COBIT Assessment Programme—Frequently Asked Questions (FAQs)

@: Why did ISACA select ISO 15504?

ISO 15504 effectively deals with a capability process assessment. It provides an understandable, logical, repeatable, reliable and robust methodology for assessing the capability of IT processes (evidentiary requirements).

@: What is the major value of using the new COBIT Assessment Programme?

a. The value derived from assessments using this approach includes reliable results that focus the enterprise on the benefits and resource implications arising from the performance and capability of its IT processes, and provide a sound basis for benchmarking and improvement, prioritization and planning.

b. There are a number of specific benefits for COBIT users in taking this approach:

- Focus first on confirming that a process is achieving its intended purpose anddelivering its required  

   outcomes as expected.

- Simplification of the content supporting process assessment.

- Improved reliability and repeatability of process capability assessment activities and evaluations, reduced 

   debates and disagreements between stakeholders on assessment results.

- Increased usability of process capability assessment results, as the new approach establishes a basis for 

   more formal, rigorous assessments to be performed, for both internal and potential external purposes such 

   as benchmarking.

- Compliance with a generally accepted process assessment standard (ISO 15504) and therefore strong 

   support for process assessment approach in the market.

@:Does the new COBIT Assessment Programme approach replace the existing COBIT 4.1CMM approach?

a. No, it does not; it is a different approach to assessing process capability that ISACA has selected to use. COBIT 4.1 CMM remains as published and the option of applying

a COBIT Assessment Programme approach as an alternative has been made available.

b. However, The CMM approach will not be offered in COBIT 5 because the new ISO

15504 approach is core to performing a capability process assessment using COBIT 5 content.

@: What is the difference between the COBIT 4.1 CMM and the new COBIT Assessment Programme approach?

a. The capability level scale is the same, i.e., 0 to 5 and some of the level names are very similar, but that is where the similarities end. The attributes assessed and measured in each approach are NOT the same nor is there a clean cut relationship between the two sets of attributes.

b. There are no specific requirements to provide evidentiary support for assessment results in the existing COBIT 4.1 CMM approach, but this is mandatory in the ISO 15504 approach. Providing such evidence in support of the assessment produces more robust, repeatable and defensible results.

c. The assessment done under the old COBIT 4.1 CMM approach will likely result in “higher scores,” due to the subjective averaging approach adopted, and also due to the more rigorous ISO 15504 requirements for level 1 in the new approach

@: Will COBIT 5 have the same process capability assessment approach using ISO 15504? And how will it differ?

a. COBIT 5 has been designed taking into account all of the ISO 15504 process capability assessment requirements. As a result the consistency of content between the COBIT 5 process content and the COBIT 5 PAM will be improved over those of COBIT 4.1.

b. For the purposes of applying the COBIT Assessment Programme approach, the only difference between COBIT 4.1 and COBIT 5 will be the level 1 content which is specific and unique to each framework version. Assessment levels 2 to 5 focus on generic process attributes (as defined in ISO 15504) and are therefore the same for both frameworks.

@:Why would you want to do a COBIT process capability assessment using COBIT 4.1 when COBIT 5 will be available in early 2012?

Enterprises have invested in using COBIT 4.1 and will continue to use it for a number of years—until a driver is encountered for them to consider a transition to COBIT 5. During this time a formal process capability assessment against COBIT 4.1 will be of value to them.

@: How is assessing cloud different from assessing other services?

There is no difference, cloud services are a subset of IT services, Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS). Regardless of the deployment model, private, public etc, cloud computing is a delivery of a service in the same way as any other IT service delivery; ISACA cloud publications provide a predefined selection of COBIT processes; the assessment of the processes itself will be the same for cloud as for any other IT service delivered. . For more information on

ISACA’s cloud publications visit: www.isaca.org/cloud

@: What other models, frameworks and approaches have been aligned to ISO 15504?

a. ITIL3 has been mapped to ISO 15504 but only at level 1; i.e., a Process Reference Model (PRM) has been developed and released via a Tudor publication. However, to our knowledge no full PAM has been developed.

b. The ISO group responsible for ISO 20000 on IT service management is also in the process of developing an ISO 15504 PAM

c. COSO has also developed an ISO 15504 PRM (level 1 only) but not a full PAM.

@:How long on average does a COBIT Assessment take to execute?

a. There is no specific answer to this as it depends on the scope of the assessment; 3 processes vs. 34/37. It depends on the business need and what processes management would like to see assessed/improved.

b. ISACA has provided a scoping tool as part of its tool kit to assist organizations in selecting processes to scope. (See tool kit link on the web site.)

@: If all of the work (heavy lifting) is done to achieve level 1, which is deemed to be a

major achievement, what is the incentive to go to further levels of capability? Is it not a “nice to have’?”

a. There is always a cost/benefit trade off in how high a capability level an organization wants to achieve and indeed many organizations have focused a lot of their attention at level 1 because this is a major achievement to show that your processes are meeting fully their purpose.

b. Level 3 is seen by ISACA as the level that enterprises should aspire to for consistency in the performance of their processes irrespective of the staff involved.

c. Levels 4 and 5 will depend on the industry and product sector, so for example to meet a government contract to provide defense technology an organization may be

required to show a level 5 capability, i.e., “their processes are optimized.”

@: What tools are available to assist assessors in performing these process capability assessments?

a. ISACA has provided a tool kit for both the assessor and the self‐assessment guide.

b. There are also commercial organizations that provide ISO assessment tools both online and via software download that can be tailored to a specific organization’s needs.