Your new workforce won't be all human. Join the
conference to learn the new workforce OS.
request invite
TL;DR: Focus on value is the first ITIL 4 guiding principle, and the one the other six serve. It says every activity should trace back to value for the service consumer, and value is the outcome they experience, not the work you do. Teams drift from it by measuring activity (tickets closed, deflection rate, SLA green) instead of outcomes. The sharpest place to see this is access: value is not "the access request was closed," it is time-to-access, how fast the person could actually work, and how fast a leaver's access was gone. A governed AI Coworker grants pre-approved access in minutes, routes the risky requests to a human, removes leaver access within policy, and reports the time. Automation up to the line, a human at the line.
This is the first in a series walking each of the seven ITIL 4 guiding principles one at a time. We start with Focus on Value because it is the one every other principle exists to support. Start where you are, keep it simple, optimize and automate, they are all in service of value. Get this one wrong and the rest optimize the wrong thing.
Part of the ITIL 4 series: The seven ITIL 4 guiding principles, The ITIL 4 service value chain, rebuilt with AI Coworkers, Start where you are, the second guiding principle.
In ITIL 4, value is not something IT hands over. It is co-created between the provider and the consumer, and it is defined by the consumer: their desired outcomes, the costs they avoid, and the risks they no longer carry. Focus on value means two things in sequence. First, know who you are serving and the outcome they are actually trying to reach. Second, make sure every activity, every metric, every project links back to that outcome, and stop the ones that do not.
The trap is that "value" sounds obvious and is easy to assume. A team can be certain it is delivering value while the consumer quietly disagrees, because the team is looking at its own activity and the consumer is looking at their outcome.
Most IT metrics measure activity, not value, and activity is a treacherous proxy. Tickets closed goes up when you split one problem into five tickets. A deflection rate looks great right up until you notice the person got a generic article, closed the chat, and messaged IT anyway ten minutes later. An SLA can be green on a ticket that never solved the actual problem.
None of those numbers are lies. They are just not value. Value is whether the person got unblocked and can get on with their work. When the proxy and the outcome diverge, focusing on value means trusting the outcome.
Nothing exposes the gap between activity and value like access. When someone joins, changes role, or needs a tool, the outcome they want is simple: the access to do their job, now. The activity metric is that the access request ticket was closed. The value metric is how long the person waited before they could actually work, and on the other side, how long a leaver kept access they should no longer have.
Those two clocks are the whole story. A request closed in five days with a green SLA is activity. Access granted in minutes, so the new hire is productive on day one, is value. A deprovisioning ticket closed is activity. A departed employee's access actually gone within the hour is value, and risk closed.
So the value-first move is not a faster queue or a prettier portal. It is compressing time-to-access itself.
This is where a governed AI Coworker earns its place. On an access request, it checks policy and grants the pre-approved, birthright, or role-based access immediately, through a credentialed workflow, never holding the keys itself, and routes anything privileged or out-of-policy to a human approver. On a leaver, it removes access fast within policy the moment the exit is confirmed. And it reports what actually matters: median time-to-access for joiners, time-to-deprovision for leavers, the share auto-granted versus human-approved, and where the delays sit.
That last part, the report, is how value becomes visible to the people who fund IT. A leader does not want to hear that the queue is shorter; they want to see that time-to-access dropped from days to minutes and that leaver access closes within the hour.
We built a Value Coworker to answer the question every CIO asks IT: prove your value. It reads Microsoft Entra, entirely read-only, and reports back on three fronts at once. End-user value: how many licensed people are actually productive versus paying for access they never touch. Agent value: the review itself, hundreds of grants and every licence SKU reconciled in one pass that would take a person hours. And CIO value: the money you can recover from unused paid licences, and the risk you can retire, over-privileged accounts, stale access, licences on the wrong people.
It never changes anything. It recommends, and a human reclaims or revokes. The output is one report attached to the ticket that turns "we closed 400 tickets" into "here is the spend to recover and the risk to close." That is the difference between activity and value.
Access is the sharpest example, not the only one. The same test applies across the service desk. Resolve, do not deflect: a deflection that ends in a second attempt is negative value, because you added a step. Make value visible: giving a CIO a live view of backlog, SLA risk, and trends without a six-week project is itself focusing on value. Reduce friction: every extra form field and portal login is a cost the consumer pays, and cost erodes value.
You do not need a transformation program to start. Pick one high-volume request type, and access requests are the perfect candidate. Write down the outcome the consumer actually wants, in their words. Then measure two things: time-to-outcome (how long until they could work) and effort (how hard it was for them). Finally, find one activity metric your team currently celebrates that does not map to that outcome, tickets closed, SLA met, and stop treating it as success.
What does "focus on value" mean in ITIL 4? It is the first of the seven guiding principles. It means every activity should link to value for the service consumer, and value is defined by the consumer's outcomes, costs, and risks, not by the provider's effort.
What is "value" in ITIL 4? Value is the benefit the consumer receives, co-created between provider and consumer. It is a combination of the outcomes they achieve, the costs they avoid or take on, and the risks they are relieved of or exposed to.
How is value different from output? Output is what you produced (a closed ticket, a delivered report). Value is the outcome the consumer experiences (they are unblocked, the risk is closed).
How do you measure value instead of activity? Measure the outcome and the effort. For access, that is time-to-access for joiners and time-to-deprovision for leavers, alongside how much effort the person spent.
Is this an official ITIL resource? No. ITIL 4 is owned by AXELOS and PeopleCert. This post explains the guiding principle in our own words; it is not affiliated with or endorsed by AXELOS or PeopleCert.
Focus on value is first for a reason: it is the test every other decision has to pass. Know who you serve and the outcome they want, tie every activity to it, and be willing to retire the metrics that only look like value. Access makes it concrete, stop celebrating the closed request and start measuring time-to-access, and the principle stops being a poster on the wall and becomes something you can put a number on.
Next in this series: Start Where You Are. For the overview of all seven, see the guiding principles.
See how AI Coworkers keep IT work tied to value at atomicwork.com.
Sources and further reading: Atomicwork ITIL 4 guide; PeopleCert ITIL 4 Foundation; AXELOS ITIL service management.
