COBIT 5 Process Assessment Model

COBIT 5 Supplementary Guide for the COBIT 5 Process
Assessment Model (PAM)

All rights reserved. Under the copyright laws, this manual may not be reproduced or
transmitted, in whole or in part, by any means, electronic or mechanical without the written
consent from ISACA. The ISACA logo is a trademark of ISACA.
ISACA
3701 Algonquin Road, Suite 1010

Rolling Meadows, IL 60008 USA
Phone: +1.847.253.1445
Fax: 1.847.253.1443
E-mail:
education@isaca.org
Web site:
www.isaca.org
2012 ISACA. All rights reserved.
APM Group Limited 2012

COBIT 5 Supplementary Guide
COBIT is a trademark of ISACA registered in the United States and other countries
ITIL is a registered trade mark of the Cabinet Office
PRINCE2 is a registered trade mark of the Cabinet Office
Version 1.0 (Status Live) Page 2 of 18 Owner Chief Examiner
Contents
1.0 Purpose of the Guide4
2.0 COBIT 5 Foundation Assessment Programme Syllabus4
3.0 Process Assessment Explained.7
3.1 What is a Process Assessment?.........................................................................................7
3.2 What is the COBIT Assessment Programme?...................................................................7
3.3 The Differences between a Maturity and a Capability Assessment.7
3.4 Differences between a COBIT 4.1 CMM Assessment and the new COBIT ISO 15504
Approach.8
3.5 Overview of the COBIT Capability Model & Assessments.9
3.6 The Process Reference Model (PRM).10
3.7 The Process Assessment Model..13
3.8 The Measurement Framework..15
4.0 APPENDIX A PAM Glossary Key Terms from ISO15504.17

1.0 Purpose of the guide
This guide supplements the COBIT 5 Framework guide with important definitions and concepts taken
from the COBIT Process Assessment Model (PAM) and ISO 15504 that are required by candidates to
be tested at foundation level, areas 1 and 2; knowledge and understanding respectively. It adds more
detail and clarity to the framework guide, chapter 8, which cross references the COBIT Process
Assessment Model (PAM).
***NOTE: Training organisations will not need the COBIT 5 PAM which is not yet available. This
can be added to the two assessor guides that come with it for a more detailed Assessor
training and certificate course. The COBIT 4.1 PAM is available and is almost the same apart
from the PRM (Process Reference Model) which is based on COBIT 4.1. All generic goals,
practices and work products however needed for Level 2 to Level 5 assessments are the same.
***NOTE: we have also added the Syllabus for Learning Area PC below as this supplementary
guide follows closely to the order and flow of the syllabus.
2.0 COBIT 5 Foundation Assessment Programme Syllabus
Syllabus Syllabus Area: Chapter 8

Area Code:
Process Capability Model ( The Process Assessment Model
PC {PAM}
To know facts, terms and concepts relating to the Process Capability Model.
Specifically to recall:
01 01 The six Capability Levels based on ISO 15504: COBIT 5 Chapter

8 Figure 19 page
Level 0 Incomplete Process 42
Level 1 Performed process
Level 2 Managed process
Level 3 - Established Process
Level 4 - Predictable Process
Level 5 Optimised Process
01 02 The nine Attributes based on ISO 15504: Chapter 8 Figure
19 page 42
PA 1.1 Process performance
PA 2.1 Performance management
PA 2.2 Work product management
PA 3.1 Process definition

PA 3.2 Process deployment
PA 4.1 Process measurement
PA 4.2 Process control
PA 5.1 Process innovation
PA 5.2 Process optimisation

01 03 The Rating Scale based on ISO 15504: Chapter 8 page
45
N Not achieved 0 to 15% achievement - There is

little or no evidence of achievement of the defined attribute in
the assessed process.
P Partially achieved 15% to 50% achievement - There
is evidence of a sound systematic approach to an

achievement of the defined attribute in the assessment
approach
L Largely achieved 50% to 85% achievement - There
is evidence of a sound, systematic approach to the
significant achievement of the defined attribute in the
assessment
F Fully achieved 85% to 100% achievement - There is
evidence of a complete and systematic approach to and full
achievement of the defined attribute in the assessed
approach.
01 04 The definition of the following ISO 15504 terms: COBIT 5 PAM
supplementary
1. A Process Purpose guide 3.6.1
2. A Process Outcome
3. A Base Practice
4. A Work Product
To understand the Process Capability Model and the basic ISO 15504
concepts.
Specifically to identify:
02 01 The Reasons for carrying out a Process Capability Assessment. COBIT 5 PAM
supplementary
ISO 15504 identifies the purpose as an activity that can be guide 3.1
performed either as a process assessment or as a process
improvement initiative
To continuously improve the enterprises effectiveness

To identify the strengths and weaknesses of selected
processes based on business need
To provide a logical, understandable, repeatable, reliable and
robust methodology for assessing the capability of IT-related
processes.
02 02 The Scope of the COBIT assessment programme, specifically the COBIT 5 PAM
purpose of the 3 guides: supplementary
guide 3.2
1. The Process Assessment Model (PAM) using COBIT 4.1 and
COBIT 5
2. The Assessor Guide using COBIT 5 and COBIT 4.1
3. The Self-Assessment Guide using COBIT 4.1 and COBIT 5

02 03 The differences between a Maturity and a Capability Assessment: COBIT 5 PAM
supplementary
o ISO/IEC 15504-2 describes a Process Assessment guide 3.3
as one that examines the processes used by an
organization to determine whether they are effective
in achieving their goals. The assessment
characterizes the current practice within an
organizational unit in terms of the capability of the
selected processes. The results may be used to
drive process improvement activities or process
capability determination.

o ISO15505-7 defines organizational maturity as an
expression of the extent to which an organization
consistently implements processes within a defined
scope that contributes to the achievement of its
business goals (current or projected). An
Organizational Maturity Model is based upon one or
more specified Process Assessment Model(s), and
addresses the domains and contexts for use of the
Process Reference Model(s) from which the Process
Assessment Model(s) are derived.
02 04 The purpose of a Process Reference Model as defined by ISO 15504 COBIT 5 PAM
supplementary
guide 3.6 page 10
02 05 The Differences between the two dimensions outlined in the ISO COBIT 5 PAM
15504 approach: supplementary
guide 3.7
The capability Dimension as outlined by the 6 capability
levels and
A process dimension which deals specifically with the 37
specific COBIT processes outlined in the Process Reference
Model (PRM).
02 06 The differences between the Generic and Specific attributes outlined COBIT 5 PAM
in the COBIT PAM. supplementary
guide 3.6.1.
1. Base Practices & Generic Base Practices
2. Work Products & Generic Work Products
02 07 The benefits of the COBIT Capability Assessment approach. COBIT 5 Chapter
8 page 44

3.4
Supplementary
Guide
02 08 How the rating scales are used in an assessment COBIT 5 PAM
Supplementary
To achieve a pass for a certain level, a process must be guide 3.8
rated L Largely or F Fully at that level, and be rated F-
Fully on the lower levels.

To be able to move onto another capability level all Process
Attributes must be F fully for that process (if not achieved,
the organisation needs to improve that particular process
attribute to have a F rating before moving on)

3.0 Process Assessment Explained
3.1 What is a Process Assessment?
ISO/IEC 15504-4 identifies process assessment as an activity that can be performed either as
part of a process improvement initiative or as part of a capability determination approach.
The purpose of process improvement is to continually improve the enterprises effectiveness

and efficiency.
The purpose of process capability determination is to identify the strengths, weaknesses and
risk of selected processes with respect to a particular specified requirement through the
processes used and their alignment with the business need.
It provides an understandable, logical, repeatable, reliable and robust methodology for

assessing the capability of IT processes.
3.2 What is the COBIT Assessment Programme?
ISACAs new COBIT Assessment Process brings COBIT together with ISO15504 a
reference model for assessing process capability (consisting of capability levels which in turn
consist of the process attributes and further consist of generic practices).
ISACA publications to support the COBIT Assessment Programme include the Process
Assessment Model (PAM); a guide for Certified Assessors (and we will talk more about the
concept of certified assessors a little later); and a self-assessment guide for enterprises
that would like a less formal assessment using the same basic approach.
The PAM the key reference source for an assessment basically re-states much of the
COBIT 4.1 content into an ISO15504 compliant process assessment model for use in
assessing IT process capability.
The COBIT Assessment Programme includes:
COBIT Process Assessment Model (PAM): Using COBIT 4.1 & 5
COBIT Assessor Guide: Using COBIT 4.1 & 5
COBIT Self-Assessment Guide: Using COBIT 4.1 & 5
The COBIT PAM adapts the existing COBIT 4.1 and COBIT 5 content into an ISO 15504 compliant
process assessment model.
3.3 The Differences between a Maturity and a Capability Assessment
Historically most frameworks from COBIT, ITIL and PRINCE2 have adopted the SEI (Software
Engineering Institute) CMMI approach which combines a Capability and a Maturity Assessment into a
single assessment.
ISO 15504 states that they are two separate assessments:

ISO/IEC 15504-2 describes a Process Assessment as one that examines the processes used by
an organization to determine whether they are effective in achieving their goals. The
assessment characterizes the current practice within an organizational unit in terms of the capability
of the selected processes. The results may be used to drive process improvement activities or
process capability determination.
ISO15505-7 defines organizational maturity as an expression of the extent to which an

organization consistently implements processes within a defined scope that contributes to the
achievement of its business goals (current or projected). An Organizational Maturity Model is
based upon one or more specified Process Assessment Model(s), and addresses the domains and
contexts for use of the Process Reference Model(s) from which the Process Assessment Model(s) are
derived.
The key difference to note from the above definitions:
A Maturity Assessment is done at an Enterprise or organizational level and uses a

different measurement scale than a capability assessment and different criteria and
attributes.
A Capability Assessment is done at a process Level and is done for purposes of process
Improvement. You cannot role up an assessment of many different processes
mathematically to an enterprise level. It works for SEIs CMMI because they are
assessing a single process, software engineering development or application
development. Most frameworks like COBIT contain 34 and 37 processes respectively for
COBIT 4.1 and COBIT 5.
ISACA decided to adopt ISO/IEC 15504-2 Process Capability Assessment only at this stage
because: a) the benefits outlined in chapter 8 of the framework guide and restated below, and b)
complexities in attempting to develop at this time an organisation Maturity Assessment using the ISO
15504-7 approach, and c) ISACA is not yet clear on the benefits of undertaking a Maturity
Assessment.
Advantages of the New COBIT Assessment Programme are:
A robust assessment process based on ISO 15504
An alignment of COBITs maturity model scale with the international standard
A new capability-based assessment model which includes:
Specific process requirements derived from COBIT 4.1 & COBIT 5
Ability to achieve process attributes based on ISO 15504
Evidence requirements
Assessor qualifications and experiential requirements
Results in a more robust, objective and repeatable assessment
3.4 Differences between a COBIT 4.1 CMM Assessment and the new COBIT ISO 15504
Approach
Figure 1

COBIT 4.1 Process ISO/IEC 15504 Process
Maturity Level Capability Level Attribute
5 Optimised 5 Optimizing PA 5.1 Process innovation
PA 5.2 Process optimization
4 Managed and 4 Predictable PA 4.1 Process measurement

measurable
3 Defined 3 Established PA 3.1 Process definition
2 Repeatable but 2 Managed PA 2.1Performance management

intuitive
1 Initial/ad hoc 1 Performed PA 1.1 Process performance
0 Non-existent 0 Incomplete
The COBIT PAM uses a measurement framework that is similar in terminology to the existing
maturity models in COBIT 4.1
While the words are similar the scales are NOT the same:
The COBIT PAM uses the capability scale from ISO/IEC 15504, whereas the existing COBIT
maturity models uses a scale derived from SEI\CMMI approach
A PAM level 3 is NOT the same as a CMM level 3
Assessments done under the PAM are likely to result in lower scores
PAM assessments are based on more fully defined and defensible attributes.
***NOTE: There is no direct relationship between the existing COBIT 4.1 CMM and the new
approach based on ISO 15504.
3.5 Overview of the COBIT Capability Model & Assessments
Figure 2

Candidates are required to know and understand only the PAM the process model concepts. The
assessor programme is introduced but will form part of a more detailed assessor training course and
certificate.
The PAM comprises 3 important sections:
The Process Reference Model
The Process Assessment Model
The Measurement Framework
3.6 The Process Reference Model (PRM)
Process Reference Models provide the mechanism whereby defined Process Assessment
Models are related to the measurement framework defined by ISO/IEC 15504. A Process
Reference Model is defined external to this part of ISO/IEC 15504 and provides the basis for one or
more Process Assessment Models. Process Assessment Model(s) are based on the process
descriptions provided in Process Reference Models.
There are two versions the COBIT 4.1 and COBIT 5. Both versions are presented in the training as
the measurement framework and the process assessment model is the same.

Figure 3 (Figure 31, Page 74, COBIT Framework Guide)
Figure 4 COBIT 4.1 PRM

3.6.1 Important definitions
ISO 15504 defines the following key terms:
Process purpose The high-level measurable objectives of performing the process and the
likely outcomes of effective implementation of the process.
Process outcomes - An observable result of a process (Note: An outcome is an artefact, a

significant change of state or the meeting of specified constraints.)
Base practices The activities that, when consistently performed, contribute to achieving the
specific process purpose.
Work product - An artefact associated with the execution of a process defined in terms of
process inputs and process outputs.
Generic practice - These are activities of a generic type and provide guidance on the
implementation of the attribute's characteristics. They support the achievement of the process
attribute from levels 2 to 5 only. Many of them concern management practices, i.e. practices that
are established to support the process performance.
Generic Work Products These are indicators are sets of characteristics that would be
expected to be evident in work products of generic types as a result of achievement of an
attribute. The generic work products form the basis for the classification of the work products
defined as process performance indicators; they represent basic types of work products that may
be inputs to or outputs from all types of process. In the process dimension they are used from
Levels 2 to 5 only.
3.6.2 Application of ISO definitions to the COBIT 5 PRM
Figure 3 of the COBIT 5 Business Framework for the Governance and Management of Enterprise IT
outlines the structure of the 37 processes. This model was developed using the ISO 15504 approach
and concepts so the key terms defined by ISO 15504 are already in the PRM except for:
Process Outcomes These are the process goals defined in the COBIT 5 PRM.
Base Practice This is the management practice defined in the COBIT 5 PRM.
3.6.3 Application of ISO definitions to the COBIT 4.1 PRM
Figure 4 outlines the Process reference Model for COBIT 4.1. Because COBIT 4.1 was not developed
to meet the ISO 15504 approach, so in order to meet the ISO 15504 definitions the following aspects
of COBIT 4.1 were adapted to meet the definitions and criteria:
Process Purpose - The COBIT 4.1 Process Business Requirements statements
Process Outcome Control Objectives
Base Practice RACI Activities
Work Products Process Inputs and Outputs.

3.7 The Process Assessment Model
ISO 15504 defines two levels:
A Capability Dimension which focuses on the process capability dimension (levels 1 to 5)

based on process attribute indicators (PAI) that are solely deals with Generic attributes
A Process dimension that contains additional indicators for process for process
performance assessment based on very specific performance indicators.
** Note that the PRM or process reference model is used only for this dimension at
LEVEL 1. Levels 2 to 5 focuses only on the Capability dimension based on generic attributes.
The ISO model shown at Figure 5 below demonstrates this concept.
Figure 5 Adapted from ISO 15504-02
Adapting this for COBIT 5 we arrive at Figure 6:

3.7.1 Capability Levels and Attributes explained
Figure 7 - COBIT PAM - 6 Capability Levels & 9 Attributes

COBIT assessment process measures the extent to which a given process achieves specific
attributes relative to that process process attributes
COBIT assessment process defines 9 process attributes (based on ISO/IEC 15504-2):
PA 1.1 Process performance

PA 2.1 Performance management
PA 3.1 Process definition
PA 4.1 Process measurement
PA 5.1 Process innovation
PA 5.2 Continuous optimisation
3.8 The Measurement Framework
COBIT assessment process measures the extent to which a given process achieves the process
attributes:
N Not achieved 0 to 15% achievement - There is little or no evidence of achievement of the

defined attribute in the assessed process.
P Partially achieved 15% to 50% achievement - There is evidence of a sound systematic

approach to an achievement of the defined attribute in the assessment approach.
L Largely achieved 50% to 85% achievement - There is evidence of a sound, systematic

approach to the significant achievement of the defined attribute in the assessment.
F Fully achieved 85% to 100% achievement - There is evidence of a complete and

systematic approach to and full achievement of the defined attribute in the assessed approach.
** Note to pass a process capability level, a process must achieve either an L Largely or F Fully.
** Note also that to be able to move to another level of assessment any deficiencies that scored L
Largely must be improved to an F Fully before an enterprise can move on. This is demonstrated in
the following Figure 8 below:

For example achieving level 1 capability requires Attribute PA 1.1 to be fully or largely achieved.
Achieving level 2 requires both PA2.1 and PA2.2 to be fully or largely achieved and PA1.1 to
be fully achieved.
Achieving level 3 requires both PA 3.1 and PA3.2 to be fully or largely achieved and PA1.1,
2.1 and 2.2 to be fully achieved.
And so on for capability levels 4 and 5.

APPENDIX A - PAM Glossary ISO 15504-1 {References taken from ISO}


COBIT 5 Process Assessment Model

Uploaded by

Copyright:

Available Formats

COBIT 5 Process Assessment Model

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

COBIT 5 Process Assessment Model

Uploaded by

Copyright:

Available Formats

COBIT 5 Supplementary Guide for the COBIT 5 Process

Assessment Model (PAM)

3701 Algonquin Road, Suite 1010

2012 ISACA. All rights reserved.

APM Group Limited 2012

APM Group Limited 2012

2.0 COBIT 5 Foundation Assessment Programme Syllabus

Syllabus Syllabus Area: Chapter 8

01 01 The six Capability Levels based on ISO 15504: COBIT 5 Chapter

APM Group Limited 2012

N Not achieved 0 to 15% achievement - There is

APM Group Limited 2012

APM Group Limited 2012

3.1 What is a Process Assessment?

The purpose of process improvement is to continually improve the enterprises effectiveness

It provides an understandable, logical, repeatable, reliable and robust methodology for

3.2 What is the COBIT Assessment Programme?

The COBIT Assessment Programme includes:

COBIT Process Assessment Model (PAM): Using COBIT 4.1 & 5

COBIT Assessor Guide: Using COBIT 4.1 & 5

COBIT Self-Assessment Guide: Using COBIT 4.1 & 5

3.3 The Differences between a Maturity and a Capability Assessment

ISO 15504 states that they are two separate assessments:

APM Group Limited 2012

ISO15505-7 defines organizational maturity as an expression of the extent to which an

The key difference to note from the above definitions:

A Maturity Assessment is done at an Enterprise or organizational level and uses a

Advantages of the New COBIT Assessment Programme are:

A robust assessment process based on ISO 15504

An alignment of COBITs maturity model scale with the international standard

A new capability-based assessment model which includes:

Specific process requirements derived from COBIT 4.1 & COBIT 5

Ability to achieve process attributes based on ISO 15504

Assessor qualifications and experiential requirements

Results in a more robust, objective and repeatable assessment

APM Group Limited 2012

Maturity Level Capability Level Attribute

5 Optimised 5 Optimizing PA 5.1 Process innovation

PA 5.2 Process optimization

4 Managed and 4 Predictable PA 4.1 Process measurement

3 Defined 3 Established PA 3.1 Process definition

PA 3.2 Process deployment

2 Repeatable but 2 Managed PA 2.1Performance management

1 Initial/ad hoc 1 Performed PA 1.1 Process performance

3.5 Overview of the COBIT Capability Model & Assessments

APM Group Limited 2012

The PAM comprises 3 important sections:

The Process Reference Model

The Process Assessment Model

The Measurement Framework

3.6 The Process Reference Model (PRM)

APM Group Limited 2012

Figure 4 COBIT 4.1 PRM

APM Group Limited 2012

ISO 15504 defines the following key terms:

Process outcomes - An observable result of a process (Note: An outcome is an artefact, a

3.6.2 Application of ISO definitions to the COBIT 5 PRM

3.6.3 Application of ISO definitions to the COBIT 4.1 PRM

Process Purpose - The COBIT 4.1 Process Business Requirements statements

Process Outcome Control Objectives