Even best-in-class frameworks need to be half as inspiring as a good novel—and twice as inspiring for practitioners to read and use them! As a COBIT trainer, I use the following tips on how to capitalize on COBIT for IT governance-related projects and workshops.
Promoting the use of COBIT 5 terminology and explanations in the local language is a key success factor for COBIT acceptance among IT and business professionals. The existence of an official ISACA translation is critical for common interpretation and understanding in a local language.
It is a good idea to start each COBIT-related project with a preliminary workshop for all involved stakeholders (especially representatives from each line of business, along with those who are mostly unfamiliar with English and/or COBIT).
Pain points and triggers discussions are a great starting point to raise interest. Real-life examples, as suggested by workshop participants, are extremely important. This could lead to mapping of business goals to enterprise IT goals and the COBIT goals cascade. Engaging business representatives in this exercise ensures the correct alignment of business and IT goals and fosters a mutual understanding of needs.
Local and applicable global regulations (e.g., requirements for the internal audit function for organizations subject to specific regulations and organizations in the financial sector, the Committee of Sponsoring Organizations of the Treadway Commission [COSO], the Basel Committee on Banking Supervision [BCBS], the US Sarbanes-Oxley Act [SOX]) can motivate the adoption and implementation of COBIT 5 as an IT-related part of the overall control environment. Internal auditors, risk and compliance officers, even chief financial officers (CFOs) and chief executive officers (CEOs) can be supporters in these cases.
Involving IT auditors, especially ISACA certification holders, in a COBIT 5 implementation project or workshop can significantly increase the overall level of understanding and communication among stakeholders and, therefore, help overall GEIT implementation.
What sets COBIT 5 apart from general standards and best practices is that COBIT 5 provides specific enabling guidance for processes and activities that support goal achievement and control management. The guidance found in COBIT 5: Enabling Processes provides details on goals; key performance indicators (KPIs) and metrics; detailed activities; and the responsible, accountable, consulted and informed (RACI) chart. Supporting guidance enables COBIT 5 to be attuned to each respective environment. The COBIT 5 Assessment Program and the COBIT Process Assessment Model (PAM): Using COBIT 5 are the basis for assessing an enterprise’s processes for the governance and management of IT and related services as described in COBIT 5. The ability to assess process capability also provides a current-state and future-state approach to resolving weaknesses.
Processes and information are critical enablers to effective governance of enterprise IT (GEIT). However, other enablers such as organizational structures; culture, ethics and behavior; services, infrastructure and applications; or people, skills and competencies may be as important, depending on the type of business and its priority. In these cases, understanding control effectiveness while assessing IT governance process capabilities enables a holistic understanding of the current state and needed improvements. Moreover, the internal audit function can supplement the PAM capability levels derived through COBIT PAM by using a classic control assessment approach together with providing recommendations for improvements.
Culture, ethics and behavior of individuals and the enterprise are very often underestimated as a success factor in governance and management activities.
Information is pervasive throughout any organization and includes all information produced and used by the enterprise. Information is required for keeping the organization running and well governed, but at the operational level, information is very often the key product of the enterprise itself.
Services, infrastructure and applications include the infrastructure, technology and applications that provide the enterprise with IT processing and services.
People, skills and competencies are linked to people and are required for successful completion of all activities and for making correct decisions and taking corrective action.
Information, which needs to be managed as a resource. Some information items, such as management reports and business intelligence information, are important enablers for the governance and management of the enterprise.
The latest digital transformation trend (sometimes even verging on hype/fashion) seems to be a bit more structured and logically realized if its related activities are aligned to tried-and-tested guidance such as that provided in COBIT 5’s APO04—Manage Innovation process. COBIT 5, ISACA’s IS Audit and Assurance Standards and ISACA’s extensive library of reference guides provide relevant tips and techniques for evaluating goal attainment by IT.
Source: ISACA, COBIT 5, USA, 2012. Reprinted with permission.
COBIT 5 is not just one publication. It is number of publications and related tools—a universe of best practices.
Though COBIT 5 provides a plethora of guidance on governance needs, a successful implementation of GEIT frameworks requires a hybrid of best practice guidance such as COBIT 5, relevant industry standards and legislation, and experience and common sense.
Is a senior manager at KPMG Russia and CIS. He is also first vice president of the ISACA Moscow (Russia) Chapter. He is a COBIT 5 practitioner and trainer and a member of the COBIT 5 translation team responsible for translating and reviewing COBIT 5 in Russian.