Improving IT Governance

Transcription

1 Improving IT Governance with COBIT 5.0 About this White Paper This paper outlines the development of the next evolutionary version of ISACA s enterprise governance of IT. COBIT 5.0 is a significant evolution of the current version, COBIT 4.1. COBIT is a Registered Trade Mark of ISACA, the Information Systems Audit and Control Association. ITIL and PRINCE2 are Registered Trademarks of AXELOS.

2 TABLE OF CONTENTS Background... 3 Proposed Changes... 3 What s Next... 4 Gain an Integrated Perspective... 4 About UXC Consulting... 5 For more information contact

3 BACKGROUND It has been over 15 years since COBIT was launched and it has been improved through research and the learning through experience of its members which now numbers in excess of 95,000 internationally. In addition ISACA has developed a number of other IT governance related frameworks including Val IT, Risk IT, Business Model for Information Security (BMIS) and the IT Assurance Framework (ITAF). Whilst these frameworks have provided some excellent guidance, without a unified vision or direction they have also resulted in complexity and variation in approaches, often covering the same general material or space in the market, leading to a somewhat fragmented solution overall. PROPOSED CHANGES In general COBIT 5.0 promises to be a major strategic shift which will align with current leading thinking on enterprise governance of IT. In summary: COBIT 5.0 will be one integrated framework which will consolidate and integrate COBIT 4.1, Val IT 2.0 and Risk IT frameworks while also drawing upon the BMIS and ITAF frameworks. This will create a much more holistic view of the enterprise governance of IT. This is a step up from COBIT 4.1, which for the most part is largely concerned with the management processes of IT on the supply side. A new focus which concerns the enterprise s use of IT (the demand of IT) which at the executive and board level will feature in COBIT 5.0 and will align with ISO38500 using the three domains of Evaluate, Direct and Monitor. This recognises that most business change is now IT enabled and the investment needs to be managed as a whole. This will bring the concept of enterprise value that is central to Val IT into the core COBIT framework. New processes will be reduced to create a simpler overall model The underlying content of COBIT 5.0 will be stored in a database repository which will make it easier for users to search and find specific topic guidance, improve consistency and improve the speed of revision lead times. An Information Reference Model will be introduced, which will enable the various stakeholders to understand the dimensions of the information and what can be done with it. It will provide a platform for common understanding between a wide range of people including the business, IT, assurance and specialist groups such as security. COBIT 5.0 will extend its scope to ensure that the needs of the stakeholders both within and external to the enterprise are considered and that the organisation is acting as a good corporate citizen. This includes aspects of Green IT again providing a more holistic and integrated approach than what is currently available. 3

4 Similar to COBIT 4.1, guides will be developed for Implementing and Continually Improving IT Governance plus the IT Assurance Guide. In addition to these guides more detailed guidance is planned for the needs of specific areas e.g. Security, Risk, Value, Projects, and Service Management (ITIL ). The new process model will clarify the governance and management processes. Some consolidation and simplification of the processes is planned this is welcomed as the total number of processes across the frameworks has become too voluminous and complex. The processes associated with the Management of IT are similar to COBIT 4.1 with a four domain categorisation note that the 4.1 processes are now recognised as management processes and not governance. The governance processes are Evaluate, Direct and Manage with the three domains of Risk Governance, Value Governance and Resource Governance. This is a much more holistic and simpler overall model which reflects current leading thinking on enterprise governance for IT. Subsequent to the core publications there will be additional publications with more detailed guidance on specific content and provide more on the how. To what extent this overlaps the guidance provided by frameworks such as ITIL will remain to be seen. WHAT S NEXT The content development will take place through the remainder of 2010 and the exposure versions of the first COBIT deliverables are planned to be made available early in No further advice has been given however it seems likely that the formal release will occur no earlier than the second half of Further updates will be provided by ISACA as the project proceeds through the year. GAIN AN INTEGRATED PERSPECTIVE There are many organisations struggling to integrate the multiple frameworks being used by their teams. It is not uncommon for different senior managers within IT to be introducing ITIL, COBIT, PRINCE 2, TOGAF, VAL IT etc. all from different angles and with varying levels of success. These frameworks can all offer real value to an organisation and the benefits of each in its own right are well documented and proven, yet something more holistic from a governance perspective is often missing in the way they are implemented. COBIT will clarify the what to allow strengthening of other frameworks which define the how, such as ITIL and PRINCE2 COBIT 5.0 will make a significant contribution to organisations committed to a best practice approach to managing both the supply and demand of IT. It will clarify more of the what we should be doing as leaders in IT, and allow us to build on the strength of other frameworks such as ITIL and PRINCE2 which show us how it should be done. 4

5 ABOUT UXC CONSULTING UXC Consulting works with Australian tier one companies to provide IT intelligence to transform existing ICT service capabilities into a strategic business asset. UXC Consulting provides deep domain expertise and thought leadership across seven service pillars including: strategy and architecture; information management; business transformation; IT service management; telecommunications business consulting; enterprise communications; and project, portfolio and programme management. Setting the benchmark for industry thought leadership UXC Consulting also provides deep, specialised intelligence regarding IT game changers including cloud computing, BYO Computing and mobility. UXC Consulting is part of UXC Ltd, which is ranked by Gartner* as the largest Australian owned provider of ICT consulting services. UXC Consulting employs more than 250 staff across the country and has a commanding presence in the Australian ICT market with over 400 clients nationwide. WANT TO FIND OUT MORE? Contact UXC Consulting for more information on COBIT 5 consulting and training: info@uxcconsulting.com.au consulting * Gartner, Market Share: IT Services, Kathryn Hale, et al, March 31,