Framework Introduction and Methodology Part 1

CHAPTER 1 INTRODUCTION Chap ter 1 Int r odUCt ion 1.1 Enterprise Governance of Information and Technology In the light of digital transformation, information and technology (I&T) have become crucial in the support, sustainability and growth of enterprises. Previously, governing boards (boards of directors) and senior management could delegate, ignore or avoid I&T-related decisions. In most sectors and industries, such attitudes are now illadvised. Stakeholder value creation (i.e., realizing benefits at an optimal resource cost while optimizing risk) is often driven by a high degree of digitization in new business models, efficient processes, successful innovation, etc. Digitized enterprises are increasingly dependent on I&T for survival and growth. Given the centrality of I&T for enterprise risk management and value generation, a specific focus on enterprise governance of information and technology (EGIT) has arisen over the last three decades. EGIT is an integral part of corporate governance. It is exercised by the board that oversees the definition and implementation of processes, structures and relational mechanisms in the organization that enable both business and IT people to execute their responsibilities in support of business/IT alignment and the creation of business value from I&T-enabled business investments (figure 1.1). Figure 1.1—The Context of Enterprise Governance of Information and Technology Enterprise Governance of IT Business/IT Alignment Value Creation Source: De Haes, Steven; W. Van Grembergen; Enterprise Governance of Information Technology: Achieving Alignment and Value, Featuring COBIT 5, 2nd ed., Springer International Publishing, Switzerland, 2015, https://www.springer.com/us/book/9783319145464 Enterprise governance of information and technology is complex and multifaceted. There is no silver bullet (or ideal way) to design, implement and maintain effective EGIT within an organization. As such, members of the governing boards and senior management typically need to tailor their EGIT measures and implementation to their own specific context and needs. They must also be willing to accept more accountability for I&T and drive a different mindset and culture for delivering value from I&T. 1.2 Benefits of Information and Technology Governance Fundamentally, EGIT is concerned with value delivery from digital transformation and the mitigation of business risk that results from digital transformation. More specifically, three main outcomes can be expected after successful adoption of EGIT: ⚫ Benefits realization—This consists of creating value for the enterprise through I&T, maintaining and increasing value derived from existing I&T1 investments, and eliminating IT initiatives and assets that are not creating sufficient value. The basic principle of I&T value are delivery of fit-for-purpose services and solutions, on time 1 Throughout this text, IT is used to refer to the organizational department with main responsibility for technology. I&T as used in this text refers to all the information the enterprise generates, processes and uses to achieve its goals, as well as the technology to support that throughout the enterprise. ® COBIT 2019 FRAMEWORK: INTRODUCTION & METHODOLOGY and within budget, that generate the intended financial and nonfinancial benefits. The value that I&T delivers should be aligned directly with the values on which the business is focused. IT value should also be measured in a way that shows the impact and contributions of IT-enabled investments in the value creation process of the enterprise. ⚫ Risk optimization—This entails addressing the business risk associated with the use, ownership, operation, involvement, influence and adoption of I&T within an enterprise. I&T-related business risk consists of I&T-related events that could potentially impact the business. While value delivery focuses on the creation of value, risk management focuses on the preservation of value. The management of I&T-related risk should be integrated within the enterprise risk management approach to ensure a focus on IT by the enterprise. It should also be measured in a way that shows the impact and contributions of optimizing I&T-related business risk on preserving value. ⚫ Resource optimization—This ensures that the appropriate capabilities are in place to execute the strategic plan and sufficient, appropriate and effective resources are provided. Resource optimization ensures that an integrated, economical IT infrastructure is provided, new technology is introduced as required by the business, and obsolete systems are updated or replaced. Because it recognizes the importance of people, in addition to hardware and software, it focuses on providing training, promoting retention and ensuring competence of key IT personnel. An important resource is data and information, and exploiting data and information to gain optimal value is another key element of resource optimization. Strategic alignment and performance measurement are of paramount importance and apply overall to all activities to ensure that I&T-related objectives are aligned with the enterprise goals. In a large case study of an international airline company, EGIT’s benefits were demonstrated to include: lower ITrelated continuity costs, increased IT-enabled innovation capacity, increased alignment between digital investments and business goals and strategy, increased trust between business and IT, and a shift toward a “value mindset” around digital assets.2 Research has shown that enterprises with poorly designed or adopted approaches to EGIT perform worse in aligning business and I&T strategies and processes. As a result, such enterprises are much less likely to achieve their intended business strategies and realize the business value they expect from digital transformation.3 From this, it is clear that governance has to be understood and implemented much beyond the often encountered (i.e., narrow) interpretation suggested by the governance, risk and compliance (GRC) acronym. The GRC acronym itself implicitly suggests that compliance and related risk represent the spectrum of governance. 1.3 COBIT as an I&T Governance Framework Over the years, best-practice frameworks have been developed and promoted to assist in the process of understanding, designing and implementing EGIT. COBIT® 2019 builds on and integrates more than 25 years of development in this field, not only incorporating new insights from science, but also operationalizing these insights as practices. From its foundation in the IT audit community, COBIT® has developed into a broader and more comprehensive I&T governance and management framework and continues to establish itself as a generally accepted framework for I&T governance. 2 3 De Haes, S.; W. van Grembergen; Enterprise Governance of IT: Achieving Alignment and Value, Featuring COBIT 5 , Springer International Publishing, Switzerland, 2nd ed. 2015, https://www.springer.com/us/book/9783319145464 De Haes, Steven; A. Joshi; W. van Grembergen; “State and Impact of Governance of Enterprise IT in Organizations: Key Findings of an International Study,” ISACA® Journal, vol. 4, 2015, https://www.isaca.org/Journal/archives/2015/Volume-4/Pages/state-and-impact-of-governance-of-enterprise-itin-organizations.aspx. See also op cit De Haes and van Grembergen. CHAPTER 1 INTRODUCTION 1.3.1 What Is COBIT and What Is It Not? Before describing the updated COBIT framework, it is important to explain what COBIT is and is not: COBIT is a framework for the governance and management of enterprise information and technology,4 aimed at the whole enterprise. Enterprise I&T means all the technology and information processing the enterprise puts in place to achieve its goals, regardless of where this happens in the enterprise. In other words, enterprise I&T is not limited to the IT department of an organization, but certainly includes it. The COBIT framework makes a clear distinction between governance and management. These two disciplines encompass different activities, require different organizational structures and serve different purposes. ⚫ Governance ensures that: ◼ Stakeholder needs, conditions and options are evaluated to determine balanced, agreed-on enterprise objectives. ◼ Direction is set through prioritization and decision making. ◼ Performance and compliance are monitored against agreed-on direction and objectives. In most enterprises, overall governance is the responsibility of the board of directors, under the leadership of the chairperson. Specific governance responsibilities may be delegated to special organizational structures at an appropriate level, particularly in larger, complex enterprises. ⚫ Management plans, builds, runs and monitors activities, in alignment with the direction set by the governance body, to achieve the enterprise objectives. In most enterprises, management is the responsibility of the executive management, under the leadership of the chief executive officer (CEO). COBIT defines the components to build and sustain a governance system: processes, organizational structures, policies and procedures, information flows, culture and behaviors, skills, and infrastructure.5 COBIT defines the design factors that should be considered by the enterprise to build a best-fit governance system. COBIT addresses governance issues by grouping relevant governance components into governance and management objectives that can be managed to the required capability levels. Several misconceptions about COBIT should be dispelled: ⚫ COBIT is not a full description of the whole IT environment of an enterprise. ⚫ COBIT is not a framework to organize business processes. ⚫ COBIT is not an (IT-)technical framework to manage all technology. ⚫ COBIT does not make or prescribe any IT-related decisions. It will not decide what the best IT strategy is, what the best architecture is, or how much IT can or should cost. Rather, COBIT defines all the components that describe which decisions should be taken, and how and by whom they should be taken. 4 5 Throughout this publication, references to the “framework for the governance of IT” imply the entirety of this description. These components were termed enablers in COBIT ® 5. CHAPTER 2 INTENDED AUDIENCE Chap ter 2 Inte n ded AU die nce 2.1 Governance Stakeholders The target audience for COBIT is the stakeholders for EGIT and, by extension, stakeholders for corporate governance. These stakeholders and the benefits they can gain from COBIT are shown in figure 2.1. Figure 2.1—COBIT Stakeholders Stakeholder Boards Executive Management Business Managers IT Managers Assurance Providers Risk Management Regulators Benefit of COBIT Internal Stakeholders Provides insights on how to get value from the use of I&T and explains relevant board responsibilities Provides guidance on how to organize and monitor performance of I&T across the enterprise Helps to understand how to obtain the I&T solutions enterprises require and how best to exploit new technology for new strategic opportunities Provides guidance on how best to build and structure the IT department, manage performance of IT, run an efficient and effective IT operation, control IT costs, align IT strategy to business priorities, etc. Helps to manage dependency on external service providers, get assurance over IT, and ensure the existence of an effective and efficient system of internal controls Helps to ensure the identification and management of all IT-related risk External Stakeholders Helps to ensure the enterprise is compliant with applicable rules and regulations and has the right governance system in place to manage and sustain compliance Business Partners Helps to ensure that a business partner’s operations are secure, reliable and compliant with applicable rules and regulations IT Vendors Helps to ensure that an IT vendor’s operations are secure, reliable and compliant with applicable rules and regulations A certain level of experience and a thorough understanding of the enterprise are required to benefit from the COBIT framework. Such experience and understanding allow users to customize core COBIT guidance—which is generic in nature—into tailored and focused guidance for the enterprise, taking into account the enterprise’s context. The target audience includes those responsible during the whole life cycle of the governance solution, from design to execution to assurance. Indeed, assurance providers may apply the logic and workflow developed in this publication to create a well substantiated assurance program for the enterprise. CHAPTER 3 COBIT PRINCIPLES Chapter 3 COBIT Principles 3.1 Introd UCtion COBIT® 2019 was developed based on two sets of principles: ⚫ Principles that describe the core requirements of a governance system for enterprise information and technology ⚫ Principles for a governance framework that can be used to build a governance system for the enterprise 3.2 Six Principles for a Governance System The six principles for a governance system are (figure 3.1): 1. Each enterprise needs a governance system to satisfy stakeholder needs and to generate value from the use of I&T. Value reflects a balance among benefits, risk and resources, and enterprises need an actionable strategy and governance system to realize this value. 2. A governance system for enterprise I&T is built from a number of components that can be of different types and that work together in a holistic way. 3. A governance system should be dynamic. This means that each time one or more of the design factors are changed (e.g., a change in strategy or technology), the impact of these changes on the EGIT system must be considered. A dynamic view of EGIT will lead toward a viable and future-proof EGIT system. 4. A governance system should clearly distinguish between governance and management activities and structures. 5. A governance system should be tailored to the enterprise’s needs, using a set of design factors as parameters to customize and prioritize the governance system components. 6. A governance system should cover the enterprise end to end, focusing not only on the IT function but on all technology and information processing the enterprise puts in place to achieve its goals, regardless where the processing is located in the enterprise.6 Figure 3.1—Governance System Principles 1. Provide Stakeholder Value 4. Governance Distinct From Management 6 3. Dynamic Governance System 2. Holistic Approach 5. Tailored to Enterprise Needs 6. End-to -End Governance System Huygh, T.; S. De Haes; “Using the Viable System Model to Study IT Governance Dynamics: Evidence from a Single Case Study,” Proceedings of the 51st Hawaii International Conference on System Sciences, 2018, https://scholarspace.manoa.hawaii.edu/bitstream/10125/50501/1/paper0614.pdf ® COBIT 2019 FRAMEWORK: INTRODUCTION & METHODOLOGY 3.3 Three Principles for a Governance Framework The three principles for a governance framework are (figure 3.2): 1. A governance framework should be based on a conceptual model, identifying the key components and relationships among components, to maximize consistency and allow automation. 2. A governance framework should be open and flexible. It should allow the addition of new content and the ability to address new issues in the most flexible way, while maintaining integrity and consistency. 3. A governance framework should align to relevant major related standards, frameworks and regulations. Figure 3.2—Governance Framework Principles Conceptual 3.4 ® COBIT 2019 COBIT® 2019 improves on prior versions of COBIT in the following areas: ⚫ Flexibility and openness—The definition and use of design factors allow COBIT to be tailored for better alignment with a user’s particular context. The COBIT open architecture enables adding new focus areas (see section 4.4) or modifying existing ones, without direct implications for the structure and content of the COBIT core model. ⚫ Currency and relevance—The COBIT model supports referencing and alignment to concepts originating in other sources (e.g., the latest IT standards and compliance regulations). ⚫ Prescriptive application—Models such as COBIT can be descriptive and prescriptive. The COBIT conceptual model is constructed and presented such that its instantiation (i.e., the application of tailored COBIT governance components) is perceived as a prescription for a tailored IT governance system. ⚫ Performance management of IT—The structure of the COBIT performance management model is integrated into the conceptual model. The maturity and capability concepts are introduced for better alignment with CMMI. COBIT guidance uses the terms governance of enterprise information and technology, enterprise governance of information and technology, governance of IT and IT governance interchangeably. CHAPTER 4 BASIC CONCEPTS: GOVERNANCE SYSTEM AND COMPONENTS Chapter 4 Basic Concepts: Governance System and Components 4.1 COBIT Overview The COBIT® 2019 product family is open-ended and designed for customization. The following publications are currently available:7 ⚫ COBIT® 2019 Framework: Introduction and Methodology introduces the key concepts of COBIT® 2019. ⚫ COBIT® 2019 Framework: Governance and Management Objectives comprehensively describes the 40 core governance and management objectives, the processes contained therein, and other related components. This guide also references other standards and frameworks. ⚫ COBIT® 2019 Design Guide: Designing an Information and Technology Governance Solution explores design factors that can influence governance and includes a workflow for planning a tailored governance system for the enterprise. ⚫ COBIT® 2019 Implementation Guide: Implementing and Optimizing an Information and Technology Governance Solution represents an evolution of the COBIT® 5 Implementation guide and develops a road map for continuous governance improvement. It may be used in combination with the COBIT® 2019 Design Guide. Figure 4.1 shows the high-level overview of COBIT® 2019 and illustrates how different publications within the set cover different aspects. Figure 4.1—COBIT Overview Inputs to COBIT® 2019 COBIT® 2019 COBIT Core COBIT 5 Standards, Frameworks, Regulations Community Contribution • Enterprise strategy • Enterprise goals • Enterprise size • Role of IT • Sourcing model for IT • Compliance requirements • Etc. ED M0 1—E n sur ed Go v e r n an c e Fra me w or k Set ti ng and M a int ena nc e I& F ra me wo rk AP O01— M a n a g e d T Ma nag e me AP O 0 8 — M a n ag ed Relat ions h ips B AI 0 1 — M a n a ge d P r o gr a m s ED M0 2 — E n s u re d B en e fits De liv e ry ED M0 3 — E n s u re d R is k O p tim i zat i on ED M0 4 — E n s u re d R e s o ur c epti m izat io n DS S 0 1— M an a g ed Op e r a t i o n s COBIT Core Publications Tailored Enterprise Governance System for Information and Technology ED M0 5 —E n sur ed Stak e ho ld E nerga g e m e nt O nt A P O 0 2 — M a n a g e d A P O 0 3 — M a n a g e d A P O 04 — M a n a g e d A P O 0 5 — M a n a g e d A P O 0 6 — M a n a g e d AP O 07 — M a n a g e d E nt e r pris e St r ate gy P o rt f o li o B u d g e t a n d Co s t s H u m a n Re s o u r c e s A r ch ite c t u r eI n n o v at io n AP O09 — M a n a g e d Se rv ic e A P O 1 0 — M a n a g e d A P O 11 — M a n a g e d A P O 1 2 — M a n a g e d AP O 1 3 — M a n a g e d A P O 1 4 — M a n a g e d V e nd o r s Q u a li ty R is k Se cu r ity Da ta A g re e m e n ts B A I 03 — M a n a g e B A I0 4 — M a n a g e d S o lu ti on s R e q uir e m e nt s en t i fic a t io a n d C apIda I T Ch a nng es c epAvt aanil ca ebaili ty c it y Ch a n g e B A I 02 — M a n a g ed O r g a n iz at i on a l Focus Area B AI 0 7 — M a n a ge d BAI05—M a n a g e d BAI06—Managed Ac IT C h a n ge nd D e fi n it io n an d B u i ld B AI 0 8 — M a n a ge d Kn o w l e d ge T ra ns i t io n in g ME A 0 3 — M a n a g e d B A I 09 — M a n a g e d B A I 1 0 — M a n a g e d B A I 1 1 — M a n a g e d A s s et s Co n f ig u r a t i o n P r o j e ct s D S S 02 — M a n a g e d D S S 05 — M a n a g e d D S S 0 6 — M a n a g e d DS S 03 — M a n a g e d DSS 04 — M a n a g e d S e rv i c e R e q u e s t s P r ob l e ms C o n ti n u it y S e c u r i ty Bu s i n e ss an d In cid e nt s S er v ic e s o c es s C on t Pr r o ls R e q uir e m e nt s ME A 0 4 — M a n a g e d A ss ur a n c e • SME • Security • Risk • DevOps • Etc. ➢ Priority governance and management objectives ➢ Specific guidance from focusareas ➢ Target capability and performance management guidance COBIT® 2019 Framework: Introduction and Methodology COBIT® 2019 Framework: Governance and Management Objectives 7 Design Factors Reference Model of Governance and Management Objectives COBIT® 2019 Design Guide: Designing an Information and Technology Governance Solution COBIT ® 2019 Implementation Guide: Implementing and Optimizing an Information and Technology Governance Solution At the time of publication of this COBIT® 2019 Framework: Introduction and Methodology title, additional titles are planned for the COBIT ® 2019 product family but not yet released. ® COBIT 2019 FRAMEWORK: INTRODUCTION & METHODOLOGY The content identified as focus areas in figure 4.1 will contain more detailed guidance on specific themes.8 COBIT® 2019 is based on COBIT® 5 and other authoritative sources. COBIT is aligned to a number of related standards and frameworks. The list of these standards is included in Chapter 10. The analysis of related standards and COBIT’s alignment to them underly COBIT’s established position of being the umbrella I&T governance framework. In the future, COBIT will call upon its user community to propose content updates, to be applied as controlled contributions on a continuous basis, to keep COBIT up to date with the latest insights and evolutions. The following sections explain the key concepts and terms used in COBIT® 2019. 4.2 Governance and Management Objectives For information and technology to contribute to enterprise goals, a number of governance and management objectives should be achieved. Basic concepts relating to governance and management objectives are: ⚫ A governance or management objective always relates to one process (with an identical or similar name) and a series of related components of other types to help achieve the objective. ⚫ A governance objective relates to a governance process (depicted in the dark blue background in figure 4.2), while a management objective relates to a management process (depicted on the lighter blue background in figure 4.2). Boards and executive management are typically accountable for governance processes, while management processes are the domain of senior and middle management. The governance and management objectives in COBIT are grouped into five domains. The domains have names with verbs that express the key purpose and areas of activity of the objective contained in them: ⚫ Governance objectives are grouped in the Evaluate, Direct and Monitor (EDM) domain. In this domain, the governing body evaluates strategic options, directs senior management on the chosen strategic options and monitors the achievement of the strategy. ⚫ Management objectives are grouped in four domains: 8 ◼ Align, Plan and Organize (APO) addresses the overall organization, strategy and supporting activities for I&T. ◼ Build, Acquire and Implement (BAI) treats the definition, acquisition and implementation of I&T solutions and their integration in business processes. ◼ Deliver, Service and Support (DSS) addresses the operational delivery and support of I&T services, including security. ◼ Monitor, Evaluate and Assess (MEA) addresses performance monitoring and conformance of I&T with internal performance targets, internal control objectives and external requirements. A number of these focus area content guides are already in preparation; others are planned. The set of focus area guides is open-ended and will continue to evolve. For the latest information on currently available and planned publications and other content, please visit www.isaca.org/cobit. CHAPTER 4 BASIC CONCEPTS: GOVERNANCE SYSTEM AND COMPONENTS Figure 4.2—COBIT Core Model EDM01—Ensured Governance Framework Setting and Maintenance 4.3 EDM02—Ensured Benefits Delivery APO01—Managed I&T Management Framework APO02—Managed Strategy APO08—Managed Relationships APO09—Managed Service Agreements APO03—Managed Enterprise Architecture EDM03—Ensured Risk Optimization EDM04—Ensured Resource Optimization EDM05—Ensured Stakeholder Engagement APO04—Managed Innovation APO05—Managed Portfolio APO06—Managed Budget and Costs APO07—Managed Human Resources APO10—Managed Vendors APO11—Managed Quality APO12—Managed Risk APO13—Managed Security APO14—Managed Data BAI05—Managed Organizational Change BAI01—Managed Programs BAI02—Managed Requirements Definition BAI03—Managed Solutions Id n entificatio and Build BAI04—Managed Availability and Capacity BAI08—Managed Knowledge BAI09—Managed Assets BAI10—Managed Configuration BAI11—Managed Projects DSS01—Managed Operations DSS02—Managed Service Requests and Incidents DSS03—Managed Problems DSS04—Managed Continuity BAI06—Managed IT Changes BAI07—Managed IT Change Acceptance and Transi tioning MEA01— Managed Performance and Conformance Monitoring MEA02— Managed System of Internal Control MEA03— Managed Compliance With External Requirements DSS05—Managed Security Services DSS06—Managed Business Process Controls MEA04— Managed Assurance Components of the Governance System To satisfy governance and management objectives, each enterprise needs to establish, tailor and sustain a governance system built from a number of components. ⚫ Components are factors that, individually and collectively, contribute to the good operations of the enterprise’s governance system over I&T. ⚫ Components interact with each other, resulting in a holistic governance system for I&T. ⚫ Components can be of different types. The most familiar are processes. However, components of a governance system also include organizational structures; policies and procedures; information items; culture and behavior; skills and competencies; and services, infrastructure and applications (figure 4.3). ◼ Processes describe an organized set of practices and activities to achieve certain objectives and produce a set of outputs that support achievement of overall IT-related goals. ◼ Organizational structures are the key decision-making entities in an enterprise. ◼ Principles, policies and frameworks translate desired behavior into practical guidance for day-to-day management. ◼ Information is pervasive throughout any organization and includes all information produced and used by the enterprise. COBIT focuses on information required for the effective functioning of the governance system of the enterprise. ® COBIT 2019 FRAMEWORK: INTRODUCTION & METHODOLOGY ◼ Culture, ethics and behavior of individuals and of the enterprise are often underestimated as factors in the success of governance and management activities. ◼ People, skills and competencies are required for good decisions, execution of corrective action and successful completion of all activities. ◼ Services, infrastructure and applications include the infrastructure, technology and applications that provide the enterprise with the governance system for I&T processing. Figure 4.3—COBIT Components of a Governance System Services, and Structures System and Com Policies, and Behavior Components of all types can be generic or can be variants of generic components: ⚫ Generic components are described in the COBIT core model (see figure 4.2) and apply in principle to any situation. However, they are generic in nature and generally need customization before being practically implemented. ⚫ Variants are based on generic components but are tailored for a specific purpose or context within a focus area (e.g., for information security, DevOps, a particular regulation). 4.4 FocUS Areas A focus area describes a certain governance topic, domain or issue that can be addressed by a collection of governance and management objectives and their components. Examples of focus areas include: small and medium enterprises, cybersecurity, digital transformation, cloud computing, privacy, and DevOps.9 Focus areas may contain a combination of generic governance components and variants. 9 DevOps exemplifies both a component variant and a focus area. Why? DevOps is a current theme in the marketplace and definitel y requires specific guidance, making it a focus area. DevOps includes a number of generic governance and management objectives of the core COBIT model, along with a number of variants of development-, operational- and monitoring-related processes and organizational structures. CHAPTER 4 BASIC CONCEPTS: GOVERNANCE SYSTEM AND COMPONEN The number of focus areas is virtually unlimited. That is what makes COBIT open-ended. New focus areas can be added as required or as subject matter experts and practitioners contribute to the open-ended COBIT model. 4.5 Design Factors Design factors are factors that can influence the design of an enterprise’s governance system and position it for success in the use of I&T. The potential impacts design factors can have on the governance system are noted in section 7.1. More information and detailed guidance on how to use the design factors for designing a governance system can be found in the COBIT® 2019 Design Guide. Design factors include any combination of the following (figure 4.4): Figure 4.4—COBIT Design Factors Enterprise Strategy Compliance Requirements Enterprise Goals Role of IT Risk Profile Sourcing Model for IT I&T-Related Issues IT Implementation Methods Threat Landscape Technology Adoption Strategy Enterprise Size Future Factors 1. Enterprise strategy—Enterprises can have different strategies, which can be expressed as one or more of the archetypes shown in figure 4.5. Organizations typically have a primary strategy and, at most, one secondary strategy. Figure 4.5—Enterprise Strategy Design Factor Strategy Archetype Growth/Acquisition Innovation/Differentiation Cost Leadership Client Service/Stability Explanation The enterprise has a focus on growing (revenues). 10 The enterprise has a focus on offering different and/or innovative products and services to their clients.11 The enterprise has a focus on short-term cost minimization.12 The enterprise has a focus on providing stable and client-oriented service.13 Corresponds with prospector in the Miles-Snow typology. See “Miles and Snow’s Typology of Defender, Prospector, Analyzer, and Reactor,” Elibrary, https://ebrary.net/3737/management/miles_snows_typology_defender_prospector_analyzer_reactor. See Reeves, Martin; Claire Love, Philipp Tillmanns, “Your Strategy Needs a Strategy,” Harvard Business Review, September 2012, https://hbr.org/2012/09/your-strategy-needs-a-strategy, specifically regarding visionary and shaping. 12 Corresponds to cost leadership; see University of Cambridge, “Porter’s Generic Competitive Strategies (ways of competing),” Institute for Manufacturing (IfM) Management Technology Policy, https://www.ifm.eng.cam.ac.uk/research/dstools/porters-generic-competitive-strategies/. Also corresponds to operational excellence; see Treacy, Michael; Fred Wiersema, “Customer Intimacy and Other Value Disciplines,” Harvard Business Review, January/February 1993, https://hbr.org/1993/01/customer-intimacy-and-other-value-disciplines 13 Corresponds with defenders in the Miles-Snow typology. See op cit “Miles and Snow’s Typology of Defender, Prospector, Analyzer, and Reactor.” 10 11 ® COBIT 2019 FRAMEWORK: INTRODUCTION & METHODOLOGY 2. Enterprise goals supporting the enterprise strategy—Enterprise strategy is realized by the achievement of (a set of) enterprise goals. These goals are defined in the COBIT framework, structured along the balanced scorecard (BSC) dimensions, and include the elements shown in figure 4.6. Figure 4.6—Enterprise Goals Design Factor Reference EG01 EG02 EG03 EG04 Balanced Scorecard (BSC) Dimension Financial Financial Financial Financial Enterprise Goal Portfolio of competitive products and services Managed business risk Compliance with external laws and regulations Quality of financial information EG05 EG06 EG07 EG08 EG09 Customer Customer Customer Internal Internal Customer-oriented service culture Business-service continuity and availability Quality of management information Optimization of internal business process functionality Optimization of business process costs EG10 EG11 EG12 EG13 Internal Internal Growth Growth Staff skills, motivation and productivity Compliance with internal policies Managed digital transformation programs Product and business innovation Section 4.6 includes more information on the COBIT goals cascade, which is the detailed elaboration of this design factor. 3. Risk profile of the enterprise and current issues in relation to I&T—The risk profile identifies the sort of I&Trelated risk to which the enterprise is currently exposed and indicates which areas of risk are exceeding the risk appetite. The risk categories14 listed in figure 4.7 merit consideration. Figure 4.7—Risk Profile Design Factor (IT Risk Categories) Reference 1 Risk Category IT investment decision making, portfolio definition and maintenance 2 3 Program and projects lifecycle management IT cost and oversight IT expertise, skills and behavior Enterprise/IT architecture IT operational infrastructure incidents Unauthorized actions 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 14 Software adoption/usage problems Hardware incidents Software failures Logical attacks (hacking, malware, etc.) Third party/supplier incidents Noncompliance Geopolitical issues Industrial action Acts of nature Technology-based innovation Environmental Data and information management Modified from ISACA, The Risk IT Practitioner Guide , USA, 2009 CHAPTER 4 BASIC CONCEPTS: GOVERNANCE SYSTEM AND COMPONEN 4. I&T-related issues—A related method for an I&T risk assessment for the enterprise is to consider which I&Trelated issues it currently faces, or, in other words, what I&T-related risk has materialized. The most common of such issues15 include those in figure 4.8. Figure 4.8—I&T-Related Issues Design Factor Reference A B C D E F G H I J K L M N O P Q R S T Description Frustration between different IT entities across the organization because of a perception of low contribution to business value Frustration between business departments (i.e., the IT customer) and the IT department because of failed initiatives or a perception of low contribution to business value Significant IT-related incidents, such as data loss, security breaches, project failure and application errors, linked to IT Service delivery problems by the IT outsourcer(s) Failures to meet IT-related regulatory or contractual requirements Regular audit findings or other assessment reports about poor IT performance or reported IT quality or service problems Substantial hidden and rogue IT spending, that is, IT spending by user departments outside the control of the normal IT investment decision mechanisms and approved budgets Duplications or overlaps between various initiatives, or other forms of wasted resources Insufficient IT resources, staff with inadequate skills or staff burnout/dissatisfaction IT-enabled changes or projects frequently failing to meet business needs and delivered late or over budget Reluctance by board members, executives or senior management to engage with IT, or a lack of committed business sponsorship for IT Complex IT operating model and/or unclear decision mechanisms for IT-related decisions Excessively high cost of IT Obstructed or failed implementation of new initiatives or innovations caused by the current IT architecture and systems Gap between business and technical knowledge, which leads to business users and information and/or technology specialists speaking different languages Regular issues with data quality and integration of data across various sources High level of end-user computing, creating (among other problems) a lack of oversight and quality control over the applications that are being developed and put in operation Business departments implementing their own information solutions with little or no involvement of the enterprise IT department 16 Ignorance of and/or noncompliance with privacy regulations Inability to exploit new technologies or innovate using I&T 5. Threat landscape—The threat landscape under which the enterprise operates can be classified as shown in figure 4.9. Figure 4.9—Threat Landscape Design Factor Threat Landscape Normal High Explanation The enterprise is operating under what are considered normal threat levels. Due to its geopolitical situation, industry sector or particular profile, the enterprise is operating in a high-threat environment. See also Section 3.3.1 Typical Pain Points, in ISACA, COBIT® 2019 Implementation Guide: Implementing and Optimizing an Information and Technology Governance Solution, USA, 2018. 16 This issue is related to end-user computing, which often stems from dissatisfaction with IT solutions and services. 15 ® COBIT 2019 FRAMEWORK: INTRODUCTION & METHODOLOGY 6. Compliance requirements—The compliance requirements to which the enterprise is subject can be classified according to the categories listed in figure 4.10. Figure 4.10—Compliance Requirements Design Factor Regulatory Environment Low compliance requirements Normal compliance requirements High compliance requirements Explanation The enterprise is subject to a minimal set of regular compliance requirements that are lower than average. The enterprise is subject to a set of regular compliance requirements that are common across different industries. The enterprise is subject to higher-than-average compliance requirements, most often related to industry sector or geopolitical conditions. 7. Role of IT—The role of IT for the enterprise can be classified as indicated in figure 4.11. Figure 4.11—Role of IT Design Factor Role of IT17 11 Support Factory Explanation IT is not crucial for the running and continuity of the business process and services, nor for their innovation. When IT fails, there is an immediate impact on the running and continuity of the business processes and services. However, IT is not seen as a driver for innovating business processes and services. IT is seen as a driver for innovating business processes and services. At this moment, however, there is not a critical dependency on IT for the current running and continuity of the business processes and services. IT is critical for both running and innovating the organization’s business processes and services. Turnaround Strategic 8. Sourcing model for IT—The sourcing model the enterprise adopts can be classified as shown in figure 4.12. Figure 4.12—Sourcing Model for IT Design Factor Sourcing Model Explanation Outsourcing The enterprise calls upon the services of a third party to provide IT services. Cloud The enterprise maximizes the use of the cloud for providing IT services to its users. Insourced Hybrid The enterprise provides for its own IT staff and services. A mixed model is applied, combining the other three models in varying degrees. 17 The roles included in this table are taken from McFarlan, F. Warren; James L. McKenney; Philip Pyburn; “The Information Archipelago—Plotting a Course,” Harvard Business Review, January 1993, https://hbr.org/1983/01/the-information-archipelago-plotting-a-course . CHAPTER 4 BASIC CONCEPTS: GOVERNANCE SYSTEM AND COMPONEN 9. IT implementation methods—The methods the enterprise adopts can be classified as noted in figure 4.13. Figure 4.13—IT Implementation Methods Design Factor IT Implementation Method Agile DevOps Traditional Hybrid Explanation The enterprise uses Agile development working methods for its software development. The enterprise uses DevOps working methods for software building, deployment and operations. The enterprise uses a more classic approach to software development (waterfall) and separates software development from operations. The enterprise uses a mix of traditional and modern IT implementation, often referred to as “bimodal IT.” 10. Technology adoption strategy—The technology adoption strategy can be classified as listed in figure 4.14. Figure 4.14—Technology Adoption Strategy Design Factor Technology Adoption Strategy First mover Follower Slow adopter Explanation The enterprise generally adopts new technologies as early as possible and tries to gain first-mover advantage. The enterprise typically waits for new technologies to become mainstream and proven before adopting them. The enterprise is very late with adoption of new technologies. 11. Enterprise size—Two categories, as shown in figure 4.15, are identified for the design of an enterprise’s governance system.18 Figure 4.15—Enterprise Size Design Factor Enterprise Size Large enterprise (Default) Small and medium enterprise 18 Explanation Enterprise with more than 250 full-time employees (FTEs) Enterprise with 50 to 250 FTEs Micro-enterprises, i.e., enterprises with fewer than 50 staff members, are not considered in this publication. ® COBIT 2019 FRAMEWORK: INTRODUCTION & METHODOLOGY 4.6 Goals Cascade Stakeholder needs have to be transformed into an enterprise’s actionable strategy. The goals cascade (figure 4.16) supports enterprise goals, which is one of the key design factors for a governance system. It supports prioritization of management objectives based on prioritization of enterprise goals. Figure 4.16—COBIT Goals Cascade Stakeholder Drivers and Needs Cascade to Enterprise Goals Cascade to Alignment Goals Cascade to Governance and Management Objectives The goals cascade further supports translation of enterprise goals into priorities for alignment goals. The goals cascade has been updated thoroughly in COBIT® 2019: ⚫ Enterprise goals have been consolidated, reduced, updated and clarified. ⚫ Alignment goals emphasize the alignment of all IT efforts with business objectives. 19 This updated term also seeks to avoid the frequent misunderstanding that these goals indicate purely internal objectives of the IT department within an enterprise. Like enterprise goals, alignment goals have been consolidated, reduced, updated and clarified where necessary. 19 Alignment goals were called IT-related goals in COBIT 5. CHAPTER 4 BASIC CONCEPTS: GOVERNANCE SYSTEM AND COMPONEN 4.6.1 Enterprise Goals Stakeholder needs cascade to enterprise goals. Figure 4.17 shows the set of 13 enterprise goals along with a number of accompanying example metrics. Figure 4.17—Goals Cascade: Enterprise Goals and Metrics Reference BSC Dimension Enterprise Goal Example Metrics EG01 Financial Portfolio of competitive products and services ⚫ Percent of products and services that meet or exceed targets in revenues and/or market share ⚫ Percent of products and services that meet or exceed customer satisfaction targets ⚫ Percent of products and services that provide competitive advantage ⚫ Time-to-market for new products and services EG02 Financial Managed business risk ⚫ Percent of critical business objectives and services covered by risk assessment ⚫ Ratio of significant incidents that were not identified in risk assessments vs. total incidents ⚫ Appropriate frequency of update of risk profile EG03 Financial Compliance with external laws and regulations ⚫ Cost of regulatory noncompliance, including settlements and fines ⚫ Number of regulatory noncompliance issues causing public comment or negative publicity ⚫ Number of noncompliance matters noted by regulators or supervisory authorities ⚫ Number of regulatory noncompliance issues relating to contractual agreements with business partners EG04 Financial Quality of financial information EG05 Customer Customer-oriented service culture EG06 Customer Business service continuity and availability EG07 Customer Quality of management information ⚫ Satisfaction survey of key stakeholders regarding the transparency, understanding and accuracy of enterprise financial information ⚫ Cost of regulatory noncompliance with finance-related regulations ⚫ Number of customer service disruptions ⚫ Percent of business stakeholders satisfied that customer service delivery meets agreed levels ⚫ Number of customer complaints ⚫ Trend of customer satisfaction survey results ⚫ Number of customer service or business process interruptions causing significant incidents ⚫ Business cost of incidents ⚫ Number of business processing hours lost due to unplanned service interruptions ⚫ Percent of complaints as a function of committed serviceavailability targets ⚫ Degree of board and executive management satisfaction with decision-making information ⚫ Number of incidents caused by incorrect business decisions based on inaccurate information ⚫ Time to provide supporting information to enable effective business decisions ⚫ Timeliness of management information ® COBIT 2019 FRAMEWORK: INTRODUCTION & METHODOLOGY Figure 4.17—Goals Cascade: Enterprise Goals and Metrics (cont.) Reference EG08 BSC Dimension Internal Enterprise Goal Optimization of internal business process functionality EG09 Internal Optimization of business process costs EG10 Internal Staff skills, motivation and productivity EG11 Internal Compliance with internal policies EG12 Growth Managed digital transformation programs EG13 Growth Product and business innovation 4.6.2 Example Metrics ⚫ Satisfaction levels of board and executive management with business process capabilities ⚫ Satisfaction levels of customers with service delivery capabilities ⚫ Satisfaction levels of suppliers with supply chain capabilities ⚫ Ratio of cost vs. achieved service levels ⚫ Satisfaction levels of board and executive management with business processing costs ⚫ Staff productivity compared to benchmarks ⚫ Level of stakeholder satisfaction with staff expertise and skills ⚫ Percent of staff whose skills are insufficient relative to competencies required for their roles ⚫ Percent of satisfied staff ⚫ Number of incidents related to noncompliance with policy ⚫ Percent of stakeholders who understand policies ⚫ Percent of policies supported by effective standards and working practices ⚫ Number of programs on time and within budget ⚫ Percent of stakeholders satisfied with program delivery ⚫ Percent of business transformation programs stopped ⚫ Percent of business transformation programs with regular reported status updates ⚫ Level of awareness and understanding of business innovation opportunities ⚫ Stakeholder satisfaction with levels of product and innovation expertise and ideas ⚫ Number of approved product and service initiatives resulting from innovative ideas Alignment Goals Enterprise goals cascade to alignment goals. Figure 4.18 contains the set of alignment goals and example metrics. Figure 4.18—Goals Cascade: Alignment Goals and Metrics Reference IT BSC Dimension Alignment Goal Metrics AG01 Financial I&T compliance and support for business compliance with external laws and regulations ⚫ Cost of IT noncompliance, including settlements and fines, and the impact of reputational loss ⚫ Number of IT-related noncompliance issues reported to the board or causing public comment or embarrassment ⚫ Number of noncompliance issues relating to contractual agreements with IT service providers AG02 Financial Managed I&T-related risk ⚫ Appropriate frequency of update of risk profile ⚫ Percent of enterprise risk assessments including I&Trelated risk ⚫ Number of significant I&T-related incidents that were not identified in a risk assessment CHAPTER 4 BASIC CONCEPTS: GOVERNANCE SYSTEM AND COMPONEN Figure 4.18—Goals Cascade: Alignment Goals and Metrics (cont.) Reference IT BSC Dimension Alignment Goal AG03 Financial AG04 Financial AG05 Customer AG06 Customer Agility to turn business requirements into operational solutions AG07 Internal Security of information, processing infrastructure and applications, and privacy AG08 Internal Enabling and supporting business processes by integrating applications and technology AG09 Internal Delivery of programs on time, on budget and meeting requirements and quality standards AG10 Internal Quality of I&T management information Metrics ⚫ Percent of I&T-enabled investments for which claimed benefits in the business case are met or exceeded ⚫ Percent of I&T services for which expected benefits (as stated in the service level agreements) are realized Quality of technology-related ⚫ Satisfaction of key stakeholders regarding the level of financial information transparency, understanding and accuracy of IT financial information ⚫ Percent of I&T services with defined and approved operational costs and expected benefits Delivery of I&T services in line ⚫ Percent of business stakeholders satisfied that IT service with business requirements delivery meets agreed service levels ⚫ Number of business disruptions due to IT service incidents ⚫ Percent of users satisfied with the quality of IT service delivery Realized benefits from I&Tenabled investments and services portfolio ⚫ Level of satisfaction of business executives with IT’s responsiveness to new requirements ⚫ Average time-to-market for new I&T-related services and applications ⚫ Average time to turn strategic I&T objectives into an agreed and approved initiative ⚫ Number of critical business processes supported by up-todate infrastructure and applications ⚫ Number of confidentiality incidents causing financial loss, business disruption or public embarrassment ⚫ Number of availability incidents causing financial loss, business disruption or public embarrassment ⚫ Number of integrity incidents causing financial loss, business disruption or public embarrassment ⚫ Time to execute business services or processes ⚫ Number of I&T-enabled business programs delayed or incurring additional cost due to technology integration issues ⚫ Number of business process changes that need to be delayed or reworked because of technology integration issues ⚫ Number of applications or critical infrastructures operating in silos and not integrated ⚫ Number of programs/projects on time and within budget ⚫ Number of programs needing significant rework due to quality defects ⚫ Percent of stakeholders satisfied with program/project quality ⚫ Level of user satisfaction with quality and timeliness and availability of I&T-related management information, taking into account available resources ⚫ Ratio and extent of erroneous business decisions in which erroneous or unavailable I&T-related information was a key factor ⚫ Percentage of information meeting quality criteria ® COBIT 2019 FRAMEWORK: INTRODUCTION & METHODOLOGY Figure 4.18—Goals Cascade: Alignment Goals and Metrics (cont.) Reference AG11 IT BSC Dimension Internal Alignment Goal Metrics I&T compliance with internal policies ⚫ Number of incidents related to noncompliance with ITrelated policies ⚫ Number of exceptions to internal policies ⚫ Frequency of policy review and update AG12 Learning and Growth Competent and motivated staff with mutual understanding of technology and business ⚫ Percent of I&T-savvy business people (i.e., those having the required knowledge and understanding of I&Tto guide, direct, innovate and see opportunities of I&T for their domain of expertise) ⚫ Percent of business-savvy IT people (i.e., those having the required knowledge and understanding of relevant business domains to guide, direct, innovate and see opportunities of I&T for the business domain) ⚫ Number or percentage of business people with technology management experience AG13 Learning and Growth Knowledge, expertise and initiatives for business innovation ⚫ Level of business executive awareness and understanding of I&T innovation possibilities ⚫ Number of approved initiatives resulting from innovative I&T ideas ⚫ Number of innovation champions recognized/awarded