Process Attributes and Process Capability Levels: Cobit5 Tutorial
1 Process Attributes and Process Capability Levels
This lesson covers the measurement framework, Process Attributes and process capability levels of COBIT® 5 (read as KOBIT five) process capability assessment model. Let us begin with the objectives of this lesson in the next screen.
By the end of this lesson, you will be able to: ● Define Process Attributes ● Discuss assessment indicators ● Explain how to assess process capability ● Describe process capability levels and Process Attribute rating scale In the next screen, we will focus on measurement framework.
3 Measurement Framework
The COBIT® assessment process measures the extent to which a given process achieves specific attributes relative to that process, called Process Attributes or PA (read as P-A). The assessment process defines nine Process Attributes based on ISO/IEC 15504-2 (read as I-S-O I-E-C fifteen thousand five hundred forty hyphen two), which are as follows: • PA 1.1 (read as P-A one point one) Process performance • PA 2.1 Performance management • PA 2.2 Work product management • PA 3.1 Process definition • PA 3.2 Process deployment • PA 4.1 Process measurement • PA 4.2 Process control • PA 5.1 Process innovation and • PA 5.2 Continuous optimisation In the next three screens, we will focus on the three Process Attributes namely, PA 1.1 Process performance, PA 2.1 Performance management and PA 2.2 Work product management.
4 PProcess Attribute 1.1—Process Performance
Let us begin our discussion with PA 1.1 Process performance The process performance attribute is a measure of the extent to which the process purpose is achieved. As a result of the full achievement of this attribute, the process achieves its defined outcomes. Next, we will discuss PA 2.1 Performance management
5 Process Attribute 2.1—Performance Management
Performance management is a measure of the extent to which the performance of the process is managed. As a result of the full achievement of this attribute: • objectives for the performance of the process are identified. • performance of the process is planned and monitored. • performance of the process is adjusted to meet plans. • responsibilities and authorities for performing the process are defined, assigned and communicated. • resources and information necessary for performing the process are identified, made available, allocated and used. • interfaces between the involved parties are managed to ensure effective communication and clear assignment of responsibility. In the next screen, we will focus on the third attribute that is PA 2.2 Work Product Management.
6 Process Attribute 2.2—Work Product Management
Work Product Management is a measure of the extent to which the work products produced by the process are appropriately managed. As a result of the full achievement of this attribute: • requirements for the work products of the process are defined. • requirements for documentation and control of the work products are defined. • work products are appropriately identified, documented and controlled. • work products are reviewed in accordance with planned arrangements and adjusted as necessary to meet requirements. In the next screen, we will focus on the assessment indicators.
7 Assessment Indicators
The image on the screen shows the assessment indicators in the capability and process dimensions. Following are the points to be noted here: • For each Process Attribute, the process capability assessments from level 1 to level 5 are based on the Process Attribute Indicators or PAI (Read as P-A-I) consisting of: o Generic Practice or GP (read as G-P) which are activities of a generic type and provide guidance on the implementation of the attribute's characteristics. o Generic Resources or GR (read as G-R) which are the resources that aid in achieving the Process Attributes; and o Generic Work Product or GWP (Read as G-W-P) which are indicators that are sets of characteristics expected to be evident in work products of generic types as a result of achievement of an attribute. • These are further amplified for Process Attribute 1.1 that is process performance consisting of additional performance assessment based on the performance indicators: o Base Practices or BP (Read as B-P) and o Work Products or WP (Read as W-P) • It is also to be noted that as per COBIT®4.1 model, there are only 3 types of processes as depicted in the image consisting of primary processes, supporting processes and organisational processes. In the next screen, we will look at the same image but with COBIT® 5 Process Reference Model or PRM (read as P-R-M).
8 Indicators with COBIT® 5 PRM
In COBIT® 5 PRM, there are 5 types of processes as depicted in the image. The 5 processes are: • Evaluate, Direct, Monitor or EDM (read as E-D-M), • Align, Plan, Organise or APO (read as A-P-O), • Build, Acquire, Implement or BAI (read as B-A-I), • Deliver, Service, Support or DSS (read as D-S-S) and • Monitor, Evaluate, Assess processes or MEA (Read as M-E-A). The image shows the assessment indicators with COBIT® 5 PRM. The points to be noted here are: • For each Process Attribute, the process capability assessments from level 1.1 to level 5.2 is again based on PAI consisting of: o Generic Practice or GP (read as G-P) o Generic Resource or GR (read as G-R) and o Generic Work Product or GWP (read as G-W-P) • These are further amplified for Process Attribute 1.1 that is process performance consisting of additional performance assessment based on the performance indicators: o Base Practices or BP (Read as B-P) and o Work Products or WP (Read as W-P) In the next screen, we will discuss assessing process capability.
9 Assessing Process Capability
The table on the screen lists the generic practices and work products for the Performance Management attribute. Here, we will focus on the tasks carried out to get the result of the full achievement of the attribute, the corresponding Generic Practices that are carried out as part of the task and the Generic Work Products that are created as an outcome of these tasks. First, we have the objectives for the performance of the process to be identified. The Generic Practice is GP 2.1.1 (read as G-P two point one point one)— Identify the objectives for the performance of the process. Here, the performance objectives, scoped together with assumptions and constraints, are defined and communicated. There are two Generic Work Products that are created as part of the outcome, namely, GWP 1.0—Process documentation that outlines the process scope and GWP 2.0—Process plan which provides details of the process performance objectives. Next, the objectives for the performance of the process are planned and monitored. The generic Practice is GP 2.1.2—Plan and monitor the performance of the process to fulfil the identified objectives. Here, basic measures of process performance linked to business objectives are established and monitored. They include key milestones, required activities, estimates and schedules. There are again two Generic Work Products that are created as part of the outcome, namely, GWP 2.0—Process plan that provides details of the process performance objectives and GWP 3.0—Process performance records which provides details of the outcomes. A point to be noted is that, at this level, the record of process performance may be in the form of reports, issues registers and informal records. Lastly, the objectives for the performance of the process are adjusted to meet plans. The generic practice is GP 2.1.3—Adjust the performance of the process. Here, action is taken when planned performance is not achieved. Actions include identification of process performance issues and adjustment of plans and schedules as appropriate. The Generic Work Product that is created is, GWP4.0—Quality record which provides details of actions taken when performance is not achieved. In the next screen, we will focus on mapping Process Assessment Model or PAM to Process Reference Models or PRMs.
10 Mapping PAM to PRMs
To ensure the mapping of the PAM to the PRM, the following pointers are used. A Process Assessment Model provides an explicit mapping from the relevant elements of the model to the processes of the selected Process Reference Model and to the relevant Process Attributes of the measurement framework. The mapping must be complete, clear and unambiguous. The mapping of the indicators within the Process Assessment Model will be: o the purpose and outcome of the processes in the specified Process Reference Model; o the Process Attribute including the results of achievements listed for each Process Attribute in the measurement framework. The mapping enables Process Assessment Models that are structurally different to be related to the same Process Reference Model. In the next screen, we discuss the process capability levels.
11 Process Capability Levels
The image on the screen lists the attributes of each process capability level. There are six levels of capability that a process can achieve, including an ‘incomplete process’ designation if the practices in it do not achieve the intended purpose of the process: • Level 0 is known as Incomplete process. Here, the process is not implemented or fails to achieve its process purpose. At this level, there is little or no evidence of any systematic achievement of the process purpose. • Level 1 also known as Performed process has one attribute. The implemented process achieves its process purpose. • Level 2 is known as Managed process and has two attributes. The previously described performed process is now implemented in a managed fashion that is, the process is planned, monitored and adjusted and its work products are appropriately established, controlled and maintained. • Level 3 also known as Established process has two attributes. The previously described managed process is now implemented using a defined process that is capable of achieving its process outcomes. • Level 4 known as Predictable process has two attributes. The previously described established process now operates within defined limits to achieve its process outcomes. • Level 5 known as Optimising process has two attributes. The previously described predictable process is continuously improved to meet relevant current and projected business goals. It is to be noted that each capability level can be achieved only when the level below has been fully achieved. For example, a process capability level 4 which is, Predictable process, requires the process measurement and process control attributes to be largely achieved, and the attributes for the process capability level 3 to be fully achieved. In the next screen, we discuss the Process Attribute rating scale.
12 Process Attribute Rating Scales
The COBIT® assessment process measures the extent to which a given process achieves Process Attributes. This is expressed using the rating scale shown on the screen. There are four ratings: N or Not achieved rating consists of Process Attributes with 0 to 15% achievement. There is little or no evidence of achievement of the defined attribute in the assessed process. P or Partially achieved rating is made up of Process Attributes with 15% to 50% achievement. There is some evidence of an approach to, and some achievement of, the defined attribute in the assessed process.L or Largely achieved rating consists of Process Attributes with 50% to 85% achievement. There is evidence of a sound, systematic approach to the significant achievement of the defined attribute in the assessment. F or Fully achieved rating consists of Process Attributes with 85% to 100% achievement. There is evidence of a complete and systematic approach and full achievement of the defined attribute in the assessment. In the next screen, we will focus on Process Attribute ratings and capability levels.
13 Process Attribute Ratings and Capability Levels
The table on the screen illustrates how the Process Attributes are organised into logical levels representing the capability levels. For example: • Achieving level 1 capability requires PA 1.1 to be fully or largely achieved. • Achieving level 2 requires both PA 2.1 and PA 2.2 to be fully or largely achieved and PA 1.1 to be fully achieved. • Achieving level 3 requires both PA 3.1 and PA 3.2 to be fully or largely achieved and PA 1.1, 2.1 and 2.2 to be fully achieved. • This continues till capability levels 4 and 5 are achieved. In the next screen, we will discuss target process capabilities.
14 Target Process Capabilities
Depending on the purpose of the assessment, the assessed capability is compared with a target or desired capability. The table on the screen shows an example of the same. This table may be used as reference while conducting actual assessments. As shown in the table, there is a target capability rating, for example, L or ‘Largely achieved’ and F or ‘Fully achieved’, for each of the processes and attributes. However, on assessment, the achieved rating may either fall short of the target rating or meet the target rating. In the next screen, we will focus on consequence of capability gaps.
15 Consequence of Capability Gaps
The ISO/IEC 15504 approach is not a risk-based assessment as per the Sarbanes-Oxley Audit standard 5 which recommends that organisations do a risk assessment to determine the areas to be audited and assessed. It is a prescriptive approach for the assessment of process capability. However, an assessment is not done in isolation. It is done for process improvement purposes, so deficiencies or gaps have some consequences. The table on the screen summarises the nature of any gap that may exist within a given process capability and the seriousness of consequence if such gaps are not plugged in or filled. It is very evident that if a gap occurs at level 1, leading to missing work products, the basic process outcomes are not achieved. It is the highest level of seriousness in terms of the capability of the process. Whereas, if a gap occurs at level 5 the seriousness of capability is low because the process is already quite capable and is delivering required outcomes. Therefore, risk assessment needs to be introduced at the process improvement stages and not at the process assessment stage.
Let us summarise what we have learnt in this lesson: ● The COBIT® assessment process measures the extent to which a given process achieves specific attributes relative to that process, called Process Attributes or PA. ● Some assessment indicators are Generic Practice, Generic Resource, Generic Work Product and Base Practices. ● Assessing process capability involves three steps, namely, identifying performance objectives, planning and monitoring process performance and adjusting process performance to meet plans. ● There are six process capability levels starting from level 0 to level 5. Next, we will look at a few questions based on the lessons covered so far.
About the On-Demand Webinar
About the Webinar