Framework Introduction and Methodology Part 2

CHAPTER 5 COBIT GOVERNANCE AND MANAGEMENT OBJECTIV Chapter 5 COBIT Governance and Management Objectives 5.1 P Ur p ose In section 4.2, figure 4.2, the COBIT core model was presented, including the 40 governance and management objectives. Figure 5.1 lists all the governance and management objectives, each with its purpose statement. The purpose statement is a further elaboration—a next level of detail—of each governance and management objective. Figure 5.1—COBIT Core Model: Governance and Management Objectives and Purpose Reference EDM01 Name Ensured governance framework setting and maintenance Purpose Provide a consistent approach, integrated and aligned with the enterprise governance approach. I&T-related decisions must be made in line with the enterprise’s strategies and objectives and desired value is realized. To that end, ensure that I&T-related processes are overseen effectively and transparently; compliance with legal, contractual and regulatory requirements is confirmed; and the governance requirements for board members are met. Secure optimal value from I&T-enabled initiatives, services and assets; cost-effective delivery of solutions and services; and a reliable and accurate picture of costs and likely benefits so that business needs are supported effectively and efficiently. Ensure that I&T-related enterprise risk does not exceed the enterprise’s risk appetite and risk tolerance, the impact of I&T risk to enterprise value is identified and managed, and the potential for compliance failures is minimized. Ensure that the resource needs of the enterprise are met in the optimal manner, I&T costs are optimized, and there is an increased likelihood of benefit realization and readiness for future change. Ensure that stakeholders are supportive of the I&T strategy and road map, communication to stakeholders is effective and timely, and the basis for reporting is established to increase performance. Identify areas for improvement, and confirm that I&T-related objectives and strategies are in line with the enterprise’s strategy. EDM02 Ensured benefits delivery EDM03 Ensured risk optimization EDM04 Ensured resource optimization EDM05 Ensured stakeholder engagement APO01 Managed I&T management framework Implement a consistent management approach for enterprise governance requirements to be met, covering governance components such as management processes; organizational structures; roles and responsibilities; reliable and repeatable activities; information items; policies and procedures; skills and competencies; culture and behavior; and services, infrastructure and applications. APO02 Managed strategy APO03 Managed enterprise architecture Support the digital transformation strategy of the organization and deliver the desired value through a road map of incremental changes. Use a holistic I&T approach, ensuring that each initiative is clearly connected to an overarching strategy. Enable change in all different aspects of the organization, from channels and processes to data, culture, skills, operating model and incentives. Represent the different building blocks that make up the enterprise and its interrelationships, as well as the principles guiding their design and evolution over time, to enable a standard, responsive and efficient delivery of operational and strategic objectives. APO04 Managed innovation Achieve competitive advantage, business innovation, improved customer experience, and improved operational effectiveness and efficiency by exploiting I&T developments and emerging technologies. ® COBIT 2019 FRAMEWORK: INTRODUCTION & METHODOLOGY Figure 5.1—COBIT Core Model: Governance and Management Objectives and Purpose (cont.) Reference APO05 Name Managed portfolio Purpose Optimize the performance of the overall portfolio of programs in response to individual program, product and service performance and changing enterprise priorities and demand. Foster a partnership between IT and enterprise stakeholders to enable the effective and efficient use of I&T-related resources and provide transparency and accountability of the cost and business value of solutions and services. Enable the enterprise to make informed decisions regarding the use of I&T solutions and services. Optimize human-resources capabilities to meet enterprise objectives. Enable the right knowledge, skills and behaviors to create improved outcomes, increased confidence, mutual trust and effective use of resources that stimulate a productive relationship with business stakeholders. APO06 Managed budget and costs APO07 Managed human resources APO08 Managed relationships APO09 Managed service agreements Ensure that I&T products, services and service levels meet current and future enterprise needs. APO10 Managed vendors APO11 Managed quality APO12 Managed risk APO13 Managed security APO14 Managed data BAI01 Managed programs BAI02 Managed requirements definition BAI03 Managed solutions identification and build Optimize available I&T capabilities to support the I&T strategy and road map, minimize the risk associated with nonperforming or noncompliant vendors, and ensure competitive pricing. Ensure consistent delivery of technology solutions and services to meet the quality requirements of the enterprise and satisfy stakeholder needs. Integrate the management of I&T-related enterprise risk with overall enterprise risk management (ERM) and balance the costs and benefits of managing I&T-related enterprise risk. Keep the impact and occurrence of information security incidents within the enterprise’s risk appetite levels. Ensure effective utilization of the critical data assets to achieve enterprise goals and objectives. Realize desired business value and reduce the risk of unexpected delays, costs and value erosion. To do so, improve communications to and involvement of business and end users, ensure the value and quality of program deliverables and follow-up of projects within the programs, and maximize program contribution to the investment portfolio. Create optimal solutions that meet enterprise needs while minimizing risk. Ensure agile and scalable delivery of digital products and services. Establish timely and cost-effective solutions (technology, business processes and workflows) capable of supporting enterprise strategic and operational objectives. BAI04 Managed availability and capacity BAI05 Managed organizational change BAI06 Managed IT changes BAI07 Managed IT change acceptance and transitioning Maintain service availability, efficient management of resources and optimization of system performance through prediction of future performance and capacity requirements. Prepare and commit stakeholders for business change and reduce the risk of failure. Enable fast and reliable delivery of change to the business. Mitigate the risk of negatively impacting the stability or integrity of the changed environment. Implement solutions safely and in line with the agreed expectations and outcomes. CHAPTER 5 COBIT GOVERNANCE AND MANAGEMENT OBJECTIV Figure 5.1—COBIT Core Model: Governance and Management Objectives and Purpose (cont.) Reference BAI08 Name Managed knowledge BAI09 Managed assets BAI10 Managed configuration BAI11 Managed projects DSS01 DSS02 Managed operations DSS03 Managed problems DSS04 Managed continuity DSS05 Managed security services DSS06 Managed business process controls MEA01 Managed performance and conformance monitoring Managed system of internal control MEA02 Managed service requests and incidents Purpose Provide the knowledge and management information required to support all staff in the governance and management of enterprise I&T and allow for informed decision making. Account for all I&T assets and optimize the value provided by their use. Provide sufficient information about service assets to enable the service to be effectively managed. Assess the impact of changes and deal with service incidents. Realize defined project outcomes and reduce the risk of unexpected delays, costs and value erosion by improving communications to and involvement of business and end users. Ensure the value and quality of project deliverables and maximize their contribution to the defined programs and investment portfolio. Deliver I&T operational product and service outcomes as planned. Achieve increased productivity and minimize disruptions through quick resolution of user queries and incidents. Assess the impact of changes and deal with service incidents. Resolve user requests and restore service in response to incidents. Increase availability, improve service levels, reduce costs, improve customer convenience and satisfaction by reducing the number of operational problems, and identify root causes as part of problem resolution. Adapt rapidly, continue business operations, and maintain availability of resources and information at a level acceptable to the enterprise in the event of a significant disruption (e.g., threats, opportunities, demands). Minimize the business impact of operational information security vulnerabilities and incidents. Maintain information integrity and the security of information assets handled within business processes in the enterprise or its outsourced operation. Provide transparency of performance and conformance and drive achievement of goals. Obtain transparency for key stakeholders on the adequacy of the system of internal controls and thus provide trust in operations, confidence in the achievement of enterprise objectives and an adequate understanding of residual risk. MEA03 Managed compliance with external requirements Ensure that the enterprise is compliant with all applicable external requirements. MEA04 Managed assurance Enable the organization to design and develop efficient and effective assurance initiatives, providing guidance on planning, scoping, executing and following up on assurance reviews, using a road map based on well-accepted assurance approaches. CHAPTER 6 PERFORMANCE MANAGEMENT IN COBIT Chapter 6 Performance Management in COBIT 6.1 Definition Performance management is an essential part of a governance and management system. “Performance management” represents a general term for all activities and methods. It expresses how well the governance and management system and all the components of an enterprise work, and how they can be improved to achieve the required level. It includes concepts and methods such as capability levels and maturity levels. COBIT uses the term COBIT performance management (CPM) to describe these activities, and the concept is an integral part of the COBIT framework. 6.2 COBIT Performance Management Principles COBIT® 2019 is based on the following principles: 1. The CPM should be simple to understand and use. 2. The CPM should be consistent with, and support, the COBIT conceptual model. It should enable management of the performance of all types of components of the governance system; it must be possible to manage the performance of processes as well as the performance of other types of components (e.g., organizational structures or information), if users wish to do so. 3. The CPM should provide reliable, repeatable and relevant results. 4. The CPM must be flexible, so it can support the requirements of different organizations with different priorities and needs. 5. The CPM should support different types of assessment, from self-assessments to formal appraisals or audits. 6.3 COBIT Performance Management Overview The CPM model (figure 6.1) largely aligns to and extends CMMI® Development V2.020 concepts: ⚫ Process activities are associated to capability levels. This is included in the COBIT® 2019 Framework: Governance and Management Objectives guide. ⚫ Other governance and management component types (e.g., organizational structures, information) may also have capability levels defined for them in future guidance. ⚫ Maturity levels are associated with focus areas (i.e., a collection of governance and management objectives and underlying components) and will be achieved if all required capability levels are achieved. 20 CMMI® Development V2.0, CMMI Institute, USA, 2018, https://cmmiinstitute.com/model-viewer/dashboard ® COBIT 2019 FRAMEWORK: INTRODUCTION & METHODOLOGY Figure 6.1—Capability Levels COBIT 5 PAM ( ISO / IEC 15504 ➔ ISO /IE C 33000 ) Processes Capability Other types of governance and management components CMMI 2.0 COBIT Update Maturity Maturity Capability Capability Capability If enterprises desire to continue using the COBIT 5 process capability model based on International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) 15504 (now ISO/IEC 33000, in which capability levels have very different meanings), they have all required information to do so in COBIT® 2019 Framework: Governance and Management Objectives. No separate process assessment model (PAM) publications are necessary, nor will they be provided with COBIT® 2019. In COBIT® 2019, the explicit process outcomes or process goals are replaced by the process practices themselves. This results in the following situation for an ISO/IEC33000 evaluation: 1. Process outcomes are now linked to the process practices on a one-to-one basis (i.e., the process outcomes are the successful completion of the process practices). Note: the process practices are formulated as practices, and the outcomes can be derived from there. Example: APO01.01 Design the management system for enterprise I&T has as process outcome APO01.01: A management system for enterprise I&T is designed. 2. Base practices are equal to the COBIT® 2019 process practices for each governance and management objective. 3. Work products are equal to the Information Flows and Items under component C in each governance/management objective. Thus, the mapping of outcomes to base practices and work products is all done by definition in COBIT® 2019. 6.4 6.4.1 Managing Performance of Processes Process Capability Levels COBIT® 2019 supports a CMMI-based process capability scheme. The process within each governance and management objective can operate at various capability levels, ranging from 0 to 5. The capability level is a measure of how well a process is implemented and performing. Figure 6.2 depicts the model, the increasing capability levels and the general characteristics of each. CHAPTER 6 PERFORMANCE MANAGEMENT IN COBIT Figure 6.2—Capability Levels for Processes improvement is pursued. performance is (quantitatively) measured. organizational assets. Processes typically are well defined. activities that can be characterized as performed. can be characterized as initial or intuitive—not very organized. The COBIT core model assigns capability levels to all process activities, enabling clear definition of the processes and required activities for achieving the different capability levels. See COBIT® 2019 Framework: Governance and Management Objectives for more detail. 6.4.2 Rating Process Activities A capability level can be achieved to varying degrees, which can be expressed by a set of ratings. The range of available ratings depends on the context in which the performance assessment is made: ⚫ Some formal methods leading to independent certification use a binary pass/fail set of ratings. ⚫ Less formal methods (often used in performance-improvement contexts) work better with a larger range of ratings, such as the following set: ◼ Fully—The capability level is achieved for more than 85 percent. (This remains a judgment call, but it can be substantiated by the examination or assessment of the components of the enabler, such as process activities, process goals or organizational structure good practices.) ◼ Largely—The capability level is achieved between 50 percent and 85 percent. ◼ Partially—The capability level is achieved between 15 percent and 50 percent. ◼ Not—The capability level is achieved less than 15 percent. 6.4.3 FocUS Area MatUrity Levels Sometimes a higher level is required for expressing performance without the granularity applicable to individual process capability ratings. Maturity levels can be used for that purpose. COBIT® 2019 defines maturity levels as a performance measure at the focus area level, as shown in figure 6.3. ® COBIT 2019 FRAMEWORK: INTRODUCTION & METHODOLOGY Figure 6.3—Maturity Levels for Focus Areas Maturity levels are associated with focus areas (i.e., a collection of governance and management objectives and underlying components) and a certain maturity level is achieved if all the processes contained in the focus area achieve that particular capability level. 6.5 Managing Performance of Other Governance System Components 6.5.1 Performance Management of Organizational StrUCtUres Although no generally accepted or formal method exists for assessing organizational structures, they can be less formally assessed according to the following criteria. For each criterion, a number of subcriteria can be defined, linked to the various capability levels. The criteria are: ⚫ Successful execution of those process practices for which the organizational structure (or role) has accountability or responsibility (an A or an R, respectively, in a responsible-accountable-consulted-informed [RACI] chart) ⚫ Successful application of a number of good practices for organizational structures, such as: ◼ ◼ Operating principles - The organizational structure is formally established. - The organizational structure has a clear, documented and well-understood mandate. - Operating principles are documented. - Regular meetings take place as defined in the operating principles. - Meeting reports/minutes are available and meaningful. Composition - The organizational structure is formally established. CHAPTER 6 PERFORMANCE MANAGEMENT IN COBIT ◼ ◼ Span of control - The organizational structure has a clear, documented and well-understood mandate. - Operating principles are documented. - Regular meetings take place as defined in the operating principles. - Meeting reports/minutes are available and are meaningful. Level of authority and decision rights - Decision rights of the organizational structure are defined and documented. - Decision rights of the organizational structure are respected and complied with (also a culture/behavior issue). ◼ Delegation of authority ◼ Escalation procedures - - Delegation of authority is implemented in a meaningful way. Escalation procedures are defined and applied. ⚫ Successful application of a number of organizational structure management practices (nonfunctional practices arising from an organizational structure point of view): ◼ Objectives for the performance of the organizational structures are identified. ◼ Performance of the organizational structure is planned and monitored. ◼ Performance of the organizational structure is adjusted to meet plans. ◼ Resources and information necessary for the organizational structure are identified, made available, allocated and used. ◼ Interfaces between the organizational structure and other stakeholders are managed to ensure both effective communication and clear assignment of responsibility. ◼ Regular evaluations result in the required continuous improvement of the organizational structure—in its composition, mandate or any other parameter. As for the processes, low capability levels require a subset of these criteria to be satisfied, and higher capability levels require all criteria to be satisfied. But, as already indicated, no generally accepted scheme exists for assessing organizational structures. However, this does not prevent an enterprise from defining its own capability scheme for organizational structures. 6.5.2 Performance Management of Information Items The information item component for a governance system of I&T is more or less equivalent to the process work products as described in COBIT® 2019 Framework: Governance and Management Objectives. Although no generally accepted or formal method exists for assessing information items, they can be less formally assessed according to the information reference model first presented in COBIT® 5: Enabling Information.21 This model defines three main quality criteria for information and 15 subcriteria, as illustrated in figure 6.4. 21 See ISACA, COBIT® 5: Enabling Information , section 3.1.2 Goals, USA, 2013 , http://www.isaca.org/COBIT/Pages/COBIT-5-Enabling-Informationproduct-page.aspx ® COBIT 2019 FRAMEWORK: INTRODUCTION & METHODOLOGY Figure 6.4—Information Reference Model: Quality Criteria for Information The extent to which information is correct and reliable The extent to which information is unbiased, unprejudiced and impartial The extent to which data values are in actual or true values The extent to which information is regarded as true and credible The extent to which information is highly regarded in terms of its source or content The extent to which information is applicable and helpful for the task at hand The extent to which information is not missing and is of sufficient depth and breadth for the task at hand The extent to which information is sufficiently up to date for the task at hand The extent to which the volume of information is appropriate for the task at hand The extent to which information is compactly represented The extent to which information is applicable to the task of the information user and is presented in an intelligible and clear manner, recognizing that information quality depends on the context of use The extent to which information is presented in the same format The extent to which information is in appropriatelanguages, symbolsand units, and the definitions are clear The extent to which information is easily comprehended The extent to which information is easy to manipulate and apply to different tasks The extent to which information is available when required, or easily and quickly retrievable The extent to which information is available or obtainable The extent to which access to information is restricted appropriately to authorized parties An information item can be assessed by considering the extent to which the relevant quality criteria, as defined in figure 6.4, are achieved. CHAPTER 6 PERFORMANCE MANAGEMENT IN COBIT 6.5.3 Performance Management of C U lt Ure and Behavior For the culture and behavior governance component, it should be possible to define a set of desirable (and/or undesirable) behaviors for good governance and management of IT, and to assign different levels of capability to each. COBIT® 2019 Framework: Governance and Management Objectives defines aspects of the culture and behavior component for most objectives. From there, it is possible to assess the extent to which these conditions or behaviors are met. Focus area content, which will contain a more detailed set of desired behaviors, will be developed going forward. The user is advised to consult isaca.org/cobit for the latest status and available focus area guidance.