Volume 2, April 2014

In This Issue:
DuPont Drives Continuous Improvement With COBIT 5 Process Assessment Model
Navigate COBIT 5 in the New COBIT Online
Is COBIT 5 Process Implementation a Wicked Problem?
Plans for the Future: COBIT 5 Growth Strategy
Strategic Planning Using COBIT 5

Come join the discussion! James Aliquo and Zhiwei Fu will respond to
questions in the discussion area of the COBIT 5Use It
Effectively topic beginning 24 April 2014. Call for Articles

How are you using COBIT

DuPont Drives Continuous Improvement With at your enterprise?
COBIT 5 Process Assessment Model We welcome articles on your
By James F. Aliquo Jr., CISA, CRISC, and Zhiwei Fu, Ph.D., CISA, experiences with this
CRISC, CGEIT, CFE, PMP framework. Deadline
to submit copy for
Over time, business has increasingly advanced the application of IT to meet ever- volume 3, 2014:
changing business needs and regulatory requirements. A systematic and continuous
improvement program is needed now more than ever to help businesses assess IT 10 June 2014
management capabilities; identify strengths, weaknesses and risk factors with respect
to business requirements; and implement process changes to enhance services and Submit articles for
operations needed to meet stakeholder and business needs. In essence, continuous peer review to:
improvement helps an organization focus on doing things right and continually publication@[Link]
improving its effectiveness and efficiency.

To successfully meet this need, DuPont recognized that it must leverage a robust,
dependable process assessment framework to drive its continuous improvement
1
program. The COBIT 5 process assessment model (PAM) is evidence-based and
enables a reliable, consistent and repeatable assessment in the area of governance Case Studies
and management of enterprise IT (GEIT) to support continuous process improvement
2
(the COBIT Assessment Programme ). Accredited training organizations deliver
training on the assessment approach, and an assessor certification, COBIT 5 Certified
Visit the
Assessor, is available from ISACA .
COBIT Recognition and
Case Studies pages to read
DuPont had successfully applied the COBIT framework for its IT process more COBIT 5 and COBIT 4.1
management, governance and audit compliance over a period of years and, therefore,

decided to use the COBIT 5 PAM. IBM Global Business Services, a premier
case studies.
consulting service provider that has broad knowledge of COBIT implementation, deep
expertise in enterprise IT process management and governance, and extensive
experiences in both private and public sectors, was asked to perform an independent
process capability assessment for DuPont.
Background on DuPont
E. I. du Pont de Nemours and Company, commonly referred to as DuPont, is a Fortune 500 American chemical company.
DuPonts vision is to be the worlds most dynamic science company, creating sustainable solutions essential to a better, safer
and healthier life for people everywhere. For more than 200 years, DuPont has served markets as diverse as agriculture,
nutrition, electronics and communications, safety and protection, home and construction, transportation, and apparel. Over the
years, DuPont has advanced to become a world leader in market-driven innovation and science. It has brought world-class
science and engineering to the global marketplace through innovative products, materials and services, and introduced
thousands of new products and patent applications every year. The DuPont information sciences and IT organization provides
globally-integrated communication, information services and computing infrastructure that enables the enterprise to provide
solutions for the worlds most urgent needs, and more important, uses information and technology for a competitive
advantage, fueling business growth for the company.

Establish the COBIT 5 PAM Assessment

The COBIT 5 PAM is an ISO/IEC 15504-based process capability assessment model that incorporates COBIT 5 as the
process reference model (PRM) for base requirements and ISO/IEC 15504 as the basis for the measurement framework to
determine capability levels.

COBIT 5 brings together its five key principles that allow enterprises to build an effective governance and management
framework, and a holistic set of seven enablers that help enterprises optimize information and technology investment and use
for the benefit of stakeholders. Furthermore, COBIT 5 enables information and related technology to be governed and
managed in a holistic manner for entire enterprises, taking in the full end-to-end business and functional areas and
considering the IT-related interests of internal and external stakeholders. The COBIT 5 principles and enablers are generic
and useful for enterprises of all sizes, whether commercial, not-for-profit or public-sector.

The ISO/IEC 15504 standard identifies management process assessment as an activity that can be performed either as part
of a process improvement initiative or as part of a capability determination approach. The purpose of process improvement is
to continually improve the enterprises management effectiveness and efficiency, and the purpose of process capability
determination is to identify the strengths, weaknesses and risk factors of selected management processes with respect to a
particular, specified requirement through the processes used and their alignment with business needs.

Leveraging ISO/IEC 15504, in conjunction with the widely accepted COBIT framework for GEIT, makes the COBIT 5 PAM the
basis for a robust, dependable and scalable assessment approach. Figure 1 illustrates the high-level architecture of the
COBT 5 PAM.

The COBIT 5 PAM is composed of process and capability dimensions, a set of process performance indicators that are
specific for each process and used
Figure 1The COBIT 5 Process Assessment Model to determine whether a process is at
capability level 1, and a set of
Process Reference Model Measurement Framework generic process capability attribute
- Domain and scope - Capability levels indicators which apply to capability
levels 1 to 5. The process capability
- Process purpose - Process attributes
attribute indicators are generic for
- Process outcomes - Rating scale each process attribute and used as
a basis for collecting objective
evidence that enables process
capability ratings to be determined.
The process dimensions of the PAM
Process use the COBIT 5 PRM, where the
Assessment Model governance and management
- Scope processes are defined in a life cycle
- Indicators and classified into process
- Mapping categories with an architecture
describing the relationship among
- Translation the processes. The capability
dimension provides a measure of a

Source: ISACA, Assessor Guide: Using COBIT 5, USA, 2013 processs capability to meet the

Volume 2, April 2014 Page 2

current or projected business goals for the enterprise process, expressed in terms of nine process attributes grouped into five
capability levels. Figure 2 illustrates the two-dimensional COBIT 5 PAM with the PRM as the process dimension and the
ISO/IEC 15504 measurement framework as the capability dimension.

The COBIT 5 PRM subdivides the IT-related processes, practices and activities of the enterprise into two main areas, governance
and management. Governance ensures that stakeholders needs, conditions and options are evaluated to determine balanced,
agreed-upon enterprise objectives to be achieved, setting direction through prioritization and decision making, and monitoring
performance and compliance against enterprise objectives. Management ensures that the plan, build, run and monitor (PBRM) IT
management activities are executed in alignment with the direction set by the governance body to achieve the enterprise objectives.

Figure 2The Capability and Process Dimensions of the PAM

Process Dimension Capability Dimension

PAM Model

Source: ISACA, Assessor Guide: Using COBIT 5, USA, 2013, figures 3, 5 and 6; ISACA, COBIT Process Assessment Model (PAM): Using
COBIT 5, USA, 2013, figure 2

Volume 2, April 2014 Page 3

The PAM process capability levels begin from level zero (incomplete process), to level one (performed process) and then to
level two (managed process), which generally represent the instance view of an individual program or project. At level two, the
base management practices are performed in a managed fashion (planned, monitored and adjusted) to achieve the process
purposes, with work products appropriately established, controlled and maintained. Process capability levels three
(established process), four (predictable process) and five (optimized process) represent the enterprise view of the corporate
capability for a process, where a standard enterprise-level process is deployed and operated with defined limits to achieve its
process outcomes and continuously improved to meet relevant current and projected business goals. The COBIT 5 PAM
assessment evaluates if and how well specific process attributes for each process level are achieved, and provides a level of
confidence in the assessment results that indicates the overall capability of management processes. A rating that indicates
the level of achievement is assigned accordingly, based on objective and validated evidence for each process attribute. The
capability level of a process is determined on the basis of the achievement of specific process attributes according to ISO/IEC
15504, i.e., whether the process attributes at that level have been largely and fully achieved and whether the process
attributes for the lower level have been fully achieved.

Plan and Scope the COBIT 5 PAM Assessment

Diligent assessment planning and proper scoping was critical to the success of the COBIT 5 PAM assessment at DuPont.
This involved identifying relevant DuPont business drivers and associated stakeholder needs for the process assessment,
selecting the target processes that would be included in the scope of the assessment, identifying any relevant constraints,
selecting the assessment participants and the assessment team, and defining their respective roles and responsibilities.
DuPont and IBM collaborated with the relevant stakeholders and determined the assessment scope, the management
processes to be assessed, assessment constraints and participants, and the type of assessment to be executed (class two).
Based on the assessment scope and requirements, IBM established a PAM assessment team with competent and certified
assessors, independent from the organizations performing the management processes.

It was integral to the assessment planning and scoping that the assessment team identified and reviewed DuPont business
and regulatory requirements and developed various diagnostic tools, assessment templates, guidelines and procedures to
ensure assessment standardization and consistency across the processes assessed. There were a number of assessment
tools and templates developed and applied by the assessment team that effectively addressed assessment and stakeholder
needs. The assessment team managed the assessment plan, scope and schedule through constant tracking and continual
communication with DuPont leadership and associated stakeholders. All assessment statuses and issues, changes and
updates were identified and communicated in a timely manner to the appropriate DuPont stakeholders for proper action.

Perform the COBIT 5 PAM Assessment

The COBIT 5 PAM assessment was carried out based on the assessment class (class two) and assessment scope chosen by
3
DuPont management (in accordance with the Assessor Guide: Using COBIT 5 ) with the goal of determining if the
management processes at DuPont have met the business needs and regulatory requirements, achieved the process
purposes, applied good practices, managed the life cycle of the processes, and produced appropriate work products. There
were a number of assessment techniques developed and applied in the process assessment, including:
Management diagnostics and awareness assessment
Management questionnaires and checklists to confirm findings
Sampling techniques to determine whether process outcomes have (or have not) occurred
Management statements corroborated by customers and other assurance sources
Staff interviews to assess their knowledge, competency, awareness and behaviors
Process, policy and standard operating procedure reviews
Process instances and sample data identified, collected and reviewed
Sample processes, procedures, meetings and reviews observed and walked through

Leveraging the appropriate assessment techniques developed by the IBM assessment team, in conjunction with DuPont
support, the team conducted extensive process management reviews and interviews with internal and external stakeholders.
The assessment team confirmed that evidence and artifacts collected from various sources were sufficient and objective, and
ensured that the data as a whole were consistent with the requirements of the class and scope of the assessment. The in-
depth analysis and validation of the supporting evidence and artifacts were thereafter performed to evaluate if the base
management practices existed for the management processes; whether these practices achieved the process purpose and
outcomes; and how well or poorly the management processes performed, which led to the establishment of the DuPont
process profiles and recommendations for continuous improvement.

Volume 2, April 2014 Page 4

 Figure 3The Mock-up Improvement Road Map

2013 Process Capability Level

Applicable Process Improvement Opportunities
Process Name In Scope 20XX Target Level
(PIO) with Recommended Priority
Level 1 Level 2 Level 3 Level 4 Level 5

Align, Plan and Organize

APO01 Manage the IT Management Framework F L Level 2

APO09 Manage Service Agreements F F L Level 3

APO11 Manage Quality F F L Level 3

APO12 Manage Risk L Level 2

APO13 Manage Security L Level 2

Build, Acquire and Implement

BAI01 Manage Programs and Projects F F L Level 3

BAI03 Manage Solutions Identification and Build F L Level 2

BAI04 Manage Availability and Capacity F F L Level 3

BAI06 Manage Changes L P Level 2

BAI07 Manage Change Acceptance and Transitioning F L Level 2

BAI08 Manage Knowledge P Level 2

BAI09 Manage Assets F L Level 2

BAI10 Manage Configuration L Level 2

Deliver, Service and Support

DSS01 Manage Operations L Level 2

DSS02 Manage Service Requests and Incidents F F P Level 3

DSS03 Manage Problems L Level 2

DSS05 Manage Security Services L Level 3

DSS06 Manage Business Process Controls F P Level 3

Monitor, Evaluate and Assess

MEA01 Monitor, Evaluate and Assess Performance and Conformance F L Level 2

MEA02 Monitor, Evaluate and Assess the System of Internal Control L Level 2

MEA03 Monitor, Evaluate and Assess Compliance with External Requirements F F P Level 3

Legend: The high priority path of the roadmap The improvement opportunity number and associated level of High priority

The Medium priority path of the roadmap The improvement opportunity number and associated level of Medium priority

The Low priority path of the roadmap The improvement opportunity number and associated level of Low priority

Source: E. I. du Pont de Nemours and Company

Develop and Communicate the Assessment Results

The results of the assessment were analyzed and reported in a detailed assessment report, which included an overall
assessment approach and analysis, a determination of the current capability level, key issues (such as observed weaknesses
in process capabilities and opportunities for improvement), and recommendations for process improvement. The detailed
assessment report was provided to the DuPont assessment sponsor upon completion of the assessment workload. A high-
level management summary and executive briefing were also provided in the form of a presentation to the DuPont leadership
team. The process capability profiles and improvement road map were also properly established for the assessed
management processes, with the key issues analyzed, capability gaps incorporated and target levels provided for respective
processes. Figure 3 illustrates the mock-up of the DuPont specific, measurable, actionable, realistic and time-bound
(SMART) improvement road map for continuous improvement.

Implement Continuous Improvement Road Map

The continuous improvement of the management processes capabilities through their life cycle goes beyond simply
remediating or mitigating these identified process issues or weaknesses. Rather, continuous improvement efforts need to be
closely aligned with enterprise business objectives and risk tolerances and managed holistically across the enterprise with
appropriate strategy, priority and resources using the seven COBIT 5 enablers. The DuPont governance organization ensured
that the target capability levels for the processes be set in alignment with strategic vision and business objectives of IT, for the
balance of optimal business value, risk levels and resource use, and that management execution of the process improvement
road map with defined roles and responsibilities be performed and governed continually through its life cycle. Figure 4
illustrates the continuous improvement landscape with the seven COBIT 5 enablers.

Volume 2, April 2014 Page 5

 Figure 4Continuous Improvement Through Seven Enablers Conclusion
Businesses have been
continually enhancing their
process capabilities to
address complex and
dynamic business
challenges. To that end, it is
critical to adopt a robust
process assessment
framework, perform a
reliable assessment for
internal reporting, and
establish a sound and solid
basis for capability
determination and continual
process improvement.
Furthermore, it is generally
understood that the higher
the process capability, the
lower the risk of the process
failing to meet its intended
purpose, and that the higher
the capability, the more
costly the process is to
operate. This case study
presents a process
capability assessment with
the COBIT 5 PAM for a
Fortune 500 company. This
COBIT 5 PAM assessment
has helped DuPont establish
Source: E. I. du Pont de Nemours and Company appropriate process
baselines and a well-
balanced SMART improvement road map to continually enhance its information and technology capability for a competitive
advantage and fuel business growth for the company. The COBIT 5 PAM is based on an ISO standard for an evidence-based
process capability assessment that, if properly implemented, can greatly benefit enterprises of all sizes, whether commercial,
not-for-profit or public-sector.

Acknowledgments
The authors wish to recognize Eric Mittnight, Michael T. Clark, John W. Lainhart, Christopher M. Ballister, James L. Golden
and Jose Martinez of IBM and Dana F. Ormerod of DuPont for their exceptional contributions to the COBIT 5 PAM
assessment at DuPont and the development of this case study.

References
International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC), 20000:2006, IT Service
Management Standard, Switzerland, 2006
ISO/IEC, 27001:2005, Information technologySecurity techniquesInformation security management systems
Requirements, Switzerland, 2005
ISO/IEC, 38500:2008, Corporate Governance of Information Technology Standard, Switzerland, 2008

ISACA, COBIT 5, USA, 2012

Volume 2, April 2014 Page 6


ISACA, COBIT 5 for Assurance, USA, 2013
Research Update

ISACA, COBIT 5: Enabling Process, USA, 2012 Recently Released COBIT 5

ISACA, COBIT 5 Implementation, USA, 2012 Materials


ISACA, COBIT 5 for Information Security, USA, 2013 Vendor Management:
Project Management Institute, Project Management Body of Knowledge (PMBOK2 ),

Using COBIT 5
USA, 2008
Upcoming Second Quarter
James F. Aliquo Jr., CISA, CRISC 2014 COBIT 5 Releases
Is the global controls and compliance manager for the information technology and process
(ITP) function at DuPont. Aliquo has designed and implemented many of the IT risk
Risk Scenarios for COBIT 5
processes being used in DuPonts ITP function. He is a strong proponent of the for Risk
incorporation of COBIT, more specifically, the maturity modeling aspects and their Controls and Assurance in
usefulness in relation to comprehensive process execution and analysis. the Cloud: Using COBIT 5
COBIT 5 online: Access to
Zhiwei Fu, Ph.D., CISA, CRISC, CGEIT, CFE, PMP publications in the COBIT 5
Is the senior principal of governance, risk and compliance (GRC) and cybersecurity at
IBM Global Business Services. He has an extensive background in designing, product family and to other
implementing and assessing governance and compliance programs and IT controls in non-COBIT, ISACA content
various industries and third-party service organizations. He is a renowned researcher and current, relevant GEIT
and practitioner in business analytics, modeling and optimization, performance material
measurement, and process improvement, with multiple publications in international
journals, book series and conference proceedings. For more information on COBIT
publications, visit the COBIT 5
Endnotes page of the ISACA web site.
1
ISACA, COBIT Process Assessment Model (PAM): Using COBIT 5, USA, 2013
COBIT 5 translations are
2
ISACA, COBIT 5 Assessment Programme, USA, 2013 available on the COBIT Product
3
ISACA, Assessor Guide: Using COBIT 5, USA, 2013 Family page.

Navigate COBIT 5 in the New COBIT Online

By John W. Lainhart IV, CISA, CISM, CGEIT, CRISC

COBIT 5 online will offer a greatly enhanced user experience with its launch in the third quarter of 2014. The new online

version of COBIT will give users the ability to navigate the COBIT 5 product family, including COBIT 5, COBIT 5

Implementation, COBIT 5: Enabling Processes, COBIT 5: Enabling Information, COBIT 5 for Assurance, COBIT 5 for

Information Security and COBIT 5 for Risk.

In addition to gaining online access to these materials, users will be able to browse news and other ISACA articles related to

COBIT . Users will be able to post feedback within the content on which others can then remark or simply take advantage of
while browsing COBIT. This real-time exchanging of knowledge and experience will allow users to share their expertise
across all geographical and industrial borders.

Users who have purchased additional publications within the COBIT 5 product family will be able to access those publications,
or download them, in their unique instance of COBIT online. Future versions of the site will include a tool set to create an
individualized goals cascade and responsible, accountable, consulted and informed (RACI) charts for each governance and
management practice. Watch the COBIT 5 Online page of ISACAs web site for updates.

John W. Lainhart IV, CISA, CISM, CGEIT, CRISC

Is the US public sector cybersecurity and privacy service area leader for IBM Global Business Services. He is past
international president of ISACA and a member of ISACAs Framework Committee and the COBIT 5 Task Force. He has been

a member of the IT Governance Committee, where he worked on COBIT and Val IT and Risk IT initiatives.

Volume 2, April 2014 Page 7

 Come join the discussion! Joao Souza Neto, Carlos Henrique de Luca Ribeiro and Diana Santos will
respond to questions in the discussion area of the COBIT 5Use It Effectively topic
beginning 24 April 2014.

Is COBIT 5 Process Implementation a Wicked Problem?

By Joao Souza Neto, Ph.D., CGEIT, CRISC, Certified COBIT Assessor, Carlos Henrique de Luca Ribeiro,
COBIT(F), and Diana Santos
1
Some problems are so complex that you have to be highly intelligent and well informed just to be undecided about them.

Extremely complex problems such as environmental degradation, obesity, climate change, indigenous inclusion, terrorism,
poverty and religious conflicts are often called wicked problems. The concept of a wicked problem was first introduced by
Charles Churchman, but Horst Rittel and Melvin Webber, urban planners at the University of California, Berkeley (USA) first
raised the approach of social processes for solving complex problems, as opposed to the cognitive styles of professionals
2, 3
based on a Newtonian mechanistic view.

Not all problems are wicked. Wicked problems have to be differentiated from common problems or tame problems. Unlike a
wicked problem, a tame problem is one where the traditional thinking, cognitive studies and current methods of project
management indicate that the best way to tackle it is to follow a top-down processan orderly and linear approachworking
4
from the problem down to the solution. This logic is usually sufficient to achieve a feasible solution in a reasonable period of
time by collecting and analyzing data and identifying the requirements to specify the problem. Then, the manager will be able
to formulate and implement a solution. Thus, the cascade model (waterfall) is indicated for tame problems because they have
a linear solution pattern recognized in project management literature with widespread use by the software industry.

A problem may have characteristics of tame or wicked problems (figure 1), which does not mean that the award of the degree
of wickedness is binary, given that most problems have different degrees of complexities. The existence of problems spread
5
in a spectrum outlines the limits and the interval between tame and wicked problems.

Results and Discussion

6, 7, 8
The 10 characteristics of wicked problems are described and evaluated for COBIT 5 implementation in figure 1.

Figure 1Evaluation of the 10 Characteristics of Wicked Problems for COBIT 5 Implementation

Characteristics of Wicked Problems Evaluation for COBIT 5 Implementation

1. There are a large number of COBIT 5 processes have a large number of stakeholders. Figure 2 shows the
stakeholders. number of responsible, accountable or consulted stakeholders who take part in
9
every process, out of a total of 26 stakeholders listed. (The informed
stakeholders were not included because this role was considered passive.)
Besides the large number of stakeholders involved in most of the processes, the
management of stakeholders with such different backgrounds, interests, goals
and responsibilities poses a complex challenge for COBIT 5 implementation.
2. Context is constantly changing. The business and IT processes are very dynamic, demanding constant
adaptation. Frameworks, best practices and standards are useful only if they
are adopted and adapted effectively. There are challenges that must be
overcome and issues that must be addressed if governance of enterprise IT
10
(GEIT) is to be implemented successfully.
3. There are no right or wrong solutions COBIT 5 does not suggest that there exists a unique solution for GEIT problems.
to the problems. Each implementation should be tailored to the needs of the organization. If an
organization decides not to implement a particular process, this is not wrong nor
right; it is just adequate.
4. There is no consensus about the Every IT governance problem can be tackled in more than one way and this is

Volume 2, April 2014 Page 8

 solution to a problem. strongly dependent on managers experiences and backgrounds. Every
enterprise will apply its own specific plan or road map, depending, of course, on
factors such as its industry and business environment and its culture and
11
objectives.
5. Wicked problems have no stopping "The implementation and improvement programme is typically a continual and
rule. iterative one. During the last phase, new objectives and requirements will be
12
identified and a new cycle will be initiated.
6. There is no definitive formulation of a Many factors may indicate a need for new or revised GEIT practices. It is,
wicked problem. The choice of however, important to note that these symptoms may not point only to
explanation determines the nature of underlying issues that need to be addressed, but could also be indicative of
the problems resolution. other issues (or a combination of factors). For example, if business has the
perception that IT costs are unacceptably high, this may be due to governance
and/or management issues (such as the inappropriate criteria being used in the
IT investment management process), but it could also be due to a legacy of
underinvestment in IT that now manifests in significant investments being
13
required.
7. Every wicked problem is essentially "The implementation of GEIT for each enterprise will, therefore, be different and
unique and novel. the context needs to be understood and considered to design the optimal new or
14
improved GEIT environment."
8. The problem is not understood until a When a solution is implemented, it exposes new aspects of the problem,
solution has been developed. requiring adjustments of the potential solution. The problem is an ill-structured,
evolving set of interlocking issues and constraints. "The implementation and
improvement programme is typically a continual and iterative one. During the
last phase, new objectives and requirements will be identified and a new cycle
15
will be initiated. Moreover, the problem will vary; according to the interlocutor;
different stakeholders (there are many listed in COBIT 5) have different views
about what the problem is and what constitutes an acceptable solution.
16
9. Every solution to a wicked problem is One cannot build a freeway to see how it works. This is the difficulty about
a "one-shot operation"; because there wicked problems: You cant learn about the problem without trying solutions, but
is no opportunity to learn by trial and every solution you try is expensive and has lasting unintended consequences
17
error, every attempt counts that are likely to spawn new wicked problems. The same happens when IT
significantly. governance is implemented; to know the context, the company and the
stakeholders, one has to start somewhere and evolve from there.
10. Wicked problems have no given There may be no solutions, or there may be a host of potential solutions that
alternative solutions. are devised, and another host that are never even thought of. Thus, it is a matter
of creativity to devise potential solutions and a matter of judgment to determine
18
which are valid, which should be pursued and implemented. Once more,
different stakeholders have different views about what the problem is and what
constitutes an acceptable solution. Therefore, naturally, there will be a large
group of potential solutions.

Using these characteristics to study practices of IT governance at the Brazilian Federal Public Administration in the spectrum
of the wickedness of problems, it was found that the first two characteristics listed in figure 1 are particularly wicked in the IT
19
governance context.

Figure 2 shows, for each COBIT 5 process, how many stakeholders are listed either as responsible, accountable or
consulted. The numbers vary from seven to 24 stakeholders, which indicates that this is indeed a matter to be taken into
consideration.

Figure 2Number of Responsible, Accountable or Consulted (RAC) Stakeholders for COBIT 5 Processes

COBIT 5 RAC COBIT 5 RAC COBIT 5 RAC COBIT 5 RAC

Processes Stakeholders Processes Stakeholders Processes Stakeholders Processes Stakeholders
EDM01 16 APO06 17 BAI03 14 DSS03 9
EDM02 18 APO07 14 BAI04 7 DSS04 12
EDM03 15 APO08 18 BAI05 21 DSS05 11

Volume 2, April 2014 Page 9

EDM04 17 APO09 16 BAI06 13 DSS06 13
EDM05 8 APO10 15 BAI07 15 MEA01 19
APO01 24 APO11 21 BAI08 14 MEA02 18
APO02 22 APO12 15 BAI09 12 MEA03 17
APO03 18 APO13 21 BAI10 8
APO04 14 BAI01 21 DSS01 11
APO05 19 BAI02 15 DSS02 11

Conclusion
The implementation of COBIT 5 governance and management processes proved to have many characteristics of a wicked
problem. Therefore, managers in charge of the implementation should be aware that dealing with this kind of problem needs
innovative, collaborative and comprehensive solutions that take into consideration the various elements of GEIT and the
aspects related to wicked problems and social complexities.

Joao Souza Neto, Ph.D., CGEIT, CRISC, Certified COBIT Assessor

Has more than eight years of experience in IT governance, applying COBIT within Brazil Post. He is also responsible for the
IT governance research area in the Universidade Catolica de Brasilia. He is founder and educational director of the ISACA
Brasilia (Brazil) Chapter.

Carlos Henrique de Luca Ribeiro, COBIT(F)

Is advisor to the director of logistics of Brazil Post. He has extensive experience in IT governance, the implementation of
COBIT processes and supply chain management.

Diana Santos
Is chief of the information systems division at a Brazilian federal government agency related to the judiciary where she
collaborates on IT governance and the implementation of COBIT processes. She is the associate director of the ISACA
Brasilia Chapter.

Endnotes
1
Peter, Laurence J.; Peters Almanac, 1977
2
Churchman, Charles West; Wicked Problems, Management Science, USA, vol. 14, no. 4, 1967, p. 141-142
3
Rittel, Horst; Melvin Webber; Dilemmas in a General Theory of Planning, Policy Sciences, The Netherlands, vol. 4, no. 2, June 1973, p. 155-169
4
Conklin, J.; W. Weil; Wicked Problems: Naming the Pain in Organizations, Group Decision Support Systems Inc., USA, 1997, p. 1-11
5
UK Climate Impacts Programme, Attributes of Well-adapting Organisations, Environmental Change Institute, University of Oxford, UK, 2010
6
Op cit, Rittel
7
Conklin, Jeff; Dialogue Mapping: Building Shared Understanding of Wicked Problems, 1st Edition, Wiley, USA, 2006, p. 242
8
Roberts, Nancy; Wicked Problems and Network Approaches to Resolution, International Public Management Review, v. 1/1, 2000
9
ISACA, COBIT 5: Enabling Processes, USA, 2012
10
ISACA, COBIT 5 Implementation, USA, 2012, p. 10
11
Ibid., p. 11
12
Ibid., p. 18
13
Ibid., p. 21
14
Ibid., p. 13
15
Ibid., p. 18
16
Op cit, Rittel
17
Op cit, Conklin 2006
18
Ibid.
19
Ribeiro, Carlos Henrique de Luca; Prticas de Governana de TI na Administrao Pblica Federal caracterizadas no espectro da
perversidade (Wickedness) dos problemas, Universidade Catlica de Braslia, Braslia, 2012

Volume 2, April 2014 Page 10

Plans for the Future: COBIT 5 Growth Strategy
By Robert E. Stroud, CGEIT, CRISC
In 2013, the COBIT Growth Strategy Task Force identified key activities and deliverables to increase adoption and use of

COBIT 5. These activities were defined through the expertise of the task force as well as through more than 35 interviews of
current and prospective COBIT 5 users. As a result of this work, several new COBIT 5 initiatives are underway with delivery
dates in 2014 and 2015.

Projects in development include:

A benchmarking study to demonstrate the business value achieved by applying governance and management practices
defined in COBIT 5
White papers that cover how COBIT can be used with other frameworks and standards

A tool, Getting Started With IT Governance, for individuals new to COBIT 5 concepts
A goals cascade tool, which will be delivered as part of COBIT 5 online
A new COBIT 5 marketing campaign focused on how COBIT 5 can help address business problems
Guidance for executives on the benefits COBIT 5 can bring to their enterprise

Other activities have also been identified and will be shared with the COBIT 5 community as development begins. Updates

will be featured in COBIT Focus and the COBIT 5 page of the ISACA web site.

Robert E. Stroud, CGEIT, CRISC

Is the vice president of strategy and innovation at CA Technologies, the incoming international president of ISACA for 2014-
15, and a member of ISACAs Professional Influence/Advocacy Committee. Stroud spent more than 15 years in the finance
industry successfully managing multiple initiatives in both the IT and retail banking sectors related to IT service management
and process governance. He joined CA Technologies from the Australian computer security company Cybec, where he was
responsible for the companys successful global expansion, including entry into the North American market.

Come join the discussion! Shahid Ali will respond to questions in the discussion area of the COBIT
5Use It Effectively topic beginning 24 April 2014.

Strategic Planning Using COBIT 5

By Shahid Ali, Ph.D., CGEIT, CISSP, ITIL Expert, PMP, TOGAF 9 Certified
Strategic planning is an important component of strategic business management. It results in long-term planning for and future
direction of an enterprise at a strategic level. If a strategic planning exercise is done for the first time, it results in setting the
vision, mission and values for the enterprise. Strategic planning cycles can vary from three to five years and are industry-
dependent. For a set vision and mission, the goals are normally reviewed and revised from one cycle to another. Every
strategy cycle results in new or updated goals to achieve the vision of the enterprise. The strategy implementation phase
deals with the delivery of the set strategic goals. The following is a step-by-step approach to the strategic planning activity

using COBIT 5 guidelines.

The COBIT 5 framework is a comprehensive and coherent set of guidelines for the governance and management of
enterprise IT (GEIT) with insight into establishment of and alignment with strategic planning. Since the business or enterprise
strategy is different from the IT strategy, the concept of strategic alignment refers to the need for alignment between business
strategy and IT goals and processes. The COBIT 5 product family is comprised of a set of guides including the framework
guide, the enabler guides and the professional guides. Since COBIT 5 is inherently based on five core principles that include
meeting stakeholder needs, covering the enterprise end-to-end, applying a single integrated framework, enabling a holistic
approach and separating governance from management, strategic planning guidance is provided throughout the entire

Volume 2, April 2014 Page 11

framework and supporting materials to ensure that these principles are achieved. A summary of the strategic planning
guidance discussed throughout the article is provided in figure 1 with reference to the COBIT 5 product family.

Figure 1A Summary of COBIT 5 Product Family Guidance for Strategic Planning

COBIT 5 Product Family Strategic Planning Guidance

COBIT 5 framework Generic enterprise goals
Goal cascade for strategically aligning goals at all levels
Governance objectives (guidance and mapping)
IT generic goals
Mapping between IT strategic goals and enterprise strategic goals
COBIT 5 enabler guides Enabler goals
Guidance on enabler-related stakeholders, life cycle and good practices
Enabling processes for governance and management

COBIT 5 Implementation Recognizing pain points and trigger events
Stakeholder involvement
Capturing stakeholder needs
Details on Implementation life cycle phases (1-4)

COBIT 5 for Risk Understanding the associated risk in achieving the goals

The formulation of a business strategy normally

Figure 2SWOT Analysis Provides Insight for Strategic Planning
starts with techniques for providing enough and
relevant supporting material to an executive team
Helpful Harmful responsible for setting the strategy. A common
technique used is a strengths, weaknesses,
To the Enterprise To the Enterprise opportunities and threats (SWOT) analysis, as
1
illustrated in figure 2. The four entities used in this
model to evaluate a business activity are
categorized in terms of origin (internal or external)
Enterprise attributes

and usefulness (helpful or harmful) with respect to

Internal

the enterprise. The information required to make the

trengths S W
eaknesses
SWOT analysis effective can be gained by
collaborating with seasoned and long-time staff
members, reviewing relevant documents or
interviewing key stakeholders. COBIT 5 recognizes
that setting stakeholder needs depends heavily on
understanding the driving influences unique to each
enterprise and that GEIT cannot occur in a vacuum.
COBIT 5 Implementation provides detailed guidance
Environmental attributes

via recognizing pain points and trigger events as

well as an understanding of the important aspects of
External

formulating the business strategy in the Stakeholder

O T
2
Involvement section. Additionally, COBIT 5
3
pportunities hreats provides guidelines to capture stakeholder needs
and an understanding of the associated risk in
4
achieving these goals. The stakeholder needs can
be captured only by involving the stakeholders
directly. One popular approach to capture
stakeholder needs and formulate the business
Source: Adopted from Humphrey, Albert; SRI International
strategy is to arrange a strategy workshop. The
SWOT analysis results should stimulate the capturing of stakeholder needs and also challenge the applicability of stakeholder
needs during the workshop.

The COBIT 5 generic enterprise goals can provide a starting point for the strategy workshop. The IT executives should be
involved in (and, in some cases, drive) the enterprise strategic goals formulation. As participants, the IT executives should
emphasize the strategic role of IT rather than the supportive role. The IT executives should also utilize the workshop

Volume 2, April 2014 Page 12

 Figure 3COBIT 5 Goals Cascade Figure 4Governance Objective Is Value Creation

Source: ISACA, COBIT 5 , USA, 2012

opportunity to ensure that business leaders get a clear understanding

of the current IT position as well as a clear view of how IT strategies
will support the business strategies being discussed. All workshop
participants should explore the three value disciplines (customer
5
intimacy, product leadership and operational excellence) as the basis
for enterprise strategy formulation and, preferably, decide on one of
the value disciplines as the primary source of focus for the strategy.
COBIT 5 provides a goal cascade for strategically aligning goals at all
levels to stakeholder needs and governance objectives (figure 3).
The derived enterprise strategic goals should be linked to stakeholder
needs and governance objectives of value creation, namely benefits
realization, risk optimization and resource optimization (figure 4). The
mapping should clarify the type of relationshipprimary relationship
Source: ISACA, COBIT 5 , USA, 2012
(P) or secondary relationship (S)to help focus importance.
Enterprise strategic goals should
Figure 5Strategy Map Showing Interrelationships Among Goals also be developed by considering
the four balanced scorecard (BSC)
dimensions: financial, customer,
6
internal, and learning and growth.
Further, a visual strategy map
should be produced to show
interrelationships among developed
enterprise strategic goals (figure
7
5), which will allow a clear
understanding of dependencies.

Formulation of an aligned IT
strategy can also capitalize on the
SWOT analysis method. A
technology trends analysis report
can be prepared as a useful input to
IT strategy formulation. As with the
enterprise strategy workshop, a
multiday IT strategy workshop can
be arranged for formulating IT
strategy. Key considerations for an
Source: Adopted from Kaplan, Robert; David Norton; The Strategy-focused Organization, 2001

Volume 2, April 2014 Page 13

effective IT strategy workshop include careful selection of participants, grouping of the participants, objectives to be achieved
by the workshop, selection of workshop facilitators and type of interaction among groups. Therefore, careful planning and
communication are critical to making the workshop a success. Inputs into the IT strategy workshop should include a finalized
enterprise goals (BSC-
Figure 6Flowchart Showing Steps of Strategic Planning Using COBIT 5 based) work product,
an enterprise strategy
Beginning of
map, the selected
Align Enterprise
Strategic Planning Goals to Stakeholder Map IT Strategic COBIT 5 Enabler value discipline for the
Cycle Needs and Goals to Enterprise Goals enterprise, results of
Governance Goals the IT SWOT analysis,
Objectives
IT generic goals of
COBIT 5 and the
technology trends
analysis report.
Define Enterprise Create the Map IT Strategic
Create the IT
Vision, Mission and Enterprise Strategy Goals to COBIT 5 six
Values Map
Strategy Map
Enabler Goals A suggested strategic
planning process and
its relevant inputs are
summarized in the
flowchart outlined in
figure 6. The
Perform Enterprise Perform IT SWOT Finalize COBIT 5 six Develop Enabler Life enterprise strategy
SWOT Analysis Analysis Enabler Goals Cycle Plan
steps are shown in
blue, the IT strategy
steps are shown in
grey, and the inputs
are shown in yellow.
Map Enabler Goals Set guidelines for
Capture Stakeholder Arrange IT Strategy to Stakeholder selection of Good
The IT strategy
Needs Workshop Needs (an Enabler Practices for each workshop should also
Dimension) Enabler explore the three value
disciplines (customer
intimacy, product
leadership, operational
8
Ensure Governance excellence) as the
Prepare for Technology Trends Framework Setting
Analysis Report
basis for IT strategy
Enterprise Strategy and Maintenance
Workshop (EDM01) formulation. Once the
COBIT 5 Generic IT strategic goals are
Enterprise Goals and identified, they should
BSC Methodology be mapped to the
COBIT 5 Generic IT
Goals and BSC enterprise strategic
Manage the IT
Methodology
Management
goals. As discussed
Arrange Enterprise Framework (APO01) previously, the
Strategy Workshop mapping should clarify
Enterprise SWOT the type of
Analysis Report IT SWOT Analysis relationships involved:
Report primary or secondary.
Perform Phases 1 to
4 of Programme It is also recommended
Management and that a visual IT strategy
Change Enablement map be produced to
Final Enterprise
show interrelationships
Goals, Strategy Map
Value Disciplines among IT strategic
and selected Value
Discipline End of Strategic goals (figure 5).
Planning

Source: Shahid Ali

Volume 2, April 2014 Page 14

As illustrated, once the IT strategy goals are developed and mapped, it is critical to define and manage all interdependent
enablers that will help to ensure the goals are achieved. COBIT 5 provides seven enterprise enablers (figure 7). According to
COBIT 5, enablers are factors that individually and collectively influence whether GEIT will work according to plan. COBIT 5
has published guidelines for each of the enabler goals discussed. Because enablers have a direct impact on the success of
the overall goals defined, it is important to develop/finalize the enabler goals at the strategic planning level and to map them
directly to the defined IT strategic goals. Once the
Figure 7COBIT 5 Enterprise Enablers enabler goals are defined, the remaining enabler
details can be defined at a later date, but should also
conform to the enabler goals. Enabler details include
the other enabler dimensions that extend beyond the
enabler goal definition, such as stakeholder needs,
life cycle and good practices. Enabler goals should be
linked to stakeholder needs. A life cycle plan should
be developed to ensure the successful management
of the enabler through its effective life. Good
practices, which can be facilitated by the strategic
planning process, should be identified for each
enabler; however, the selection of good practices for
the enabler should be left to experts in the area of the
enabler (e.g., HR, information, technology and
application architects, process specialists, policy
makers).

COBIT 5 has a professional guide for implementation.

The guide provides details of seven phases of the
Source: ISACA, COBIT 5 , USA, 2012
implementation life cycle. The what and where
phases (1-4) of program management and change
enablement can be
Figure 8COBIT 5 Implementation Life Cycle considered at the IT
strategic planning
level (figure 8).
COBIT 5
implementation life
cycle phases to be
considered in
strategic planning
are indicated in
figure 9. The
strategic planning
note column
highlights the
relevance of the
phase to strategic
planning.

Source: ISACA, COBIT 5 , USA, 2012

Volume 2, April 2014 Page 15

 Figure 9COBIT 5 Implementation Life Cycle Phases to Be Considered in Strategic Planning

Phase Program Change Enablement Strategic Planning Note

Management (Middle Ring)
(Outer Ring)
What are the Initiate program. Establish desire to Knowing the drivers, initiating strategic planning cycle
drivers? change. and establishing the desire for improvement are critical
first steps.
Where are we Define problems Form implementation Current-state information and SWOT analysis are
now? and opportunities. team. important inputs for better strategic planning.
Where do we want Define road map. Communicate Strategic planning should result in a high-level road map.
to be? outcome.
What needs to be Plan program. Identify role players. Identifying the role players and breaking down the big
done? picture into manageable steps are crucial for successful
strategy implementation.

The COBIT 5 framework provides enhanced process reference model guidance in the COBIT 5: Enabling Processes guide
for governance and management (figure 10). In this guide, processes are further organized into groups. For governance of
enterprise IT, there is one group of five processes, namely the Evaluate, Direct and Monitor (EDM) domain. For management,
there are four groups of processes: Align, Plan and Organize (APO); Build Acquire and Implement (BAI); Deliver, Service and
Support (DSS); and Monitor, Evaluate and Assess (MEA). As with the direction discussed previously, some of these groups

Figure 10COBIT 5 Process Reference Model

Source: ISACA, COBIT 5 , USA, 2012

Volume 2, April 2014 Page 16

 and processes should be considered at the strategic planning level. The recommended processes to be considered at the
strategic planning level are those falling into the EDM and APO process areas, specifically Ensure governance framework
setting and maintenance (EDM01), Manage the IT management framework (APO01), and Manage strategy (APO02).

In future articles, follow-up discussions of additional phases of strategic planning, such as continuous strategic alignment and
implementation of strategy, will be presented from a COBIT 5 perspective.

In summary, COBIT 5 provides guidance in the establishment of enterprise strategic plans as well as IT strategic goal alignment
and implementation. The COBIT 5 goals cascade (figure 3) provides a solid foundation for IT strategic goals alignment. As is
common with setting and executing any given strategy, strategy implementation is considered more challenging than strategic
planning itself. COBIT 5 offers end-to-end guidance for strategic planning, alignment and implementation. The guidance is
systematic and well organized and is valuable for large audiences irrespective of industry type.

Shahid Ali, Ph.D., CGEIT, CISSP, ITIL Expert, PMP, TOGAF 9 Certified
Is currently an enterprise architecture consultant with 20 years of IT and strategic planning consulting experience in large
public sector organizations and the education sector. He has helped organizations in strategic planning, execution, enterprise
architecture management and strategic performance management. He has spoken at various conferences and delivered short
courses and tutorials on emerging technology topics. He is the topic leaders in the ISACA Knowledge Center Strategic
Planning/Alignment topic. Join him for more discussion on this and other topics.

Endnotes
1
Humphrey, Albert; SWOT Analysis for Management Consulting, SRI Alumni Association Newsletter, SRI International, December 2005
2
ISACA, COBIT 5 Implementation, USA, 2012
3
ISACA, COBIT 5, USA, 2012
4
ISACA, COBIT 5 for Risk, USA, 2012
5
Treacy, Michael; Fred Wiersema; The Discipline of Market Leaders, Addison-Wesley, 1993
6
Kaplan, Robert; David Norton; The Balanced Scorecard: Translating Strategy Into Action, Harvard Business School Press, 1996
7
Kaplan, Robert; David Norton; The Strategy-focused Organization: How Balanced Scorecard Companies Thrive in the New Business Environment, Harvard
Business School Press, USA, 2001
8
Op cit, Treacy

COBIT Focus is published by ISACA. Opinions Framework Committee

expressed in COBIT Focus represent the views
Steven A. Babb, CGEIT, CRISC, ITIL, UK, chair
of the authors. They may differ from policies and David Cau, ITIL, MSP, Prince2, France
official statements of ISACA and its committees, Sushil Chatterji, CGEIT, Singapore
and from opinions endorsed by authors,
Frank Cindrich, CGEIT, CIPP, CIPP/G, USA
employers or the editors of COBIT Focus.
Joanne De Vito De Palma, USA
COBIT Focus does not attest to the originality of
Jimmy Heschl, CISA, CISM, CGEIT, ITIL, Austria
authors content.
Katherine McIntosh, CISA, USA
ISACA. All rights reserved. Andre Pitkowski, CGEIT, CRISC, OCTAVE, Brazil
Paras Shah, CISA, CGEIT, CRISC, CA, Australia
Instructors are permitted to photocopy isolated
articles for noncommercial classroom use without Editorial Content
fee. For other copying, reprint or republication, Comments regarding the editorial content may be directed to
permission must be obtained in writing from the Jennifer Hajigeorgiou, senior editorial manager, at
association. Please contact Julia Fullerton at jhajigeorgiou@[Link].
jfullerton@[Link].

2014 ISACA. All rights reserved.

Volume 2, April 2014 Page 17

The author has requested enhancement of the downloaded file. All in-text references underlined in blue are linked to publications on ResearchGate.