2.4.2. Cost and Risk
💡 First Principle: Cost and risk are the two things a good service moves off the consumer's plate — so they're not just downsides to minimize, they're levers a provider pulls to create value by absorbing what the consumer would rather not carry.
Cost is the amount of money or resources spent on a particular activity or resource. In a service relationship there are costs removed from the consumer (which the provider absorbs) and costs imposed on the consumer (which they take on by using the service). Risk is a possible event that could cause harm or loss, or make it harder to achieve objectives — and equally, in ITIL's framing, uncertainty that can carry positive as well as negative outcomes.
Explaining how they contribute to value: a service creates value partly by removing costs and risks the consumer would otherwise bear (you don't buy or secure your own servers) while being honest about the costs and risks it imposes (subscription fees, dependency on the provider). Net value reflects this balance.
⚠️ Exam Trap: Risk in ITIL is not purely negative. It includes positive uncertainty (opportunity). And a provider absorbing risk is a source of value, not merely a cost centre — options that treat risk only as "a bad thing to eliminate" miss the framing.
Reflection Question: How can taking on more risk for a consumer actually increase the value a provider creates?
