COBIT Framework Navigation

As mentioned in the outset, COBIT 4.1 contains 34 processes, organized in four domains. Each process is covered in four sections, combining to give a complete picture of how to control, manage and measure the process. The four sections are:

1. Process descriptions
2. Control objectives
3. Management guidelines
4. Maturity model for the process

At the end, by applying these four sections for every process in sequential manner, it has been stated:

• (1) What the process owner needs to do >> in a process description
• (2) How the process owner is going to do it >> by using control objectives
• (3) What the process needs from others >> by determining input
• (3) What the process owner needs to deliver >> identifying output
• (3) What need to be delegated and to whom >> by creating a RACI chart
• (3) How the process and its goals should be measured >> by stating goals & metrics
• (4) How the process can be improved >> by applying a maturity model

In the following I want to give you an overview of how each of the four sections is organized and what is contained in them.

Section 1 – Process descriptions

This section is organized as follows:

Section 2 – Control Objectives

This section starts with the process domain and –name. It is then followed by a number of controls. Each control has its own descriptive text.

<Process Domain – Process Number – Process name>

Example: PO1 Define a Strategic IT Plan

PO1.1 IT Value Management

• Work with the business to ensure that the enterprise portfolio of IT-enabled investments contains programs that have solid business cases. Recognize that …

PO1.2 Business IT Alignment

• Explanatory text

PO1.3 Assessment of Current Capability and Performance

• Explanatory text

PO1.4 IT Strategic Plan

• Explanatory text

PO1.5 IT Tactical Plans

• Explanatory text

PO1.6 IT Portfolio Management

• Explanatory text

Section 3 – Management Guidelines

Part of the management guidelines section are input and output tables, a RACI chart and goals and metric for IT, process and activities.

Section 4 - Maturity model for the process

This section contains the maturity scales from 0-5 showing how a process can evolve from a non-existent capability to an optimized capability

<Process Domain – Process Number – Process name>

Example: PO1 Define a Strategic IT Plan

0 Non-existent when

• IT strategic planning is not performed. There is no management awareness that IT strategic planning is needed to support business goals.

1 Initial/ Ad Hoc when

• Descriptive text

2 Repeatable but Intuitive when

• Descriptive text

3 Defined when

• Descriptive text

4 Managed and Measurable when

• Descriptive text

5 Optimized when

• Descriptive text