Marrying COBIT and ITIL for Effective Governance. April 2008 Harpreet Virdee Partner, The Manta Group

Transcription

1 1

2 Marrying COBIT and ITIL for Effective Governance April 2008 Harpreet Virdee Partner, The Manta Group 2

3 Marrying COBIT and ITIL for Effective Governance Welcome! Objective: Provide an appreciation of why and how Governance (COBIT 4.1) initiatives and ITSM (ITIL v2/v3, ISO20000) can make a happy marriage. 3

4 Agenda Context: How do COBIT 4.1 and ITSM (ITIL v2 and ITIL v3) frameworks align? Why: Why align Governance and ITSM initiatives? How: A practical approach in using COBIT and ITIL together. 4

5 Context..How do the frameworks align? Governance: COBIT 4.1, Val IT ment: ITIL v2, ITIL v3, ISO

6 Evolution of Governance Practices IT Function Value Governance COBIT 4.1 and Val IT Focus: IT as a partner: Enable Value and Compliance Controls and Processes Business & IT Alignment Value Governance COBIT 4.0 Focus: Governance Governance Controls & Process Business Risk Oriented Goals Audit Controls based Auditors tool: Controls COBIT 3.0 Focus: Control Environment Control Framework Risk ment Time 6

7 Val IT = Investment Strategy & Value Val IT Approach: Enterprise Value, Governance of IT Investments Strategic Investment Affordable Cost Acceptable Risk Returns Value Are we doing the right things? Are we getting the benefits? Value Realization Accountability Processes Track Record Enterprise Architecture Integration Performance Change Risk Are we doing them the right way? Are we getting them done well? Delivery Capabilities Processes People Technology COBIT = Supports Execution 7

8 CobiT 4.1 Overview 1 Planning & Organization Are Business and IT strategy aligned? Is business achieving optimum use of its IT resources? Does everyone in business understand IT objectives? Are IT risks understood and being managed? Are the quality of IT systems and services appropriate for business needs? 2 Acquire & Implement Are projects likely to deliver solutions that meet business needs? Are projects likely to deliver on time and within budget? Will the new or revised systems work properly when implemented? Will changes be made without upsetting current business operations? 4 Monitor Can IT performance be measured? Can problems be detected before it is too late? Is independent assurance needed to ensure critical areas are operating as intended? 3 Delivery & Support Are IT services being delivered in line with business priorities? Are IT costs optimised? Is the work force able to use IT systems productively? Are adequate performance requirements such as security, integrity and availability in place? 8

9 CobiT 4.1 Overview 1 Plan & Organize 2 Acquire & Implement PO 1 Define Strategic IT Plan PO 2 Define Information Architecture PO 3 Determine Technological Direction PO 4 Define IT Processes, Organisation, Relationships PO 5 IT Investment AI 1 Identify Automated Solutions AI 2 Acquire and Maintain Application Software AI 3 Acquire and Maintain Technology Infrastructure AI 4 Enable Operation & Use PO 6 Communicate Aims and Direction PO 7 IT Human Resource PO 8 Quality PO 9 Assess & IT Risks PO 10 Projects AI 5 Procure IT Resources AI 6 Change AI 7 Install and Accredit Solutions & Changes 4 Monitor & Evaluate 3 Deliver & Support ME 1 Monitor & Evaluate IT Performance ME 2 Monitor & Evaluate Internal Control DS 1 Define and Levels DS 2 Third-party s DS 3 Performance and Capacity DS 4 Ensure Continuous DS 5 Ensure System Security DS 6 Identify and Allocate Costs ME 3 Ensure Regulatory Compliance ME 4 Provide IT Governance DS 7 Educate and Train Users DS 8 Desk & Incident DS 9 Configuration DS 10 Problems DS 11 Data DS 12 Physical Environment DS 13 Operations 9

10 IT Function Strategic Partner Evolution of ment ment Practices ITIL V3 Focus: IT alignment & integration. Value Chain Complete lifecycle for solutions Integrate with the business Partner IT ment ITIL V2 Focus: Optimization Process Centric Production Oriented Optimal Levels of at Justifiable Costs Basis for ISO20000 Technology Provider IT Infrastructure ment ITIL V1 Focus: Common Approach Common Language and Approach Align disparate work practices Define a standard approach Continuous Work in Progress (40+ Books) Time 10

11 ITIL V2 Overview Change ment Release ment IT Continuity ment Availability ment IT Financial ment Configuration ment ITIL Capacity ment Level ment Processes Security ment Desk Incident ment Problem ment Application ment Infrastructure ment 11

12 ITIL V3 Overview 1 Strategy 2 Design 3 Transition 3 Operations SS1 Strategy Generation SS2 Financial ment SS3 Demand ment SS4 Portfolio ment SD1 Catalogue ment SD3 Capacity ment SD4 Availability ment SD6 Information Security ment SD2 Level ment SD5 IT Continuity ment SD7 Supplier ment ST1 Transition & Planning Support ST3 Asset & Configuration ment ST5 Validation & Testing ST7 Knowledge ment ST2 Change ment ST4 Release & Deployment ment ST6 Evaluation SO1 Event ment SO2 Incident ment SO3 Request Fulfilment SO4 Problem ment SO5 Asset ment 5 Continual Improvement CSI1 7-Step Improvement Process CSI2 Measurement CSI3 Reporting 12

13 Governance Big Picture COBIT 4.1 Governance: Value, Risk & Compliance 13

14 All ITIL v2 Processes are addressed by CobiT 4.1 AI 6 Change AI 7 Install and Accredit Solutions & Changes DS 4 Ensure Continuous PO 5 IT Investment DS 6 Identify and Allocate Costs DS 9 Configuration DS 1 Define and Levels Change ment Configuration ment Level ment Desk Release ment Incident ment IT Continuity ment ITIL Processes Problem ment Availability ment Application ment IT Financial ment Capacity ment Security ment Infrastructure ment DS 3 Performance and Capacity DS 5 Ensure System Security DS 8 Desk & Incident DS 10 Problems AI 2 Acquire and Maintain Application Software AI 3 Acquire and Maintain Technology Infrastructure 14

15 CobiT 75% of ITIL V3 processes map to CobiT 4.1 ITIL V3 Operations DS 8 Desk & Incident SO1 Event ment DS 10 Problems DS 7 Educate and Train Users DS 11 Data DS 12 Physical Environment DS 13 Operations SO2 Incident ment SO3 Request Fulfilment SO4 Problem ment SO5 Asset ment 15

16 ITIL & CobiT Inter-Operability Business IT Process Goals/Metrics Governance Processes Process & Metrics Oriented Process Controls Functions, Roles & RACI CobiT ITIL v3 Oriented broader scope High-level Work Flows Role descriptions Toolsets ITIL ITIL v2 Process Oriented Process Metrics Process Work Flows Detail Role Descriptions Detailed Procedures, Work Instructions, Templates 16

17 COBIT : Business Goals for IT Financial Perspective 1. Expand Market Share 2. Increase Revenue 3. Increase Profit 4. Increase Return on Investment 5. Optimize Asset Utilization 6. Business Risk Customer Perspective 7. Improve Customer Orientation and 8. Offer Competitive Products and s 9. Assure Availability 10. Agility in Responding to Changing Business Environment Internal Perspective 11. Compliance with Laws and Regulations 12. Compliance with Internal Policies 13. Transparency for Better Decisions 14. Automate and Integrate the Enterprise value chain 15. Optimize Costs 16. Improve and Maintain Business Processes Functionalities 17. Improve and Maintain Workforce productivity Learning and Growth Perspective 18. Enable Innovations 19. Enable Expansion outsider of Core Strategy 20. Acquire Talent to Support Innovation and Expansion 17

18 SLM Framework (DS1.1) Definition of s ITIL & CobiT Process Level Level ment Level Agreements (DS1.3) SLAs & Contracts Reviews (DS1.6) Operating Level Monitoring CobiT Agreements and Reporting (DS1.2) (DS1.4) (DS1.5) (Process Controls) Create SC and SLAs Identify Metrics Monitor service metrics Review SLAs, OLAs and UCs ITIL (Process Workflow & Activities) 18

19 ITIL & CobiT Metrics Level - Level ment % of s not in the catalogue % of service levels reported # of business stakeholders satisfied that service delivery meets agreed levels % of service levels reported in automated way # of formal SLA annual review meetings with business % of service levels review meetings % of users satisfied that service delivery meets agreed levels. CobiT (Metrics aligned to IT & Business Goals % of services covered by SLAs % of SLAs with OLAs & underpinning contracts? # or % of targets met and # or % severity breaches? Are SLA s, OLAs and underpinning Contracts current? % that need review or update? Are review meetings held on time and correctly minuted? Documentary evidence that issues raised at review are followed-up and resolved? Are SLAs monitored and regular reports produced? Are service levels improving? ITIL Process metrics 19

20 ITIL & CobiT Roles & Responsibility Level Business Executive (CI) Business Process Owner (CI) Head IT Admin (RCI) Head Operations (RC) CFO (I) CIO (ACI) Head Development (RCI) Chief Architect (I) PMO (CI) Compliance, Security, Audit (CI) r (RA) CobiT (Function, Roles & RACI) Level r ITIL Detail on Role Descriptions 20

21 Why should we align? Why align Governance and ITSM initiatives? 21

22 Current State versus Desired State Current State Desired State and Benefits IT has too many `standard terminologies` Multiple initiatives with common goals are not aligned: Project silos Inefficient use of resources Governance initiatives are `compliance` focused versus value oriented. ITSM initiatives lack of governance and value focus A common language Program (Governance and ITSM) vision and goals are aligned, use common approach, share knowledge. Governance is about value & compliance. ITSM supports governance goals. 22

23 Ideal Future State About The Manta Group The Manta Group Architecture pg.00 23

24 Why align Governance and ment? We don t know if our IT enabled investments are delivering value? Perception 40% of all IT spending bought no return to the organization 2004 IBM research CIOs (Gartner 2006 & ITGI research on 1600 projects). ment is a critical component of overall Governance Bridges the gap between business & IT goals (COBIT) and fulfilling these goals via effective service management (ITIL). The goals are the same: Business Alignment, Value, and Compliance. The frameworks are complementary. (ITIL more process details, COBIT: Measurement, Goals and Controls). Why have separate efforts?... 24

25 How can we use them together? A practical approach in using COBIT and ITIL together 25

26 RAPID Approach 26

27 1. Need to have a common Governance Vision and Scope. Example: Governance Visioning Workshop 27

28 The Manta Group CobiT Governance Visioning Approach Adopt and Adapt CobiT Governance Framework for Customer Environments Demand Drivers Analysis What Business needs, imperatives, priorities, goals and strategies are dependent on the IT governance framework? Who Cares? Value Consequence Drivers Analysis What will/can go wrong in the absence of a standardized IT governance framework? So What? Risk Mitigation Drivers Analysis What level of mitigation maturity is required to establish a standardized IT governance framework? Now What? Control 1. Employ high insight to effort ratio. 2. Produce comprehensive & detailed assessment. 3. Results in meaningful priorities for Customer IT Governance Framework. 28

29 PO: Domain Summary example: Maturity versus Consequence Maturity (Now What) 0 Plan and Organize PO5 PO4 PO1 - IT Strategy PO2 - Information Architecture PO7 PO1 PO6 PO3 PO8 PO2 PO PO10 Consequences (So What) 3 PO3 -Technology Direction PO4 - Process & Organization PO5 - Investment PO6 - Communication Strategy 3.5 PO7 - HR 4 PO8 - Quality 4.5 PO9 - Risk 5 PO10 - Projects 7 29

30 PO 10 PO4 Define the IT Processes, Organization & Relationships Monitor -1 Maturity of Controls 0 Under Controlled PO4.1 IT Process Framework PO4.2 IT Strategy Committee PO4.3 IT Steering Committee PO4.4 Organizational Placement of the IT Function PO4.5 IT Organizational Structure Severity of Concern PO4.6 Roles and Responsibilities PO4.7 Responsibility for IT Quality Assurance PO4.8 Responsibility for Risk, Security and Compliance PO4.9 Data and System Ownership PO4.10 Supervision PO4.11 Segregation of Duties Over Controlled 5 Monitor Closely PO4.12 IT Staffing PO4.13 Key IT Personnel 6 PO4.14 Contracted Staff Policies and Procedures 30

31 Example: Deliver & Support Gap Assessment DS 1 Define and Levels DS 2 DS 3 DS 4 Ensure Third-party Performance Continuous s and Capacity DS 7 DS 8 DS 9 DS 10 Educate and Desk Configuration Problems Train Users & Incident DS 5 DS 6 Ensure Identify System and Allocate Security Costs DS 12 DS 11 DS 13 Physical Data Operations Environment High Risk and Low Maturity Gap Areas of Focus: DS4 Ensure Continuous s DS5 Ensure System Security DS7 Enable & Train Users DS10 Problems DS 1 Define and Levels DS 2 DS 3 DS 4 Ensure Third-party Performance Continuous s and Capacity DS 7 DS 8 DS 9 DS 10 Educate and Desk Configuration Problems Train Users & Incident DS 5 DS 6 Ensure Identify System and Allocate Security Costs DS 12 DS 11 DS 13 Physical Data Operations Environment High Business Demand DS 1 Define and Levels DS 1 Define and Levels DS 2 DS 3 DS 4 Ensure Third-party Performance Continuous s and Capacity DS 7 DS 8 DS 9 Educate DS 10 and Desk Configuration Train Users & Incident Problems DS 2 DS 3 DS 4 Ensure Third-party Performance Continuous s and Capacity DS 7 DS 8 DS 9 DS 10 Educate and Desk Configuration Problems Train Users & Incident DS 5 DS 6 Ensure Identify System and Allocate Security Costs DS 12 DS 11 DS 13 Physical Data Operations Environment DS 5 DS 6 Ensure Identify System and Allocate Security Costs DS 12 DS 11 DS 13 Physical Data Operations Environment Gap in Responsibility and Accountability High Relevance 31

32 Step 2: Need to have a plan on what you will implement and how. this as a Portfolio of Projects 32

33 Governance Planning Scope Use COBIT to prioritize what governance areas to focus on strategically. Decide from scope which are also under the ITIL framework. Prioritize focus areas Look to create portfolio of projects to cover each focus area and look to adopt additional frameworks for further detail. Embody people, process and automation as factors. Deliverables: Portfolio of prioritized governance projects Implementation plan 33

34 Step 3: Implementation & Review Use COBIT and ITIL content together for process implementation 34

35 How to use COBIT & ITIL together Metrics Use COBIT for performance dashboard strategy Use COBIT to align business to IT to process goals and metrics Validate process metrics with ITIL process KPIs Process Use ITIL to define process activities and workflow Use COBIT to validate process controls are in place Roles Use COBIT for Functional Role and RACI role mapping Use ITIL to provide a role description 35

36 Conclusion Top 10 Reasons 1. IT becomes the growth engine of the organization 2. Levels the playing field for IT to have a voice in the executive table 3. Moves IT from cost-centre mentality to value-centre mentality 4. Brings risk into the forefront enabling IT to convey concerns constructively 5. Enables for regulatory compliance 6. Provides business oriented measures to monitor IT performance 7. Promotes IT and Business joint responsibility and accountability 8. Aligns IT goals with business goals 9. Links IT processes to business process 10. Clarifies IT activities, output and contributions 36

37 Thank You Question & Answer April 2008 Harpreet Virdee Partner, The Manta Group 37