Merger integration and role confusion at a three-university group
Three universities merge into one institution with 6,000 staff and 38,000 students. Procurement remains decentralized across 11 buying teams, each using different supplier catalogues. The service desk uses four ticketing tools and cannot see assets purchased outside central IT. Research departments buy specialized equipment with grant funds and insist they own the records. The security team must report patch status for 9,000 endpoints within 48 hours of a critical vulnerability, but only 5,200 endpoints are discoverable. A new CMDB is funded, and the programme board wants it live in six months. Nobody has been named as asset owner for research equipment, and the asset manager role is vacant. The CIO wants procurement to stop buying devices without an asset tag, but procurement says that will delay research. The merger also brings three different disposal policies.
1. Define the key ITAM roles and a RACI for onboarding a newly purchased asset from requisition to operational record.
Read the worked answer
The asset owner is accountable for value and risk and approves lifecycle decisions. The asset manager is accountable for the process and record quality. Procurement is responsible for purchase data and supplier terms. The service desk is consulted on support requirements. Security is consulted on configuration and patch attributes. Change enablement is informed or consulted for CI relationships. For onboarding, requisition is procurement responsible with asset manager consulted; receipt is asset manager responsible with procurement consulted; record creation is asset manager accountable and responsible, with the service desk consulted; deployment is service desk responsible with asset manager informed; verification is asset manager responsible with security consulted. The point is to separate accountability for value from operational data entry. A vacant asset manager role must be filled or explicitly delegated before the CMDB programme starts, otherwise the RACI is only a document.
2. Explain how ITAM should integrate with procurement, service desk, security, and change management, including the specific data flows.
Read the worked answer
Procurement should trigger asset onboarding and feed purchase order, supplier, cost, warranty, and contract data; payment should require an asset identifier. The service desk should see asset and CI data during incidents and feed back user, location, and status changes. Security needs discovery and patch data mapped to stable asset or CI identifiers; the 48-hour report is impossible while 3,800 endpoints are undiscoverable, so endpoint coverage is a prerequisite. Change management needs CI relationships to assess impact, and asset lifecycle changes should be raised as changes where appropriate. Automate data flows where possible; manual spreadsheets create lag and duplication. Define one identifier and interface rules across the four ticketing tools. Integration is not a one-off project; it is a set of agreements and data contracts that survive the merger.
3. Recommend how to handle ownership of research equipment without blocking procurement.
Read the worked answer
Do not force central ownership of grant-funded equipment. Define the principal investigator as asset owner for grant compliance, with a lightweight minimum record: grant reference, value, location, custodian, data-bearing or hazardous status, and disposal restrictions. ITAM provides the template, validation, and audit trail; procurement uses a fast-track code so research is not delayed. Escalate only high-risk items, such as data-bearing, export-controlled, or hazardous equipment. This preserves accountability without pretending central IT controls grant spending. It also gives the security team the inventory it needs for patching and incident response while respecting academic ownership.