIL Framework helps organizations create an environment of efficiency and quality, delivering IT services at speed. It is a vehicle for change, as organizations can also use it to understand and implement new ways of working, like DevOps, Lean and Agile.

ITIL 4 ensures IT services are aligned with wider business aims through the principle of a Service Value System. The system highlighted in ITIL 4 is called the Service Value Chain. It gives organizations an operating model to deliver and improve an effective IT service. The Service Value Chain is a flexible model for planning the journey between customer demand and delivery of service. This system is key to 

, as it develops a resilient organization that is responsive to change.

ITIL 4 consists of 34 different practices, focusing on refining technical management, service management, and general management. Organizations gain processes and functions for all areas of service delivery, including risk management, workforce development, and asset development.

ITIL 4 introduces four dimensions to be considered when delivering a service or product. This ensures that the full organization is taken into account, avoiding inefficient processes. It encourages organizations to map the four dimensions whenever they are designing a service or product, providing a framework for strategic-level planning. The four dimensions replace the Four Ps found in the previous version, ITIL 3 (Products, People, Partners, Processes).

 — This dimension focuses on the structure and governance of the organization and the people involved in every aspect of the service. This includes suppliers, customers, employees, managers and 

. Organizations should consider how teams are connected, the level of training, and the type of organizational culture.

 — This dimension denotes the tools, technology, and information needed to support both product delivery and IT governance and management. Considerations may include the capabilities and capacity of the support service and the technology required for the service.

 — This element centers around the external suppliers and partners that help organizations deliver products and services. The comparison of in-house versus outsourced capabilities is a key part of this dimension. Organizations should consider and compare the cost of outsourcing, as well as reliability, performance, and capacity.

 — This dimension is all about how services and products are delivered. ITIL 4 introduces the concept of a Service Value Chain, the operating model to deliver services or products. The Service Value Chain will be explored in more detail later in the article but can be used for an incident response as well as product development.

The main aspect of ITIL 4 is the introduction of the Service Value Chain, a model for service delivery. It focuses on the concept of a value stream and replaces the Service Lifecycle system found in ITIL 3.

A value stream is a journey between receiving a request (or demand) and delivering a product or service (or value). In this instance, the model is based on six flexible activities that can be rearranged to create value streams for specific purposes. It's very flexible, as the value stream doesn't need to be linear. The order of activities is able to dynamically shift to fit the requirement. An example could be creating an incident response process as part of a risk management strategy.

The Service Value Chain naturally brings different areas of the whole organization together, with IT services as the link. This concept is an integral part of ITIL 4, as each activity can draw on a procedure or practice outlined elsewhere in the framework. A holistic approach to high-level IT governance is promoted, allowing for informed strategic planning. The six activities found within the Service Value Chain are:

— Engage with stakeholders to understand their needs. The aim is to forge good stakeholder relationships and understand their service requirements.

— Understand the direction, current status, and required improvements across the organization, services, and products.

 — Achieve continuous improvements in services. Use the Service Value Chain to improve processes across all areas of the organization.

 — Ensure that the cost and quality of services meet the expectations of stakeholders.

 — Ensure individual components of services are reliably available.

— Meet agreed expectations by delivering services and support.

Today, organizations face a rapidly changing digital environment. A variety of IT systems and services are interwoven throughout the company’s structure and operations. The ITIL 4 Framework has evolved to meet these changes and can provide best-practice procedures for all IT services. Organizations also gain a framework to guide them through digital transformation and new ways of working to improve service efficiency.

A modular structure that encourages continuous improvements.

A Service Value Chain that embeds the ITIL Framework across the entire organization.

New ways of working to improve service efficiency.

International quality standards for IT service delivery.

As an internationally recognized framework for IT services, the concepts presented by ITIL 4 help to elevate an organization to international quality standards. ITIL 4 is shaping how organizations run their business across the world. The concepts and definitions within the ITIL Framework are a common language between international partners.

ITIL 4 has a modular structure, with baseline concepts outlined in the Foundation section. This allows organizations and individuals to get a well-rounded idea of the ITIL Framework before moving on to supplementary sections. This approach helps to create an environment of continuous, staged improvements within the organization. The stage-by-stage progression is reflected in ITIL 4 certification, with different levels providing support for each step of an IT service professional's career. ITIL certification will be explored in detail later in this article.

Learn how to run an IT compliance program that keeps up with complex threats and regulatory environments.

Grow with IT compliance

IT governance, risk management and the ITIL framework are interconnected. Adopting the ITIL framework provides the structured processes, clear accountability and continuous improvement practices that strengthen 

IT governance seeks to align IT investments and services with business goals, value creation and regulatory compliance. ITIL furthers these aims by:

Establishing standardized processes for service management, which create transparency and control

Defining roles and responsibilities that promote accountability across IT and business units

Providing performance measurement tools, such as KPIs and Service Level Agreements (SLAs), to monitor and optimize IT services

Encouraging IT investments that advance overall business strategies through the Service Strategy phase

The above governance benefits are hand-in-hand with risk management. Having ITIL in place enhances your 

Integrating proactive risk identification and mitigation into IT service design and change management

Offering detailed guidance on incident, problem and change management processes that reduce the likelihood and impact of service disruptions

Supporting continual service improvement to regularly assess risks, identify vulnerabilities and implement corrective actions

Promoting documentation and process consistency to minimize errors and improve compliance with industry standards and regulations

In essence, ITIL best practices overlap with the practices that bolster governance, reduce IT-related risks and ensure that IT services consistently support business success.

The real-world impact of the ITIL framework

The ITIL framework delivers measurable results across industries. But what does it look like in practice? ITIL can be particularly influential in industries like financial services, where system reliability, regulatory compliance and customer trust are essential.

Consider a regional financial services firm. The firm faces inconsistent IT processes, frequent service disruptions and poor communication between technical teams and business units. Imagine a system going down and the team scrambling to resolve the issue; without clear procedures, fixes are reactive, temporary and undocumented.

Now imagine the firm adopted ITIL best practices. The ITIL framework introduced standardized workflows for incident, change and problem management. It also pushed the firm to establish a single point of contact to streamline requests and improve response times. The IT team began holding post-incident reviews to uncover root causes and prevent repeat issues.

Service disruptions can be easier to manage because everyone can follow a clear process

Communication with IT and business leaders can improve, with better visibility into service performance

Change management can become more controlled, reducing the risk of unintended outages during updates or system changes

Continuous improvement could become part of the culture, with teams regularly analyzing incidents to strengthen processes

When and where to implement the ITIL framework

The full introduction of the ITIL Framework takes time, especially if it means a root-and-branch change to the current way of working. It can take up to a year or more for a complex project to be fully implemented. Most organizations will introduce it in stages and may take some time to bring internal IT stakeholders on board through a proper engagement campaign. There are many steps ahead of implementation, from project alignment, the assignment of roles, an internal audit, and the designing of processes.

To begin with, organizations may use it to combat limitations or issues within current support processes. After issues are improved, organizations can move on to driving improvements to wider IT infrastructure or services. The aim should be to get key stakeholders and managers ITIL certified, allowing them to be the driving force behind the implementation of the framework. Because of the nature of ITIL 4, there will be an environment of continuous improvement which becomes the new normal.

ITIL is best suited for organizations that:

Deliver complex, customer-facing IT services where uptime, efficiency and service quality directly impact the business

Operate in heavily regulated industries like financial services, healthcare, energy and government, where process consistency and accountability are essential

ITIL framework explained: what it is & how to comply

In the first half of 2025, rapid market shifts, new regulations, including updated SEC guidance on Schedules 13D/13G – and changing activist tactics pushed boards, investors and advisors to rethink how they operate. It’s been the most disruptive proxy season in years – and the impact is far from over.

Based on insights from 

, here are five things you need to know.



1.  Engagement is no longer business as usual



Faced with new regulations and heightened scrutiny, many institutional investors have pulled back on active outreach and are reassessing how they engage with companies with new SEC guidance narrowing the definition of “passive” investors. The White House’s executive order on diversity, equity & inclusion has also upended many stewardship teams’ voting policies.

That silence is creating new challenges for issuers. Without the usual dialogue, companies are left to interpret how shareholders might vote based on historical behavior and policy documents, guesswork that adds friction, reduces transparency, and increases the risk of being caught off guard. Proactive planning, data tracking, and year-round monitoring of shareholder trends are now essential to stay aligned and avoid surprises.



2.  ESG proposals are losing steam, but governance still matters



With tougher rules for no-action relief, the volume of shareholder proposals advanced saw a notable dip. Support for environmental and social proposals continued to fall in the first half of 2025, averaging just 11% while investor backing for anti-ESG proposals fell to a record low of 1.4%.

Governance-focused proposals told a different story. Thirty-three passed with majority support in the first half of the year, reinforcing that investors still care deeply about board structure, accountability, and transparency. That sustained traction suggests governance remains the most reliable path for investors seeking impact, and the most likely area where boards may face real pressure.



3.  Activists are picking their battles, and winning them



Activist campaigns may be down in volume, but they’re hitting harder than ever. In the first half of 2025, activists secured 112 board seats, the highest since 2022, even as formal demands for board representation dipped. Over 90% of those seats came through settlements, highlighting a growing preference for quiet, efficient victories.

But the playbook has evolved. Today’s activists often run high‑conviction campaigns that use “vote no” or “withhold” tactics instead of mounting full proxy fights. These targeted efforts are cost-effective and quick, but still carry real pressure.



: You might not see a full-blown proxy fight, but activist pressure is still very real, just quieter. Whether through settlements or vote‑no campaigns, these moves can shift board composition, governance, or strategy without the same level of public fanfare. Being prepared means recognizing threats early, even when the spotlight appears off.



4.  Agility and anticipation are now table stakes



This year proved that traditional engagement strategies aren’t enough. Shareholder behavior is shifting quickly, driven by regulation, political pressure, and market volatility, and companies that can’t adapt risk getting caught flat-footed.

Activists are using a wider range of tactics, from quiet settlements to vote-no campaigns. Investors are dialing back engagement and tweaking policies, forcing issuers to make decisions with less direct input. And governance teams are under pressure to respond in real time, even when they don’t have all the information.

Boards need to be flexible and fast-moving. That means understanding the players, anticipating emerging risks, and having a plan ready, not just for the proxy vote, but for everything that might happen before and after it.



5.  Data-driven engagement is the new gold standard



With fewer direct conversations happening between shareholders and companies, gaps in communication are growing, and so is the risk of being surprised. In this environment, access to timely, reliable data isn’t a luxury. It’s how governance teams stay grounded when visibility is limited.

Past voting trends, policy updates, and investor behavior are all critical signals when engagement slows. But they only work if boards are tracking them consistently, not just at proxy time, but year-round. Without that foundation, companies are left guessing at what matters most to their shareholders, and often finding out too late.



 or learn more about Diligent Market Intelligence.

5 Key Takeaways from the 2025 Proxy Season

Leadership in the boardroom is a multifaceted journey that requires a blend of diverse experiences, proactive engagement, and strategic preparation. At the Next Gen Board Leaders Summit, seasoned board chairs including Alicia Syrett, Founder of Madam Chair, provide valuable insights on what it takes to lead a board effectively and create a strong boardroom culture.

The ​​p​​ath to ​​b​​oard ​​l​​eadership

​​Board​ chairs typically reach their positions through a combination of executive experience, committee work, and active involvement in board matters.​There​’s no set formula, but d​​iverse backgrounds and a ​​bias for action​​​ a​re essential. Continuous learning, such as seeking out mentors and familiarizing oneself with board and committee responsibilities, can help build the necessary skills and credibility. ​That said, ​​i​t's also crucial ​for aspiring chairs ​to be realistic about the time commitment required for the role.

Resources and ​​p​​ractices for ​​e​​ffective board chairs

To excel in the chair role, familiarity with key resources like 'Robert’s Rules of Order' and practical articles like 'How to be a Good Chair' can provide a solid foundation. ​Bu​t it’s the consistent habits that matter most. ​​Strategic use of the agenda, starting meetings with ​​planning​ and forward-looking topics​, and conducting pre-meeting calls with directors can ​clarify priorities and ​foster alignment. Engaging directly with shareholders and proxy advisors is vital for anticipating issues and building trust. Regular communication with the CEO and fellow directors, as well as ​​creating​​ an environment where directors feel comfortable raising ​​tough questions and dissenting views​​ is also crucial.

: ​​A good​​ board chair ​​acts as​​ the 'conductor of the orchestra,' responsible for ensuring the board operates cohesively.

: Effective chairs take their responsibilities seriously, benchmark against other boards, and ​​seek​​ regular ​​feedback from​​ the CEO and fellow directors.

​​​Making the most of​​ meeting time

: By prioritizing strategic planning​, sharp agendas, and candid discussion,​ the chair can ​drive more meaningful outcomes ​​​​​​​in​​ limited meeting time.

​​M​aintaining a ​​s​​trong ​​b​​oardroom ​​c​​ulture

​​​Culture starts with the chair – and a​​ robust boardroom culture is essential for the board's effectiveness. Regular assessments, ideally conducted by third parties to gather unfiltered feedback, are critical. The chair should act on this feedback and​​ actively reinforce high expectations for board conduct and performance​​. By identifying and ​​actively drawing out​​​​​​ the strengths of each board member, the chair can ensure that the board remains a dynamic and effective decision-making body.

In summary, effective board leadership ​requires more than experience ​– it calls for ​​​​preparation, ​​intentionality, ​​and a commitment to fostering a strong, cohesive boardroom culture. By following the insights shared by experienced chairs, aspiring leaders can better navigate the complexities of board leadership and contribute to the success of their organizations.

Navigating ​b​oard ​l​eadership: The ​v​iew from the ​c​hair 

This article originally appeared in our July 31 edition of the Diligent Minute Newsletter. For more insights like these, delivered straight to your inbox, subscribe

Compliance lapses have big repercussions, like fines, reputational damage, compromised legal standing and missed business opportunities, to name a few.

So, it’s logical to assume that compliance is a top board priority today, with the chief compliance officer (CCO) front and center for important discussions — right?

Not so much, as we discovered in the findings of the 

, an annual survey of more than 200 U.S. public company directors conducted in partnership with Corporate Board Member and FTI Consulting.

Regulatory compliance ranked relatively low on both the list of company priorities for 2025 and on topics directors wanted to discuss at upcoming board meetings. What we’ve heard anecdotally from CCOs themselves affirms these findings. They sometimes feel neglected by their boards.

And here’s the key takeaway: CCOs may not perceive themselves as wanted — but their perspectives and input are sorely needed right now, as the following example illustrates.

Authorities in France and Switzerland, as well as state authorities in the U.S., are amping up their enforcement of anti-bribery laws. But only 65% of the directors we surveyed reported ethics policies and employee training to mitigate bribery and corruption risk in their supply chains. Only 60% implemented regular audits and inspections in this area, and a full 22% answered “not applicable/don’t know” about their risk-mitigation activities.

How can boards and CCOs close this dangerous gap?

In a recent Corporate Director podcast, we received sage advice from a compliance expert and former CCO: Kristy Grant-Hart, now Vice President and Head of Advisory Services for Spark Compliance, a Diligent Brand.

1. Recognize the urgency of the situation

Especially when the board agenda is dominated by changes in trade, technology and the geopolitical landscape, it’s tempting to move compliance to the back burner. This is especially true in industries where regulations have remained static for years.

But boards who deprioritize compliance today — and a strong, transparent board/CCO relationship — do so at their own peril, Kristy cautioned.“ Compliance doesn’t seem important until it’s the only thing, and you’re responding to big problems.”

She pointed out the importance of “more global” compliance areas like conflict-of-interest management and investigations, which “can actually be very, very problematic if you’re not paying attention to them because of what they tell you about the culture and how your company is going.”

Culture is a “hard ask” to oversee, she noted, a mix of subjective and objective data like exit interviews, focus groups and whistleblower surveys. But it’s a rising area of regulatory scrutiny and a major driver of business profitability, so overseeing it in tandem with the CCO, along with the rest of the compliance landscape, needs to be a board priority.

“I would remind directors of their personal responsibility under many laws, as well as the reputational issues that come if they face compliance meltdowns under their watch,” she said.

While 60% of organizations conducting regular anti-bribery audits and inspections was a higher-than-anticipated statistic, Kristy noted that only 65% of organizations implementing anti-bribery training was an area in need of improvement.

“Training is pretty much ground zero,” she declared. And it’s an investment that pays ongoing dividends. As boards become more aware of external pressures, like local AI regulations and growing human trafficking regulations, and internal compliance progress, their oversight becomes more robust and adaptable over time.

Now is the time for directors to proactively invite closer collaboration and information-sharing, recognizing the invaluable role the CCO can play in illuminating trends, anticipating challenges and navigating uncertain times. And CCOs can elevate their own standing through purposeful storytelling: monitoring important data points, synthesizing them and distilling them all into a compelling, contextual narrative, based on what boards care about.

“There is a tendency in our industry to report on what you are doing, your activities,” Kristy noted. “Directors don’t want a litany of what you’ve been up to. They want to understand forward-looking risk, not just backwards-looking risk.”

Want regular access to original research in the field of GRC? Bookmark our 

 for the latest surveys, podcasts and reports.

Diligent

Blog

ITIL framework explained: what it is & how to comply

5 Key Takeaways from the 2025 Proxy Season

Your Data Matters