COBIT 5 provides principles for effective IT governance and management. One key principle is separating governance from management. Governance defines the direction and ensures proper oversight and accountability, while management designs, implements and monitors processes to achieve the direction set by governance. Separating these roles and responsibilities helps ensure appropriate checks and balances.

1. COBIT 5
Controlled Objects in
Business IT Environment
OVERVIEW AND KEY FEATURES

2. TRAINER PROFILE
LEO LOURDES
(MBA IT Management, BoM Hons. HRM)
Certified in ITIL IT Service Management
Certified in Coaching and Calibration Skills for Call Center
Certified in Delivering Learning / Teaching by City & Guilds, United
Kingdom
Implementer of ISO 20000-1:2011
Certified in COBIT® 5
Certified in ISO 9001 Auditor (PECB)
Certified in PRINCE2® in Project Management
Certified in ITIL® Practitioner
Certified in ITIL® Intermediate Certificate in IT Service Operation
Certified in ITIL Information Security based on ISO/IEC 27002
Certified in ITIL for Cloud Computing
leo@thinkleosolutions.com
+6016-349 1793
Experience:
Certified Trainer
Certified IT Auditor & Consultant
Head of Service Desk
Call Quality Monitoring Expert
Senior CRM Delivery Analyst
Management Representative (MR) ISO 20000-1: 2011
IT Service Management (Incident, Problem, Change) Manager
Security, Compliance & Risk Management

3. Main case study
You are the Chief Architect entrusted with setting up the IT Operations
with governance and controls to cater to ever changing business
requirements.
You are from a team of Consulting providers who work with clients and
manage their services.
Throughout the next 2 days you will use COBIT to define and implement
controls for better governance in your organization

4. Benefits of COBIT 5
 COBIT 5 helps enterprises create optimal value from IT by maintaining a
balance between realizing benefits and optimizing risk levels and resource use:
1. It is a business framework with top down view of business needs that create
goal cascade.
2. Enables IT to be governed and managed in holistic end to end manner for
entire enterprise.
3. Is generic and useful for all enterprises of any size and type.
4. Provides common language for the enterprise governance and management
of IT.
5. Is consistent with generally accepted corporate governance standards thus
help meet regulatory requirements.

5. Why COBIT 5?
1. ISACA Board of Directors direction: “Tie together and reinforce all
ISACA knowledge assets with COBIT.
2. Provide a renewed and authoritative governance and management
framework for enterprise information and related technology.
3. Integrate all major ISACA frameworks and guidance.
4. Align with other major frameworks and standards.

6. The Evolution of COBIT 5

7. COBIT 5
MAPPING SUMMARY

8. COBIT 5 Mapping Summary

9. Where does COBIT 5 fit?

10. COBIT 5
PRINCIPLES

11. COBIT 5 Principles
COBIT 5
Principles
1. Meeting
Stakeholder
Needs
4. Enabling
Holistic
Approach
5. Separating
Governance
from
Management
3. Applying a
Single
Integrated
Framework
2. Covering
Enterprise
End to End

12. Quiz 1
What are five (5) principles of COBIT 5?

13. Principle 1
MEETING STAKEHOLDER NEEDS

14. Value Creation
Benefit
Realisation
Risk Optimisation
Resource
Optimisation
Governance Objective: Value Creation
Stakeholder Needs
Drive
Enterprise exist to create value for their
stakeholder.
Value Creation: Benefit Realisation at an Optimal Resource Cost while Optimizing Risk.

15. The Need of Goal Cascade
• Enterprise have many stakeholders.
• ‘Creating Value’ has different, sometimes conflicting, meanings for each.
• Governance is about:-
• Negotiating
• Deciding among different stakeholders value interests.
• Considering all stakeholders during decision making.
• For each decision, ask:-
• For whom are the benefits?
• Who bears the risk?
• What resources required?
• Stakeholder needs must be transformed into actionable strategy.

16. COBIT 5 Goal Cascade
Stakeholder Drivers
Stakeholder Needs
Enterprise Goals
Benefit
Realisation
Risk
Optimisation
Resource
Optimisation
Governance Objective: Value Creation
Example, strategy changes, changing business, new technologies
and etc.
IT Related Goals
Enabler Goals
Influences
Cascades To
Cascades To
Cascades To
Stakeholder needs can be related to a set of generic enterprise
goals.
Achievement of enterprise goals requires a number of IT
related outcomes.
Achieving IT related goals requires the successful application and use
of enablers.

17. Internal Stakeholder Needs: Governance & Management Questions on IT

18. External Stakeholder Needs: Governance & Management
Questions on IT

19. COBIT 5 Enterprise Goal
BSC: Balance Score Card, P: Primary Relationship & S: Secondary Relationship

20. COBIT 5 IT Related Goal

21. Quiz 3
What are IT-related outcomes, required to achieve enterprise goals,
represented by?
a) IT-related goals
b) Enabler goals
c) IT balanced scorecard
d) Processes

22. Quiz 4
What are (3) key elements of governance objective that creates value to
meet stakeholder needs?

23. Principle 2
COVERING ENTERPRISE END TO END

24. Governance Approach
Benefit
Realisation
Risk Optimisation
Resource
Optimisation
Governance Objective: Value Creation
Governance
Enablers
Governance
Scope
Roles, Activities and Relationships
Key components of Governance System
Governance Enablers are
organizational resources; such
as frameworks, structures,
principles, processes and
practices. Also include
enterprise resources like
service capabilities, people
and information.
Governance Scope can
be applied to entire
enterprise, an entity,
tangible or intangible
asset.
Roles, Activities and Relationships defines who involved in the governance, how they are involved, what
they do, how they interact within the scope of the governance system.

26. Principle 3
APPLYING A SINGLE
INTEGRATED FRAMEWORK

27. Governance and Management Framework Integrator
COBIT 5:
• Aligns with latest relevant standards and frameworks thus allows enterprise use COBIT 5 as
the overarching governance and management framework integrator.
• Is complete in enterprise coverage providing a basis to integrate effectively with other
frameworks, and practices used.
• Provides simple architecture for structuring guidance materials and producing a consistent
product set.
• Integrates all knowledge previously dispersed over different ISACA frameworks (previously
known as Information Systems Audit and Control Association, now goes on with the ISACA
acronym.

28. COBIT 5 Single Integrated Framework
1. Bringing together the existing ISACA guidance (COBIT 4.1, Val IT 2.0, Risk IT,
BMIS) into this single framework.
2. Complementing this content with areas needing further elaboration and updates.
3. Aligning to other relevant standards and frameworks, such as ITIL, TOGAF and
ISO standards.
1. Populating a COBIT 5 knowledge base that contains all guidance and content
produced now and will provide a structure for additional future content.
2. Providing a sound and comprehensive reference base of good practices.
Defining a set of governance and management enablers, which
provide a structure for all guidance materials.

29. Principle 4
ENABLING HOLISTIC APPROACH

30. COBIT 5 Enablers
• Factors that individually and collectively, influence whether something will work.
• Driven by goal cascade.
• Described by the COBIT 5 framework in seven categories.
• Support a comprehensive governance and management system for enterprise of
IT.

31. The seven (7) Enablers Categories
1. Principles, Policies & Frameworks
2. Processes
3. Organizational
Structures
4. Culture, Ethic &
Behavior
5. Information
6. Services,
Infrastructures &
Applications
7. People, Skill &
Competencies
Resources

32. Quiz 5
What are the seven (7) key Enablers categories of COBIT 5?

33. Enablers Dimensions and Performance Management

34. COBIT 5 Enablers Dimensions
All enablers have a set of common dimensions. This set of common dimensions
1. Provides a common, simple and structured way to deal with enablers
2. Allows an entity (enablers) to manage its complex interactions
3. Facilitates successful outcomes of the enablers

35. Dimensions 1: Stakeholders
1. Each enabler has stakeholders (parties who play an active role and/or have an
interest in the enabler).
2. For example, processes have different parties who execute process activities
and/or who have an interest in the process outcomes.
3. Stakeholders can be internal or external to the enterprise, all having their
own, sometimes conflicting, interests and needs.
4. Stakeholders’ needs translate to enterprise goals, which in turn translate to IT-
related goals for the enterprise. (COBIT 5 Goal Cascade)

36. Dimensions 2: Goals
1. Each enabler has a number of goals, and enablers provide value by the
achievement of these goals.
2. Goals can be defined in terms of:
 Expected outcomes of the enabler
 Application or operation of the enabler itself
3. The enabler goals are the final step in the COBIT 5 goals cascade.

37. Dimensions 2: Goals Characteristics
A. Intrinsic quality:
 The extent to which enablers work accurately, objectively and provide
reputable results.
B. Contextual quality:
 The extent to which enablers and their outcomes are fit for purpose,
relevant, complete, current, appropriate, consistent, understandable
and easy to use.
C. Access and security:
 The extent to which enablers and their outcomes are accessible and
secured.

38. Dimensions 3: Lifecycle
1.Each enabler has a life cycle, from inception through an operational/useful life
until disposal.
2.The phases of the life cycle consist of:
• Plan (includes concepts development and concepts selection)
• Design
• Build/acquire/create/implement
• Use/operate
• Evaluate/monitor
• Update/dispose

39. Dimensions 4: Good Practices
1.For each of the enablers, good practices can be defined.
2.Good practices support the achievement of the enabler goals.
3.Good practices provide examples or suggestions on how best to implement the
enabler, and what work products or inputs and outputs are required.

40. COBIT 5 Enabler Performance Management
1. Enterprises expect positive outcomes from the application and use of enablers.
2. Lag indicators (Achievement of Goals)
- What extent the goals are achieved?
• Are stakeholder needs addressed?
• Are enabler goals achieved?
3. Lead indicators (Application of Practice)
- Actual functioning of the enabler itself.
• Is the enabler life cycle managed?
• Are good practices applied?

41. Principle 5
SEPARATING GOVERNANCE
FROM MANAGEMENT

42. Governance and Management Defined
Governance ensures stakeholders needs, conditions and options are:
• Evaluated to determine balanced, agreed-on enterprise objectives to be achieved.
• Setting direction through prioritization and decision making.
• Monitoring performance and compliance against agreed-on direction and objectives.
Management plans, builds, runs and monitors activities in alignment with the direction set by
the governance body to achieve the enterprise objectives. (PBRM)

43. Governance and Management
Note: Detailed informations on above diagram will be explained in next slides onwards.

44. COBIT 5
PROCESS REFERENCE MODEL

45. COBIT 5: Process Reference Model
1. Details of 37 processes across five domains.
2. Governance: One domain (EDM) with 5 processes aligned with key process
area of (practice defined) - evaluating, directing and monitoring (EDM).
3. Management: Four domains with 32 processes aligned with key process area of
(responsibility areas) - plan, build, run & monitor (PBRM):-
 Plan: APO (Align, Plan & Organize) -> 13 processes
 Build: BAI (Build, Acquire & Implement) -> 10 processes
 Run: DSS (Deliver, Service & Support) -> 6 processes
 Monitor: MEA (Monitor, Evaluate & Assess) -> 3 processes

46. Governance and Management: Key Process Areas & Domains

47. COBIT 5: Process Reference Model

48. Quiz 6
In Process Reference Model, what does EDM key process area stands for Governance?
a) Plan, Organize & Align
b) Evaluate, Design & Measure
c) Evaluate, Direct & Monitor
d) Build, Acquire & Implement

49. Quiz 7
In Process Reference Model, what does DSS domain stands for Management?
a) Plan, Organize & Align
b) Deliver, Service & Support
c) Evaluate, Direct & Monitor
d) Build, Acquire & Implement

50. Quiz 8
In Process Reference Model, what does MEA domain stands for Management?
a) Plan, Organize & Align
b) Deliver, Service & Support
c) Monitor, Evaluate & Assess
d) Build, Acquire & Implement

51. Quiz 9
In Process Reference Model, how many processes are aligned to (Build,
Acquire & Implement) BAI domain in Management?
a) 6 processes
b) 10 processes
c) 13 processes
d) 60 processes

52. Quiz 10
In Process Reference Model, what does PBRM key process area stands
for Management?

58. Process Reference Model: Mapping to Current ISO/IEC 20000 Process
Domains COBIT 5 Process Current ISO/IEC 20000 Process
Align, Plan & Organize
(APO)
APO06 Manage Budget & Costs IT Financial Management
APO08 Management Relationships Business Relationship Management
APO09 Manage Service Agreements Service Level Management
APO10 Manage Suppliers Vendor Management
APO11 Manage Quality Quality Management System
APO13 Manage Security Information Security Management

59. Process Reference Model: Mapping to Current ISO/IEC 20000 Process
Domains COBIT 5 Process Current ISO/IEC 20000 Process
Build, Acquire &
Implement (BAI)
BAI04 Manage Availability &
Capacity
Availability Management
Capacity Management
BAI06 Manage Changes Change Management
BAI07 Manage Change Acceptance
and Transitioning
Release & Deployment Management
BAI10 Manage Configuration Configuration Management

60. Process Reference Model: Mapping to Current ISO/IEC 20000 Process
Domains COBIT 5 Process Current ISO/IEC 20000 Process
Deliver, Support &
Service (DSS)
DSS02 Manage Service Requests &
Incidents
Incident & Service Request Management
DSS03 Manage Problems Problem Management
DSS04 Manage Continuity IT Service & Continuity Management

61. Process Reference Model: Mapping to Current ISO/IEC 20000 Process
Domains COBIT 5 Process Current ISO/IEC 20000 Process
Monitor, Evaluate and
Assess (MEA)
MEA01 Monitor, Evaluate and
Assess Performance and
Conformance
Service Reporting
MEA02 Monitor, Evaluate and
Assess the System of Internal
Control
Internal Audit
MEA03 Monitor, Evaluate and
Assess Compliance With External
Requirements
Legal, Regulatory, and Contractual
Requirements

62. COBIT 5
LIFE CYCLE APPROACH

63. COBIT 5: Life Cycle Approach

64. COBIT 5
PROCESS CAPABILITY MODEL

65. COBIT 5: Process Capability Model

66. COBIT 5: Process Capability Model

67. Slides Reference Source
This slides content is aligned to the ISACA COBIT V5 2012.

68. Thank You