1. Transforming Enterprise IT
Ref:

2. IT Governance Is the Key Issue
Enterprises are giving money, productivity and competitive advantage by not implementing effective IT governance
A better way to:
Direct IT for optimal advantage
Measure the value provided by IT
Manage IT-related risks
IT governance goes a long way towards bridging the gap between corporate expectations and perceptions of the IT function. The need for top management direction and oversight regarding the value of IT and the management of IT-related risks are now understood as key elements of governance. Value, risk and control constitute the core of IT governance.
IT governance consists of the leadership, organisational structures and processes that ensure that the enterprise’s IT sustains and extends the enterprise’s strategies and objectives.
Governance is not the sole responsibility of the CIO; it is the responsibility of an enterprise’s top executives and board of directors. Successful enterprises understand the risks and exploit the benefits of IT and find ways to deal with:
• Aligning IT strategy with the business strategy
• Ensuring investors and stakeholders that a ‘standard of due care’ around mitigating IT
risks is being met by the enterprise
• Providing organisational structures that facilitate the implementation of strategy and
goals
• Measuring IT’s performance
These are the benefits of sound IT governance.

3. IT Governance
The purpose of IT governance is to direct IT endeavors, to ensure that IT’s performance meets the following objectives:
• Alignment of IT with the enterprise and realisation of the promised benefits
• Use of IT to enable the enterprise by exploiting opportunities and maximising benefits
• Responsible use of IT resources
• Appropriate management of IT-related risks

4. Focus Areas of IT Governance

5. Why do we need a Framework?
Increasing dependence on information and the systems that deliver this information
Increasing vulnerabilities and a wide spectrum of threats, such as cyberthreats and information warfare
Scale and cost of the current and future investments in information and information systems
The need to comply with regulations
The potential for technologies to dramatically change organisations and business practices, create new opportunities and reduce costs
Recognition by many organisations of the potential benefits that technology can yield

6. Who Needs a Framework?
Board and Executive
To ensure management follows and implements the strategic direction for IT
Management
To make IT investment decisions
To balance risk and control investment
To benchmark existing and future IT environment
Users
To obtain assurance on security and control of products and services they acquire internally or externally
Auditors
To substantiate opinions to management on internal controls
To advise on what minimum controls are necessary

7. COBIT
Control Objectives for Information and related Technology (COBIT) is a set of best practices (framework) for IT management created by the Information systems audit and control association (ISACA),
Incorporates major international standards
Has become the de facto standard for overall control over IT
Starts from business requirements
Is process-oriented

8. COBIT: Basics?
Starts from the premise that IT needs to deliver the information that the enterprise needs to achieve its objectives
Promotes process focus and process ownership
Divides IT into 34 processes belonging to four domains and provides a high-level control objective for each
Considers fiduciary, quality and security needs of enterprises, providing seven information criteria that can be used to generically define what the business requires from IT
Is supported by a set of over 300 detailed control objectives
Plan and Organise
Acquire and Implement
Deliver and Support
Monitor and Evaluate
Effectiveness
Efficiency
Availability
Integrity
Confidentiality
Reliability
Compliance

9. Overview of CobiT Then what is CobiT?
It is the Control Objectives for Information and related Technology
A methodology consisting of standards and controls created to assist IT professionals in the implementation, review, administration and monitoring of an IT environment.
The CobiT Executive Summary and Framework were released in December 1995, Control Objectives in April 1996, and Audit Guidelines followed in September 1996.
A tool that for IT professionals that has linked information technology and control practices
CobiT consolidates and harmonizes standards from prominent global sources into a critical resource for management, control professionals and auditors.

10. Overview of CobiT CobiT represents
A control framework,
a set of generally accepted control objectives, and
the CobiT Audit Guidelines.
CobiT is based on the philosophy that IT resources need to be managed by a set of naturally grouped processes in order to provide the pertinent and reliable information an organization needs to achieve its objectives.
CobiT is business process oriented provides the business process owners with a framework, which should enable them to control all the different activities underlying IT deployment.

11. Overview of CobiT What is the purpose of CobiT?
To provide management and business process owners with an Information Technology (IT) governance model that helps in understanding and managing the risks associated with IT.
CobiT helps bridge the gaps between business risks, control needs and technical issues by presenting the controls through one vehicle.
It is a control model to meet the needs of IT governance and ensure the integrity of information and information systems.

12. Components of CobiT

13. PLANNING & ORGANIZATION (PO) ACQUISITION & IMPLEMENTATION (AI)
Components of CobiT
The 4 Domains of CobiT
MONITORING (MO)
PLANNING & ORGANIZATION (PO)
ACQUISITION & IMPLEMENTATION (AI)
DELIVERY & SUPPORT (DS)

14. MONITORING (MO) Components of CobiT
All IT processes need to be regularly assessed over time for their quality and compliance with control and regulatory requirements
Auditors need to perform procedures to ensure that the IT environment meets predefined standards with respect to controls.
M1- Monitor the process
M2- Obtain independent assurance

15. PLANNING & ORGANIZATION (PO)
Components of CobiT
PLANNING & ORGANIZATION (PO)
Addresses strategy and tactics, and concerns the identification of the way information technology can best contribute to the achievement of business objectives.
Is the IT strategy be effectively controlled and will it contribute to the business objectives?
PO1- Define a strategic IT plan
PO2- Define the Information architecture
PO3- Determine technical direction
PO4- Define IT Organization and relationships
PO5- Manage the investment in IT
PO6- Communicate management aims and directions
PO7- Manage Human Resources
PO8- Ensure compliance with external requirements
PO9- Assess risks
PO10- Manage projects
PO11- Manage quality

16. ACQUISITION & IMPLEMENTATION (AI)
Components of CobiT
ACQUISITION & IMPLEMENTATION (AI)
To realize the IT strategy, IT solutions need to be identified, developed and/or acquired as well as implemented and integrated into the business process.
Is the process to choose and implement IT solutions a controlled process? Does this process meet control standards?
AI1- Identify solutions
AI2- Acquire and maintain application software
AI3- Acquire and maintain technology architecture
AI4- Develop and maintain IT procedures
AI5- Install and accredit systems
AI6- Managing changes

17. DELIVERY & SUPPORT (DS)
Components of CobiT
DELIVERY & SUPPORT (DS)
Addresses the actual delivery of required information services.
Are information related services delivered in a controlled manner?
DS8- Assist and advise IT customers
DS9- Manage the configuration of IT systems
DS10- Manage problems and incidents
DS11- Manage data
DS12- Manage facilities
DS13- Manage operations
DS1- Define service levels
DS2- Manage Third Party services
DS3- Manage performance capacity
DS4- Ensure continuous service
DS5- Ensure systems security
DS6- Identify and allocate costs
DS7- Educate and train users

18. COBIT is a Road Map for an easy IT Governance
Accepted globally as a set of tools that ensures IT is working effectively
Functions as an overarching framework
Provides common language to communicate goals, objectives and expected results to all stakeholders
Based on, and integrates, industry standards and good practices in:
Strategic alignment of IT with business goals
Value delivery of services and new projects
Risk management
Resource management
Performance measurement
The COBIT mission is to research, continually update, publicise and promote an authoritative, internationally accepted IT governance control framework for adoption by enterprises and day-to-day use by business managers, IT professionals and assurance professionals. Now in its 4.1 release, the framework has been used successfully by IT organisations and business executives in many industries and of many sizes. COBIT provides a common language to communicate goals, objectives and expected results. A common language benefits all levels of IT, including management and stakeholders.

19. Business Benefits
COBIT® provides guidance for executive management to govern IT within the enterprise
More effective tools for IT to support business goals
More transparent and predictable full life-cycle IT costs
More timely and reliable information from IT
Higher quality IT services and more successful projects
More effective management of IT-related risks
COBIT delivers significant benefits in areas that are fundamental to every enterprise: value, risk and control.
Implementing COBIT also provides:
Clearer security and privacy requirements, and more easily monitored
implementation
More efficient and successful audits
IT compliance with regulatory requirements will become a normal
management practice

20. Harmonizing the Elements of IT Governance
Resource Management
Strategic Alignment
Value Delivery
Performance Measurement
Risk Management
COBIT is based on the analysis and harmonisation of existing IT standards and good practices and conforms to generally accepted governance principles. It is positioned at a high level, driven by business requirements, covers the full range of IT activities, and concentrates on what should be achieved rather than how to achieve effective governance, management and control. Therefore, it appeals to executive management; business and IT management; governance, assurance and security professionals; and IT audit and control professionals.
• Strategic alignment focuses on ensuring the linkage of business and IT plans; defining, maintaining and validating the IT value proposition; and aligning IT operations with enterprise operations.
• Value delivery is about executing the value proposition throughout the delivery cycle, ensuring that IT delivers the promised benefits against the strategy, concentrating on optimising costs and proving the intrinsic value of IT.
• Risk management requires risk awareness by senior corporate officers, a clear understanding of the enterprise’s appetite for risk, understanding of compliance requirements, transparency about the significant risks to the enterprise and embedding of risk management responsibilities into the enterprise.
• Resource management is about the optimal investment in, and the proper management of, critical IT resources: applications, information, infrastructure and people. Key issues relate to the optimisation of knowledge and infrastructure.
• Performance measurement tracks and monitors strategy implementation, project completion, resource usage, process performance and service delivery, using, for example, balanced scorecards that translate strategy into action to achieve goals measurable beyond conventional accounting.

21. The COBIT® Framework
Let’s take a closer look at the COBIT framework. COBIT defines IT activities in a generic process model within four domains along with a set of information criteria. The four domains are: Plan and Organise, Acquire and Implement, Deliver and Support, and Monitor and Evaluate. The domains map to IT’s traditional responsibility areas of plan, build, run and monitor. The COBIT framework provides a reference process model and common language for everyone in an enterprise to view and manage IT activities. Incorporating an operational model and a common language for all parts of the business involved in IT is one of the most important and initial steps towards good governance. It also provides a framework for measuring and monitoring IT performance, communicating with service providers and integrating best management practices. A process model encourages process ownership, enabling responsibilities and accountability to be defined.
• Plan and Organise (PO)—Provides direction to solution delivery (AI) and service
delivery (DS) (example controls: Define Strategic IT Plan, Manage Quality)
• Acquire and Implement (AI)—Provides the solutions and passes them to be turned
into services (example controls: Identify Automated Solutions, Manage Changes)
• Deliver and Support (DS)—Receives the solutions and makes them usable for end
users (example controls: Define and Manage Service Levels, Identify and Allocate Costs
• Monitor and Evaluate (ME)—Monitors all processes to ensure that the direction
provided is followed (example controls: Ensure Regulatory Compliance, Monitor and
Evaluate IT Performance)

22. The high-level approach diagram of information system audits
Approch
Ref-

23. Operationalising CMMI: integrating CMMI and CoBIT perspective
Ref-

24. The COBIT model groups all information and IT activities into four domains, which are articulated into 34 processes
Ref:

25. Ref:

26. COBIT® Defines Processes, Goals and Metrics
Relationship Amongst Process, Goals and Metrics (DS5)
The chart illustrates the relationship between the business, IT, process and activity goals, and the different metrics. From top left to top right, the goals cascade is illustrated. Below the goal is the outcome measure for the goal. The small arrow indicates that the same metric is a performance indicator for the higher-level goal.
The example provided is from DS5 Ensure systems security. COBIT provides metrics only up to the IT goals outcome as delineated by the dotted line. While they are also performance indicators for the business goals for IT, COBIT does not provide business goal outcome measures.
The metrics have been developed with the following characteristics in mind:
• A high insight-to-effort ratio (i.e., insight into performance and the
achievement of goals as compared to the effort to capture them)
• Comparable internally (e.g., percent against a base or numbers over time)
• Comparable externally irrespective of enterprise size or industry
• Better to have a few good metrics (may even be one very good one
that could be influenced by different means) than a longer list of
lower-quality metrics
• Easy to measure, not to be confused with targets

27. Defined Responsibilities for Each Process
RACI Chart
A RACI chart identifies who is Responsible, Accountable, Consulted and/or Informed.
Functions
Activities
Link business goals to IT goals. C I
A/R
Identify critical dependencies and current performance. R
Build an IT strategic plan. A
Build IT tactical plans.
Analyse programme portfolios and manage project and service portfolios.
COBIT also provides information on what processes should be delegated and to whom they should be delegated. This helps to ensure that IT processes are being managed at the appropriate level within an enterprise. The ‘RACI’ Chart is defined for each process and indicates who is responsible, accountable, consulted or should be informed about specific tasks within a given process.
The roles in the RACI chart are categorised for all processes as:
• Chief executive officer (CEO)
• Chief financial officer (CFO)
• Business executives
• Chief information officer (CIO)
• Business process owner
• Head operations
• Chief architect
• Head development
• Head IT administration (for large enterprises, the head of functions such
as human resources, budgeting and internal control)
• The project management officer (PMO) or function
• Compliance, audit, risk and security (groups with control responsibilities
but not operational IT responsibilities)

28. COBIT® Products and Their Primary Audience
COBIT products have been organised into three levels designed to support:
• Executive management and boards
• Business and IT management
• Governance, assurance, control and security professionals
This COBIT-based product diagram presents the generally applicable products and their primary audience. There are also derived products for specific purposes (IT Control Objectives for Sarbanes-Oxley, 2nd Edition), for domains such as security (COBIT® Security Baseline and Information Security Governance: Guidance for Boards of Directors and Executive Management), or for specific enterprises (COBIT® Quickstart for small and medium-sized enterprises or for large enterprises wishing to ramp up to a more extensive IT governance implementation).
COBIT, Risk IT and Val IT frameworks
Implementing and Continually Improving IT Governance
COBIT User Guide for Service Managers
COBIT and
Application Controls

29. IT Governance Focus Areas
Ref:

30. ... IT Governance Focus Areas
Strategic alignment focuses on ensuring the linkage of business and IT plans; defining, maintaining and validating the IT value proposition; and aligning IT operations with enterprise operations.
• Value delivery is about executing the value proposition throughout the delivery cycle, ensuring that IT delivers the promised benefits against the strategy, concentrating on optimising costs and proving the intrinsic value of IT.
• Resource management is about the optimal investment in, and the proper management of,
critical IT resources: applications, information, infrastructure and people. Key issues relate to
the optimisation of knowledge and infrastructure.
• Risk management requires risk awareness by senior corporate officers, a clear understanding of the enterprise’s appetite for risk, understanding of compliance requirements, transparency about the significant risks to the enterprise and embedding of risk management responsibilities into the organisation.
• Performance measurement tracks and monitors strategy implementation, project completion, resource usage, process performance and service delivery, using, for example, balanced scorecards that translate strategy into action to achieve goals measurable beyond conventional accounting.

31. Management statement on IT Governance
“IT governance is the responsibility of Telco’s executives to install a system of management control that ensures that Telco’s business objectives are achieved through end-to-end processes, quality of information and the supportive IT. This consists in our opinion of directing Telco’s IT resources towards optimal performance aiming for: - IT to be aligned with the business and the business processes; - IT resources to be used in a controlled structure; - IT risks to be assessed and to be managed appropriately.” 
“Further formalisation of goal setting and performance
monitoring of the overall IT program could
be enforced by regular internal audits.”

32. Forces influencing IT Governance IT Governance Institute Erik Guldentops
Value
(Brookings Institute)
85% of market value of enterprises is intangible (knowledge, information, capability…)
Institutional investors willing to pay up to 20% premium for shares of enterprises that have governance framework IT
Governance
Trust
(McKinsey)
Assurance
(Turnbull)
Regulations establishing responsibility of enterprise officers for internal control and risk transparency.
Trust can vanish overnight. A factory cannot.
Survival
(Alan Greenspan)

33. IT Governance Lifecycle
IT Governance Institute approach
IT governance, like other governance subjects, is the responsibility of executives and shareholders (represented by the board of directors). It consists of the leadership and organisational structures and processes that ensure that the organisation’s IT sustains and extends the organisation’s strategies and objectives.
Definition
Provide Direction
Compare
Measure Performance
IT Activities
Increase automation (make the business
effective)
Decrease cost
(make the enterprise efficient)
Manage risks
(security, reliability and compliance)
IT is aligned with the
business, enables the
business and
maximises benefits
IT resources are used
responsibly
IT related risks are
managed appropriately
Set Objectives
Framework
IT Governance Lifecycle
Environment
Ethics & Culture
Laws & Regulations
Mission & Vision
Role Models
Industry Practices
…...
Alignment
Delivery
Value
Management
of Risk
Monitoring &
Reporting
Evaluation
Lifecycle

34. Ex-Organisatie Telco RvB Corporate staf Division Fixed Division Mobile
IT Operators
IT partners

35. IT Governance framework
DIO focus
CIO focus
Business
Information
Systems
Information
Technology
Strategy
Structure
product, process,
organisation
use of information
and transport
IT products, security
IT management
Implementation
Business Alignment
Demand Management

36. Expertise in IT Governance
Information
Systems
Information
Technology
Business
Compliance
management
Sourcing
Information
Economics
Strategy
Third Party
Assurance
Information
architecture
Management
of change
Structure
User/Application
controls
Security/
Operations
IT Service
Management
Implementation
Business Alignment
Demand Management

37. IT Governance is ...... IT management
Business orientatie
Extern IT
Governance
IT Control IT
Management
Intern
Tijds dimensie
Heden
Toekomst
Ontleend aan IT Governance mechanismen: Wim van Grembergen en Steven de Haes, Kluwer 2004

38. Visit www.isaca.org/cobit to download the COBIT® framework
Getting Started
Visit to download the COBIT® framework
If you would like to learn more, or are interested in taking the first steps, you will find that our web site has a wealth of material.
The site offers not only a PDF version of COBIT you can download free of charge, it also offers archived Webcasts, case studies, access to the online discussion forum, and information on COBIT training.

39. TOM detail: Spider Diagrams
Customer
Customer
INPUTS
OUTPUTS
Customer
Interface
Man.
Customer
Interface
Man.
Notifications Trouble Reports,
Status reports
Trouble reports
Order
Handling
Major Trouble
Reports
Problem Handling
Sales
QoS & SLA terms,
Profiles
- Receive trouble notif
- Determine cause &resolve
Request to
re-configure
Service
Configuration
- Track progress of resolution
Service
Configuration
Completion notification
- Initiate action to reconfigure
- Generate TT to suppliers
Other
Provider(s)
- Confirm trouble cleared
Trouble report
Other
Provider(s)
Trouble report,
Trouble cleared
- Notify cust. trouble cleared
- Schedule with and notify
customer of planned work
Problem
reports
Service
Problem
Resolution
Trouble report,
Trouble cleared
Customer
QoS
Man.
Trouble report*
SLA violations, Planned mtc.
scheduling and notification
Customer
QoS
Man.
SLA/QoS violations,
Trouble reports
Service
Problem
Resolution
QoS Violations
Service
Quality
Man.
Rating &
Discounting

40. Governance - architectuur
1. Domains:
2. Governance structure :
Company wide steering committee; chair RvB member
Board responsibilities like wise (Fixed, Mobile, CFO)
Clear domain accountability (domain manager)
Linkage to business via sponsor, steer by domain management:
3. Roles /responsibilities in conformance with baseline document:
Domain manager (reporting to DIO), DIO & CIO
Program office per division chaired by DIO
Architectural board chaired by CIO (with participation of division)
fixed
mobile
corporate
Sales
Fulfillment
Billing
Sales
Fulfillment
Billing
Sales
Fulfillment
Billing
Enterprise mgmt.
Enterprise mgmt.
Enterprise mgmt.
Service Backbone
Service Backbone
Service Backbone
Marketing
Operations
Purchasing
Marketing
Operations
Purchasing
Marketing
Operations
Purchasing
business
sponsor (MT member)
working mode
domain mngr
operational mngt

41. Different Levels of IT Control
Strategic
Core
Possible Outsourcing
Tactic
Operational

42. Clear governance relationships
Business view
Technology view
Business strategy
Processes
Domains/services
Applications
Technology
Strategic aspiration
Business plan
Value proposition
Going-to-market model
Business processes
Business rules
Domain structure
Functional architecture
Data architecture
Domain services
Governance model
Application programs and modules
Databases
Connectivity
Hardware, opera-ting systems, net-works
Middleware, data-base management systems
Business
IT Demand
(CIO/DIO)
IT Supply
(IT Service organizations)

43. Demand Management Organization Supply IT Axioms
Portfolio - Target architecture
Purchasing
Contract standards
Preferred Suppliers - Legal guidelines
Operations
Software maintenance/ supply
Infrastructure
Business
Functional requirements
Usage
Money
Demand Mngt
- “Broker”
- Functional characteristics
- Quality Assurance
- Maintenance documentation
Selection functionality
Implementation/Control SLA

44. Business alignment demand supply
Example:Telco adoption of CobiT Framework
BUSINESS
PROCESSES
INFORMATION
effectiveness
efficiency
confidenciality
integrity
availability
compliance
reliability
Criteria
COBIT IT
RESOURCES
data
aplication systems
technology
facilities
people
PLANNING AND
ORGANISATION
AQUISITION AND
IMPLEMENTATION
DELIVERY AND SUPPORT
MONITORING
Business alignment
In order to provide the information that the organization needs to achieve its objectives, IT resources need to be managed by a set of naturally grouped processes.
demand
supply

45. Gartner Advisory on CobiT and ITIL
Activities
BS7799
Security
CobiT
Control
WHAT
HOW
Ref: itgi.org,

46. Ex-IT Control Framework
CobiT
Supply
Demand
Key Control Objectives
Manage Changes
Manage IT-configurations
Manage IT incidents and problems
Manage Security
Manage Service levels
Manage Business Continuity
Manage IT Costs
Manage Business Information Planning
Manage Releases (Project Management)
Manage IT Sourcing
ITIL
Processes
Plus