© ISACA 2016.
All Rights Reserved.

Tichaona Zororo
CIA, CISA, CISM, CRISC, CRMA, CGEIT, COBIT 5 Certified Assessor
B.Sc. Honours Information Systems, PGD Computer Auditing
Accredited COBIT 5 Trainer© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

Business Value© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

Value Creation Governance Objectives

Benefits Realisation
EDM02© ISACA 2016.
All Rights Reserved.

Risk Optimization
EDM03

Resource Optimization
EDM04

© ISACA 2016.
All Rights Reserved.

1

Meeting
Stakeholder
Needs

2

COBIT 5

Covering
theEnterpriseEnd-to-End

Principles
3

4

Enabling a
Hollistic
Approach© ISACA 2016.
All Rights Reserved.

Applying asingleintegrated
Framework© ISACA 2016.
All Rights Reserved.

Meeting Stakeholder Needs:
Enterprises exist to create value for their stakeholders bymaintaining a balance between the realisation of benefits andthe optimisation of risk and use of resources.
COBIT®5 provides all of the required processes and otherenablers to support business value creation through the use ofIT.
An enterprise can customise COBIT®5 to suit its own context
through the goals cascade, translating high-level enterprisegoals into manageable, specific, IT-related goals and mappingthese to specific processes and practices.

© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

Covering the Enterprise End to end:
COBIT®5 integrates governance of enterprise IT into enterprisegovernance:
It covers all functions and processes within the enterprise;
COBIT®5 does not focus only on the ‘IT function’, but treats
information and related technologies as assets that need to be
dealt with just like any other asset by everyone in theenterprise.
It considers all IT-related governance and management
enablers to be enterprise-wide and end-to-end, i.e., inclusive of
everything and everyone—internal and external—that isrelevant to governance and management of enterprise
information and related IT.

© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

Applying a Single Integrated Framework :There are many IT-related standards and bestpractices, each providing guidance on a subset of IT
activities. COBIT 5 aligns with other relevant standards
and frameworks at a high level, and thus can serve as
the overarching framework for governance andmanagement of enterprise IT.

© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

Enabling a Holistic Approach:
Efficient and effective governance and management ofenterprise IT require a holistic approach, taking into accountseveral interacting components. COBIT 5 defines a set of
enablers to support the implementation of a comprehensive
governance and management system for enterprise IT.
Enablers are broadly defined as anything that can help toachieve the objectives of the enterprise.

© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

1.

5.

2.

6.

3.

7.

4.

© ISACA 2016.
All Rights Reserved.

Resources

Metrics forAchievementof Goal(Lag
Indicators)

The 7 Enabler
Dimensions

Enabler
Dimensions

Enabler
Performance
Management

Metrics forApplication of
Practice(Lead
Indicators)© ISACA 2016.
All Rights Reserved.

Principles,
Processes
Framework
People,Skills& Competencies

Processes

Metrics forAchievementof Goals(Lag
Indicators)

SIA

Organisational

Information

Structures

CultureEthics&Behaviour© ISACA 2016.
All Rights Reserved.

Metrics forApplication of
Practice(Lead
Indicators)© ISACA 2016.
All Rights Reserved.

Separating Governance from Management:
The COBIT 5 framework makes a clear distinction between
governance and management.
These two disciplines encompass different types of activities,
require different organisational structures and serve different
purposes.

© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

Processes for Governance of Enterprise IT
Evaluate, Direct and Monitor
EDM01 Ensure Governance Framework Setting & Maintenance
EDM02 Ensure Benefits Delivery
EDM03 Ensure Risk Optimization
EDM04 Ensure Resource Optimization
EDM05 Stakeholder Transparency

Processes for Management of Enterprise IT
Align, Plan and Organise

APO01 Manage the IT Management Framework
APO02 Manage Strategy
APO03 Manage Enterprise Architecture
APO04 Manage Innovation
APO05 Manage Portfolio
APO06 Manage Budget and Costs
APO07 Manage Human Resources

Build, Acquire and Implement

BAI01 Manage Programmes and Projects
BAI02 Manage Requirements Definition
BAI03 Manage Solutions Identification and Build
BAI04 Manage Availability and Capacity
BAI05 Manage Organisational Change Enablement
BAI06 Manage Changes

Deliver, Service and Support

DSS01 Manage Operations
DSS02 Manage Service Requests and Incidents
DSS03 Manage Problems
Controls© ISACA 2016.
All Rights Reserved.

APO08 Manage Relationships
APO09 Manage Service Agreements
APO10 Manage Suppliers
APO11 Manage Quality
APO12 Manage Risk
APO13 Manage Security

BAI07 Manage Change Acceptanceand Transitioning
BAI08 Manage Knowledge
BAI09 Manage Assets
BAI010 Manage Configuration

DSS04 Manage Continuity
DSS05 Manage Security Services
DSS06 Manage Business Process

Monitor Evaluate&
Assess

MEA01 Monitor,
Evaluate and Assess
Performance andConformance

MEA02 Monitor,
Evaluate and Assess
the System of Internal
Control
MEA03 Monitor,
Evaluate and Assess
Compliance With
External Requirements© ISACA 2016.
All Rights Reserved.

Grab the Low Hanging Fruit“

Focusing on quick wins and the prioritisation of

the most beneficial improvements that areeasiest to implement to demonstrate benefit andbuild confidence for further improvements”

Unlocking Your World to a Sea Opportunities© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

The 7 phases of theimplementation life cycle –Creating the Appropriate
Environment

Programme
management

Change enablement

Continual Improvement Life
Cycle

What are the drivers?

Initiate programme

Establish desire to change

Recognise need to act

Where are we now?

Define problems andopportunities

Form implementation
team

Assess current state

Where do we want to be?

Define road map

Communicate outcome

Define target state

What needs to be done?

Plan programme

Identify role players

Build improvements

How do we get there?

ExecuteOperate and use

Implement improvements

Did we get there?

Realise benefits

Embedded new
approaches

Operate & Measure

How do we keep the
momentum going?

Review effectivenessSustain

Monitor & Evaluate

GEIT Ideation Phase?

Unlocking Your World to a Sea Opportunities© ISACA 2016.
All Rights Reserved.

Phase 1

What Are The Drivers?

Unlocking Your World to a Sea Opportunities© ISACA 2016.
All Rights Reserved.

Phase 1

The Business Case for GEIT

Unlocking Your World to a Sea Opportunities© ISACA 2016.
All Rights Reserved.

Phase 1

Pain Points

Unlocking Your World to a Sea Opportunities© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

Phase 1

Trigger Events

Unlocking Your World to a Sea Opportunities© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

The 7 phases of theimplementation life
cycle

Programme
management

Changeenablement

Continual
Improvement Life
Cycle

Initiate programme

Establish desire tochangeRecognise need toact

Initiate the Programme
What are the drivers?

© ISACA 2016.
All Rights Reserved.

Phase 1© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

Process Assessment Phases?

Unlocking Your World to a Sea Opportunities© ISACA 2016.
All Rights Reserved.

Phase 2

Where Are We Now?

Unlocking Your World to a Sea Opportunities© ISACA 2016.
All Rights Reserved.

The 7 phases oftheimplementation
life cycle

Programme
management

Changeenablement

Continual Improvement Life
Cycle

Define problems andopportunities

Form
implementation
team

Assess current state❖ Understand the pain
points that havebeen identified asgovernanceproblems❖ Take advantage oftrigger events thatprovide opportunity
for improvement❖ Knowledge ofthe businessenvironment❖ Insight into
influencing
factors❖ Identify the IT goals in
respect to enterprise goals❖ Identify the most important
processes❖ Understand management
risk appetite❖ Understand the maturity ofexisting governance❖ Related processes

Define problems & opportunities
Where are wenow?

© ISACA 2016.
All Rights Reserved.

Phase 2© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

Phase 3

Where Do We Want to Be?

Unlocking Your World to a Sea Opportunities© ISACA 2016.
All Rights Reserved.

The 7 phases of theimplementation life
cycle

Programme
management

Change enablement

Continual
Improvement Life
Cycle

Define road map

Communicate outcome

Define target
state❖ Describe the highlevel change
enablement planand objectives❖ Develop acommunication
strategy❖ Define thetarget for
improvement❖ Communicate thevision❖ Analyze thegaps❖ Articulate the rationale
and benefits of thechange❖ Identify
potential
improvements

Define road map
Where do we want tobe?

❖ Set the tone at the top© ISACA 2016.
All Rights Reserved.

Phase 3© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

GEIT Solution Design Phase?

Unlocking Your World to a Sea Opportunities© ISACA 2016.
All Rights Reserved.

Phase 4

What Needs to Be Done?

Unlocking Your World to a Sea Opportunities© ISACA 2016.
All Rights Reserved.

The 7 phases oftheimplementation
life cycle

Change enablement

Continual
Improvement Life
Cycle

Plan programme

Identify role players

Build improvements❖ Prioritize
potential
initiatives❖ Develop
formal andjustifiable
projects❖ Use plans that
includecontribution
and program
objectives

Empower role players and identify
quick wins [Low Hanging Fruit – visible
issues that can be addressed relatively
quickly and help establish thecredibility of the overall initiative bydemonstrating benefits ]❖ High benefit, easy implementations
should come first❖ Obtain buy-in by key stakeholders
affected by the change❖ Identify strengths in existingprocesses and leverage
accordingly❖ Plot improvements
onto a grid toassist withprioritization❖ Consider
approach,deliverables,
resources needed,
costs, estimatedtime scales,
project
dependencies
and risks

Programme
management

Plan the Programme

What needs tobe done?

© ISACA 2016.
All Rights Reserved.

Phase 4© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

GEIT Solution Implementation Phase?

Unlocking Your World to a Sea Opportunities© ISACA 2016.
All Rights Reserved.

Phase 5

How Do We Get There?

Unlocking Your World to a Sea Opportunities© ISACA 2016.
All Rights Reserved.

The 7 phases of theimplementation life
cycle

Programme
management

Changeenablement

Continual
Improvement Life
Cycle

ExecuteOperate and use

Implement
improvements❖ Execute projects
according to an
integrated program
plan❖ Provide regular
update reports tostakeholders❖ Document andmonitor thecontribution ofprojects while
managing risks
identified❖ Build on the
momentum andcredibility of quick
wins❖ Plan cultural andbehavioral
aspects of thebroader transition❖ Define measuresof success❖ Adopt and adapt
best practices tosuit theenterprise’s
approach topolicies andprocess changes

Execute the Programme
How do we getthere?

© ISACA 2016.
All Rights Reserved.

Phase 5© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

Post Implementation Phases?

Unlocking Your World to a Sea Opportunities© ISACA 2016.
All Rights Reserved.

Phase 6

Did We Get There?

Unlocking Your World to a Sea Opportunities© ISACA 2016.
All Rights Reserved.

The 7 phases of
GEIT
implementation
life cycle

Programme
management

Change enablement

Continual
Improvement Life
Cycle

Realise benefits

Embedded new approaches

Operate &Measure❖ Monitor theoverall
performance ofthe program
againstbusiness caseobjectives❖ Monitor andmeasure theinvestment
performance❖ Provide transition from projectmode to business as usualmode❖ Monitor whether new roles
and responsibilities havebeen taken on❖ Track and assess objectives of
the change response plans❖ Maintain communication andensure communication
between appropriate
stakeholders continues❖ Set targets foreach metric❖ Measure
metrics
against targets❖ Communicate
results andadjust targets
as necessary

Realise Benefits
Did we get there?

© ISACA 2016.
All Rights Reserved.

Phase 6© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

Phase 7

How Do We Keep the Momentum Going?

Unlocking Your World to a Sea Opportunities© ISACA 2016.
All Rights Reserved.

The 7 phases of theimplementation life
cycle

Programme
management

Change enablement

Continual Improvement
Life Cycle

Review effectivenessSustain

Monitor & Evaluate

keeping the
momentum is critical tosustainment of thelifecycle.

❖ Conscious
reinforcement(reward achievers)❖ Ongoing
communication
campaign(feedback on
performance)❖ Continuous top
management
commitment❖ Identify new
governanceobjectives based onprogram experience❖ Communicate
lessons learned andfurther improvement
requirements for the
next iteration of the
cycle

Review EffectivenessHow do we keep
the momentum
going?

❖ Review program
effectivenessthrough a program
review gate
❖ Review the program
benefits© ISACA 2016.
All Rights Reserved.

Phase 7© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

Is a standard
based approachto processassessment that
produces resultsthat support
process
improvement
criteria andplanning.

Improved
reliability andrepeatability
reducing debatesanddisagreements
betweenstakeholders on
assessment results.
© ISACA 2016.
All Rights Reserved.

Providesenterprises with arepeatable,
reliable androbustmethodology forassessing thecapability of IT
processes.

Provides a means tomeasure theperformance of any of
the 5 Governance(EDM-based) or 32
Management (PBRMbased) processes
thereby allowing areas
for improvement to be
identified.

ISO 15504
compliance.

Simplified
content
througheliminationofduplication.

© ISACA 2016.
All Rights Reserved.

ISO 15504

Process Attribute Rating
Scale

ISO 15504 -1
Concepts andVocabulary

Process Assessment
Terminology
Process Assessment
Process

ISO 15504 – 2
Measurement
Framework

ISO 15504 – 3
Guidance on
Performing an
Assessment

ISO 15504 – 4
Assessment
Process

ISO 15504 – 5

An Exemplar
Process Assessment
Model© ISACA 2016.
All Rights Reserved.

Process Capability Levels& Attributes

Assessment Indicators

Process Capability Level
Ratings

Generic Work Products&
Generic Practices

37 Processes

Process Description
Process Purpose Statement
IT Related Goals & Metrics
Process Related Goals &Metrics
2 AreasEnabling Processes

5 Domains
210 Practices
Practice Description

30 Outputs

1111 Activities© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

Provide Gap Analysis
and improvement
planning information
to support definitionof justifiableimprovement projects
Assessing
Capability of IT
Processes

Provide thegovernance body andmanagement withprocess assessment
ratings to measure andmonitor current IT
processes capabilities© ISACA 2016.
All Rights Reserved.

Report internally to an
enterprise’s executive
management or boardof directors on thecapability of IT processes
and establish a target for
improvement based on
business requirements

Enable those ingovernance &management tobenchmark processcapabilities &support investment
decisionmaking with regard
to process
improvement

Process Assessment

Can invlove

Process Capability
Determination

Process
Improvement

Leads to

© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

GEIT
Implementation
Phase – Creating
the Appropriate
Environment

Programme
management

Changeenablement

Continual
Improvement Life
Cycle

Phase 2

Define problems
andopportunities

Form
implementati
on teamAssess current state

Define roadmap

Communicat
e outcomeDefine target state

Where are wenow?
Phase 3
Where do we want
to be?

© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

Assessor Guide: Using COBIT® 5
Provides details on how to undertake a full ISO 15504 - compliant
assessment (Guidance on how to perform an assessment)
Principles, Policies&
Frameworks

Process Assessment Model: Using COBIT® 5
Principles, Policies&
Frameworks

Forms the basis for the assessment of an enterprise's IT processes

Self Assessment Guide: Using COBIT® 5
Provides guidance on how to perform a basic/less rigorous selfassessment of an organisation’s current IT process capability levels
against COBIT processes

Assessment Programme Tool Kit: Using COBIT® 5
Principles, Policies&
Frameworks

Support assessment activities, including scoping templates andmapping to business and IT goals© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

ISO/IEC 15504 Process

COBIT 4.1 Process Maturity Level

Capability Level

Attribute

5 Optimizing

PA 5.1 Process innovation
PA 5.2 Process optimization

4 Predictable

PA 4.1 Process measurement
PA 4.2 Process control

3 EstablishedPA 3.1 Process definition
PA 3.2 Process deployment

2 Managed

PA 2.1 Performance management
PA 2.2 Work productmanagement

1 Initial/ad hoc

1 Performed

PA 1.1 Process performance0 Non-existent

0 Incomplete

5 Optimised

4 Managed and measurable

3 Defined

2 Repeatable but intuitive© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

Class 1:
Used for Comparison with other enterprises
Assessor Independent of the unit being Assessed
A minimum of 4 process instances for each process assessed

Class 2:
Used to provide a basis for an initial assessment at the commencementof a process improvement programme
To enable assessment conclusion to be drawn about the opportunities
for improvement
Can be performed internally or by an independent assessor
A minimum of 2 process instances for each process assessed
Class 3:
Used for testing and understanding the IT process and potential benefits
from improvement.
Suitable for monitoring the ongoing progress of an improvement
programme or to identify key issues for a later class 1 or 2
Can be performed internally or by an independent assessor
No minimum number of process instances required for each processassessed© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

Level 5 Optimizing process
PA.5.1
Process Innovation attribute
PA.5.2
Process Optimization attribute

Optimizing
The process is continuously improved to meet relevant
current and projected business goals
Predictable
The process is enacted consistently within
defined limits

EstablishedA defined process is used based on astandard process.

6 Process
Capability
LevelsLevel 4 Predictable Process
PA.4.1
Process Measurement attribute
PA.4.2
Process Control attribute

Level 3 Established Process
PA.3.1
Process Definition attribute
PA.3.2
Process Deployment attribute

Level 2 Managed Process
PA.2.1
Performance Management attribute
PA.2.2Work Product Management attribute

Level 1 Performed process
PA.1.1
Process Performance attribute

Level 0 Incomplete process© ISACA 2016.
All Rights Reserved.

9 ProcessAttributes

ManagedThe process is managed and work
products are established, controlled andmaintained.

Performed
The process is implemented and achieves
its process purpose

Incomplete
The process is not implemented or fails to achieve its
purpose. No process Attribute© ISACA 2016.
All Rights Reserved.

N

Not achieved> 0 to 15 % achievement

There is little or no evidence of achievement of the defined attribute in the assessed
process

NP

Partially achieved

4 Rating Scales> 15 % to 50 % achievement00% – 15%
Not achievement
Achieved of, the N
There is some evidence of❖an approach
to, and somedefinedattribute in the assessed process. Some aspects of achievement of the attribute may be
unpredictable

L

Largely achieved❖❖

16% - 50%
51% - 85%

Partially Achieved
Largely Achieved> 50 % to 85% achievement

NPL❖ 86%approach- 100% to, Fully
Achieved
F of, theThere is evidence of a systematicand significant
achievement
defined attribute in the assessed process. Some weakness related to this attribute may exist
in the assessed processF© ISACA 2016.
All Rights Reserved.

Fully achieved> 85 % to 100 % achievement
There is evidence of a complete and systematic approach to, and full achievement of,the defined attribute in the assessed process. No significant weaknesses related to this
attribute exist in the assessed process© ISACA 2016.
All Rights Reserved.

1
PA.5.1
PA.5.2

Level 5 - Optimised

Level 4 - Predictable

Level 2 - Managed

PA.2.1 Performance Management
PA.2.2 Work Product Management

Process Definition
Process Deployment

PA.1.1 Process Performance

Incomplete process

4

5
L
/
F

Process Measurement
Process Control

Level 3 - Established

Level 0 - Incomplete

3

Process Innovation
Process Optimization

PA.3.1
PA.3.2

Level 1 - Performed© ISACA 2016.
All Rights Reserved.

PA.4.1
PA.4.2

2

L
/
F

F

F

F

L
/
F

L
/
F
L
/
F

F

F

F

F

F

F

F

© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

/ Capability Dimension

Level 5
Level 4
Level 3
Level 2
Level 1
Level 0

EDM 5 Processes
APO 13 Processes

BAI 10 Processes
DSS 6 Processes
MEA 3 Processes© ISACA 2016.
All Rights Reserved.

PA5.2 Continuous optimisation
PA5.1 Process innovation
PA4.2 Process control
PA4.1 Process measurement
PA3.2 Process deployment
PA3.1 Process definition
PA2.2 Performance management
PA2.1 Work product management
PA1.1 Process performance

Based on (Level 1 to 5)
Process Attribute Indicators(PAI):
GP : Generic Practice
GWP : Generic Work Product

Additional performanceindicators Level 1 based on :BP : Base practices
WP : Work products© ISACA 2016.
All Rights Reserved.

ISO 15504 – 2

40 Generic Practices

Measurement
Framework
Capability Levels
Process Attributes
Rating Scale© ISACA 2016.
All Rights Reserved.

9 Generic Work Products© ISACA 2016.
All Rights Reserved.

40 Generic Practices

Level 5 Optimizing process
PA.5.1
Process Innovation attribute
PA.5.2
Process Optimization attribute

Level 4 Predictable Process
PA.4.1
Process Measurement attribute
PA.4.2
Process Control attribute© ISACA 2016.
All Rights Reserved.

11 Generic Practices

Level 3 Established Process
PA.3.1
Process Definition attribute
PA.3.2
Process Deployment attribute

11 Generic Practices

Level 2 Managed Process
PA.2.1
Performance Management attribute
PA.2.2Work Product Management attribute

10 Generic Practices

Level 1 Performed process
PA.1.1
Process Performance attribute

Level 08 Generic Practices

Incomplete process

210 Base Practices

PA 1.1 Process Performance
BP 1.1.1

Achieve the process outcomes

PA 2.1 Performance Management
GP 2.1.1

Identify the objectives

GP 2.1.2

Plan & monitor the performance

GP 2.1.3

Adjust the performance

GP 2.1.4

Define responsibilities and authorities

GP 2.1.5

Identify and make available

GP 2.1.6

Manage the interfaces

PA 2.2 Work Product Management© ISACA 2016.
All Rights Reserved.

GP 2.2.1

Define the requirements for the work products

GP 2.2.2

Define the requirements for documentation and control

GP 2.2.3

Identify document and control

GP 2.2.4

Review and adjust work productsPA 3.1 Process Definition

GP 3.1.1

Define the standard

GP 3.1.2

Determine the sequence and interaction between processes

GP 3.1.3

Identify the roles and competencies

GP 3.1.4

Identify the required infrastructure and work environment

GP 3.1.5

Determine suitable methods

PA 3.2 Process Deployment© ISACA 2016.
All Rights Reserved.

GP 3.2.1

Deploy a defined process

GP 3.2.2

Assign and communicate roles and responsibilities and authorities

GP 3.2.3

Ensure necessary competencies

GP 3.2.4

Provide resources and information

GP 3.2.5

Provide adequate processes infrastructure

GP 3.2.6

Collect and analyse dataPA 4.1 Process Measurement

GP 4.1.1

Identify process information needs

GP 4.1.2

Define process measurement objectives

GP 4.1.3

Establish quantitative objectives

GP 4.1.4

Identify product and process

GP 4.1.5

Collect product and process measurement results

GP 4.1.6

Use results of the defined measurement

PA 4.2 Process Control© ISACA 2016.
All Rights Reserved.

GP 4.2.1

Determine analysis

GP 4.2.2

Define parameters

GP 4.2.3

Analyse process and product measurement results

GP 4.2.4

Identify and implement corrective actions

GP 4.2.5

Re-establish control

PA 5.1 Process Innovation
GP
5.1.1

Define the process improvement objective for the process

GP
5.1.2

Analyse measurement data of the process

GP
5.1.3

Identify improvement opportunities of the process

GP
5.1.4

Derive improvement opportunities of the process from new technologies andprocess concepts

GP
5.1.5

Define an implementation strategy

PA 5.2 Process Optimisation© ISACA 2016.
All Rights Reserved.

GP
5.2.1

Assess the impact of each proposed change

GP
5.2.2

Manage the implementation of agreed changes

GP
5.2.3

Based on actual performance, evaluate the effectiveness of process change© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

GWP ID

GWP

1.0

Process Documentation

2.0

Process Plan

3.0

Quality Plan

4.0

Quality Records

5.0

Policies and Standards

6.0

Performance Improvement Plan

7.0

Process Measurement Plan

8.0

Process Control Plan

9.0

Process Performance Records

© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.

Processes for Governance of Enterprise IT
Evaluate, Direct and Monitor
EDM01 Ensure Governance Framework Setting & Maintenance
EDM03 Ensure Risk Optimization
EDM05 Stakeholder Transparency

EDM02 Ensure Benefits Delivery
EDM04 Ensure Resource Optimization

Processes for Management of Enterprise IT
Align, Plan and Organise

APO01 Manage the IT Management Framework
APO02 Manage Strategy
APO03 Manage Enterprise Architecture
APO04 Manage Innovation
APO05 Manage Portfolio
APO06 Manage Budget and Costs
APO07 Manage Human Resources

Build, Acquire and Implement

BAI01 Manage Programmes and Projects
BAI02 Manage Requirements Definition
BAI03 Manage Solutions Identification and Build
BAI04 Manage Availability and Capacity
BAI05 Manage Organisational Change Enablement
BAI06 Manage Changes

Deliver, Service and Support

DSS01 Manage Operations
DSS02 Manage Service Requests and Incidents
DSS03 Manage Problems© ISACA 2016.
All Rights Reserved.

APO08 Manage Relationships
APO09 Manage Service Agreements
APO10 Manage Suppliers
APO11 Manage Quality
APO12 Manage Risk
APO13 Manage Security

BAI07 Manage Change Acceptanceand Transitioning
BAI08 Manage Knowledge
BAI09 Manage Assets
BAI010 Manage Configuration

DSS04 Manage Continuity
DSS05 Manage Security Services
DSS06 Manage Business Process Controls

Monitor Evaluate&
Assess
MEA01 Monitor,
Evaluate and Assess
Performance andConformance
MEA02 Monitor,
Evaluate and Assess
the System of Internal
Control
MEA03 Monitor,
Evaluate and Assess
Compliance With
External Requirements

EDM 5 - Process

APO -13 Processes

BAI - 10 Processes

DSS - 6 Processes

MEA - 3 Processes© ISACA 2016.
All Rights Reserved.

COBIT® 5 Enablers –Enabling Processes –230 pages❖❖

210 Practices
30 Outputs

EDM 15 Practices

APO 72 Practices

BAI 68 Practices

DSS 38 Practices

MEA 17 Practices© ISACA 2016.
All Rights Reserved.

❖❖

210 Base Practices
434 Base Work
Products

© ISACA 2016.
All Rights Reserved.

+27 (0) 11 234 2597
tichaona.zororo
Tichaona Zororotichaonazororo
Tichaona Zororotichaona.zororo@egit.co.za@TichaonaZororo
Tichaona Zororo+27 (0) 73 298 9606
EGIT | Enterprise Governance of IT (Pty) Ltd© ISACA 2016.
All Rights Reserved.

© ISACA 2016.
All Rights Reserved.