Find Resources and Connect with members on topics that interest you.

AI - Acquire and Implement

PO - Plan and Organize

DS - Deliver and Support

Please sign in to see your topics.

Subscribe to this discussion

COBIT Focus - A Partial Transition to COBIT 5 Demonstrates Value to IT

Several years ago, the IT department of the largest bakery factory in the world, with a presence in the United States, Mexico, Central America, South America, Asia, Europe, Canada and the United Kingdom, conducted a COBIT® 4 assessment and implementation of a enterprise governance. Recently, it was determined that the assessment and governance process needed to be updated to determine the next steps required to align it with the new business vision.

Read the full article here.

The author, Victor Antonio Jimenez, will be responding to questions pertaining to his article today. Ask your question in the comments section of this post.   
You must sign in to rate content.
(5 ratings)

Comments

RE: COBIT Focus - A Partial Transition to COBIT 5 Demonstrates Value to IT

Thanks Victor for an interesting article but I am a little confused as to the assessment you did. As one of the developers and authors of the COBIT 5 Process Assessment programme I would like to raise the following comments:

  • The COBIT 5 approach is based on a ISO (Now 33000) SPICE approach which  is a Process Capability assessment and not a maturity assessment.
  • A Maturity assessment would be a CMMI SCAMP approach
  • Using COBIT 5 you cannot assess continuously; only level by level, you must assess at level 1 (Is the process performing) using specific base practices and work products as evidence and get a rating of F - Fully before you can get to assess level 2 which deals with generics although in reality many use the detailed COBIT 5 PRM also for these levels.
  • Self Assessment- The self assessment tool was developed to allow users and management a quick look using process outcomes only and not detailed evidentiary requirements. It does NOT conform to ISO and should not be used as or in a detailed assessment process, it can be very misleading to do so as it is not supported by evidence.
Just some of my confusion as to what and how you used the tools.
Gary396Lively at 11/14/2016 2:18:20 AM Quote
You must sign in to rate content.
(Unrated)

RE: COBIT Focus - A Partial Transition to COBIT 5 Demonstrates Value to IT

Unfortunately there is a lot of confusion about the COBIT 4 maturity model and the COBIT 5 capability model. Firstly it should be recognized that these are two completely different models. They have no similarities. The COBIT 4 maturity model is an assessment of controls and not of processes. (There is a revised COBIT 4 capability assessment model, but from the illustration this was not the method used). The COBIT capability assessment is of processes, and more specifically processes achieving predefined outcomes.

The COBIT 5 PAM only specifies capability level 1. There is no guidance (except for generic statements) about the requirements for levels 2 and above. Before an assessment of capability level 2 and above can be conducted, the requirements for these higher levels of capability have to be identified for each process.

Before an assessment of capability can be performed, the processes have to be defined. Not just defined, but  the process activities have to be aligned with the specific outcomes. The outcomes may go beyond the COBIT 5 identified outcomes and include outcomes required by the company. Further, different instances of the process execution should be identified.

Before assessing capability at level 2, the processes must be delivering the outcomes expected at level 1. This is not an easy task. Consequently, very few organisations anywhere in the world will be functioning at capability 2 or above! 
peterhillEnergizer at 11/14/2016 2:53:12 AM Quote
You must sign in to rate content.
(Unrated)

RE: COBIT Focus - A Partial Transition to COBIT 5 Demonstrates Value to IT

Thanks for your comments, just to clarify this approach, the self-assessment was used to perform an assessment of the capability of the IT processes, as you mentioned the approach is based on the COBIT PAM but does not use it as a whole. It was not a rigorous assessment as the main goal was to provide information to the company that a full assessment is needed to move forward from COBIT 4 to COBIT 5. We started at level 1 for each process asking if it is achieved and for higher levels we looked at generic goals, not specific process outcomes. Once this capability level was established, the results were presented in Figure 2 where I think the confusion arouse, although in figure 3 I am referring to capability attributes, in figure 2 was referred as maturity level and I would be more accurate to set the headings to Process capability instead of maturity level.
Victor Antonio612Observer at 11/17/2016 11:43:51 AM Quote
You must sign in to rate content.
(Unrated)

RE: COBIT Focus - A Partial Transition to COBIT 5 Demonstrates Value to IT

Thanks for your comments, just to clarify this approach, the self-assessment was used to perform an assessment of the capability of the IT processes, as you mentioned the approach is based on the COBIT PAM but does not use it as a whole. It was not a rigorous assessment as the main goal was to provide information to the company that a full assessment is needed to move forward from COBIT 4 to COBIT 5. We started at level 1 for each process asking if it is achieved and for higher levels we looked at generic goals, not specific process outcomes. Once this capability level was established, the results were presented in Figure 2 where I think the confusion arouse, although in figure 3 I am referring to capability attributes, in figure 2 was referred as maturity level and I would be more accurate to set the headings to Process capability instead of maturity level.
Victor Antonio612Observer at 11/17/2016 11:43:51 AM Quote
You must sign in to rate content.
(Unrated)

RE: COBIT Focus - A Partial Transition to COBIT 5 Demonstrates Value to IT

Unfortunately there is a lot of confusion about the COBIT 4 maturity model and the COBIT 5 capability model. Firstly it should be recognized that these are two completely different models. They have no similarities. The COBIT 4 maturity model is an assessment of controls and not of processes. (There is a revised COBIT 4 capability assessment model, but from the illustration this was not the method used). The COBIT capability assessment is of processes, and more specifically processes achieving predefined outcomes.

The COBIT 5 PAM only specifies capability level 1. There is no guidance (except for generic statements) about the requirements for levels 2 and above. Before an assessment of capability level 2 and above can be conducted, the requirements for these higher levels of capability have to be identified for each process.

Before an assessment of capability can be performed, the processes have to be defined. Not just defined, but  the process activities have to be aligned with the specific outcomes. The outcomes may go beyond the COBIT 5 identified outcomes and include outcomes required by the company. Further, different instances of the process execution should be identified.

Before assessing capability at level 2, the processes must be delivering the outcomes expected at level 1. This is not an easy task. Consequently, very few organisations anywhere in the world will be functioning at capability 2 or above! 
peterhillEnergizer at 11/14/2016 2:53:12 AM Quote
You must sign in to rate content.
(Unrated)

RE: COBIT Focus - A Partial Transition to COBIT 5 Demonstrates Value to IT

Thanks Victor for an interesting article but I am a little confused as to the assessment you did. As one of the developers and authors of the COBIT 5 Process Assessment programme I would like to raise the following comments:

  • The COBIT 5 approach is based on a ISO (Now 33000) SPICE approach which  is a Process Capability assessment and not a maturity assessment.
  • A Maturity assessment would be a CMMI SCAMP approach
  • Using COBIT 5 you cannot assess continuously; only level by level, you must assess at level 1 (Is the process performing) using specific base practices and work products as evidence and get a rating of F - Fully before you can get to assess level 2 which deals with generics although in reality many use the detailed COBIT 5 PRM also for these levels.
  • Self Assessment- The self assessment tool was developed to allow users and management a quick look using process outcomes only and not detailed evidentiary requirements. It does NOT conform to ISO and should not be used as or in a detailed assessment process, it can be very misleading to do so as it is not supported by evidence.
Just some of my confusion as to what and how you used the tools.
Gary396Lively at 11/14/2016 2:18:20 AM Quote
You must sign in to rate content.
(Unrated)

RE: COBIT Focus - A Partial Transition to COBIT 5 Demonstrates Value to IT

Thanks Victor for an interesting article but I am a little confused as to the assessment you did. As one of the developers and authors of the COBIT 5 Process Assessment programme I would like to raise the following comments:

  • The COBIT 5 approach is based on a ISO (Now 33000) SPICE approach which  is a Process Capability assessment and not a maturity assessment.
  • A Maturity assessment would be a CMMI SCAMP approach
  • Using COBIT 5 you cannot assess continuously; only level by level, you must assess at level 1 (Is the process performing) using specific base practices and work products as evidence and get a rating of F - Fully before you can get to assess level 2 which deals with generics although in reality many use the detailed COBIT 5 PRM also for these levels.
  • Self Assessment- The self assessment tool was developed to allow users and management a quick look using process outcomes only and not detailed evidentiary requirements. It does NOT conform to ISO and should not be used as or in a detailed assessment process, it can be very misleading to do so as it is not supported by evidence.
Just some of my confusion as to what and how you used the tools.
Gary396Lively at 11/14/2016 2:18:20 AM Quote
You must sign in to rate content.
(Unrated)

RE: COBIT Focus - A Partial Transition to COBIT 5 Demonstrates Value to IT

Unfortunately there is a lot of confusion about the COBIT 4 maturity model and the COBIT 5 capability model. Firstly it should be recognized that these are two completely different models. They have no similarities. The COBIT 4 maturity model is an assessment of controls and not of processes. (There is a revised COBIT 4 capability assessment model, but from the illustration this was not the method used). The COBIT capability assessment is of processes, and more specifically processes achieving predefined outcomes.

The COBIT 5 PAM only specifies capability level 1. There is no guidance (except for generic statements) about the requirements for levels 2 and above. Before an assessment of capability level 2 and above can be conducted, the requirements for these higher levels of capability have to be identified for each process.

Before an assessment of capability can be performed, the processes have to be defined. Not just defined, but  the process activities have to be aligned with the specific outcomes. The outcomes may go beyond the COBIT 5 identified outcomes and include outcomes required by the company. Further, different instances of the process execution should be identified.

Before assessing capability at level 2, the processes must be delivering the outcomes expected at level 1. This is not an easy task. Consequently, very few organisations anywhere in the world will be functioning at capability 2 or above! 
peterhillEnergizer at 11/14/2016 2:53:12 AM Quote
You must sign in to rate content.
(Unrated)

RE: COBIT Focus - A Partial Transition to COBIT 5 Demonstrates Value to IT

Thanks for your comments, just to clarify this approach, the self-assessment was used to perform an assessment of the capability of the IT processes, as you mentioned the approach is based on the COBIT PAM but does not use it as a whole. It was not a rigorous assessment as the main goal was to provide information to the company that a full assessment is needed to move forward from COBIT 4 to COBIT 5. We started at level 1 for each process asking if it is achieved and for higher levels we looked at generic goals, not specific process outcomes. Once this capability level was established, the results were presented in Figure 2 where I think the confusion arouse, although in figure 3 I am referring to capability attributes, in figure 2 was referred as maturity level and I would be more accurate to set the headings to Process capability instead of maturity level.
Victor Antonio612Observer at 11/17/2016 11:43:51 AM Quote
You must sign in to rate content.
(Unrated)

Leave a Comment

* required

You must login to leave a comment.