COBIT® 5 Process Capability Assessment Model Tutorial

This lesson is a part of the COBIT 5 Foundation Certification Course and covers the measurement framework, Process Attributes and process capability levels of COBIT® 5 process capability assessment model.

Let us begin with the objectives of this lesson.

Objectives

By the end of this lesson, you will be able to:

  • Define Process Attributes

  • Discuss assessment indicators

  • Explain how to assess process capability

  • Describe process capability levels and Process Attribute rating scale

In the next section, we will focus on measurement framework.

Measurement Framework

The COBIT® assessment process measures the extent to which a given process achieves specific attributes relative to that process, called Process Attributes or PA. The assessment process defines nine Process Attributes based on ISO/IEC 15504-2

which are as follows:

  • PA 1.1 Process performance

  • PA 2.1 Performance management

  • PA 2.2 Work product management

  • PA 3.1 Process definition

  • PA 3.2 Process deployment

  • PA 4.1 Process measurement

  • PA 4.2 Process control  

  • PA 5.1 Process innovation and

  • PA 5.2 Continuous optimization

In the next three sections, we will focus on the three Process Attributes namely,

PA 1.1 Process performance,

PA 2.1 Performance management and

PA 2.2 Work product management.

Preparing for COBIT 5 Certification? Take this Practice Test to check where you stand!

Process Attribute 1.1—Process Performance

Let us begin our discussion with PA 1.1 Process performance

The process performance attribute is a measure of the extent to which the process purpose is achieved. As a result of the full achievement of this attribute, the process achieves its defined outcomes.

Next, we will discuss PA 2.1 Performance management

Process Attribute 2.1—Performance Management

Performance management is a measure of the extent to which the performance of the process is managed. As a result of the full achievement of this attribute:

  • objectives for the performance of the process are identified.

  • performance of the process is planned and monitored.

  • performance of the process is adjusted to meet plans.

  • responsibilities and authorities for performing the process are defined, assigned and communicated.

  • resources and information necessary for performing the process are identified, made available, allocated and used.

  • interfaces between the involved parties are managed to ensure effective communication and clear assignment of responsibility.

In the next section, we will focus on the third attribute that is PA 2.2 Work Product Management.

Process Attribute 2.2—Work Product Management

Work Product Management is a measure of the extent to which the work products produced by the process are appropriately managed. As a result of the full achievement of this attribute:

  • requirements for the work products of the process are defined.

  • requirements for documentation and control of the work products are defined.

  • work products are appropriately identified, documented and controlled.

  • work products are reviewed in accordance with planned arrangements and adjusted as necessary to meet requirements.

In the next section, we will focus on the assessment indicators.

Assessment Indicators

The image shows the assessment indicators in the capability and process dimensions. Following are the points to be noted here:

  • For each Process Attribute, the process capability assessments from level 1 to level 5 are based on the Process Attribute Indicators or PAI consisting of:

  • Generic Practice or GP which are activities of a generic type and provide guidance on the implementation of the attribute's characteristics.

  • Generic Resources or GR which are the resources that aid in achieving the Process Attributes; and

  • Generic Work Product or GWP which are indicators that are sets of characteristics expected to be evident in work products of generic types as a result of achievement of an attribute.

  • These are further amplified for Process Attribute 1.1 that is process performance consisting of additional performance assessment based on the performance indicators:

  • Base Practices or BP and o Work Products or WP •

  • It is also to be noted that as per COBIT®4.1 model, there are only 3 types of processes as depicted in the image consisting of primary processes, supporting processes and organizational processes.

In the next section, we will look at the same image but with COBIT® 5 Process Reference Model or PRM (read as P-R-M).

Indicators with COBIT® 5 PRM

In COBIT® 5 PRM, there are 5 types of processes as depicted in the image.

The 5 processes are:

  • Evaluate, Direct, Monitor or EDM 

  • Align, Plan, organize or APO

  • Build, Acquire, Implement or BAI 

  • Deliver, Service, Support or DSS 

  • Monitor, Evaluate, Assess processes or MEA 

 You should consider taking a COBIT 5 Certification Training course!

The image shows the assessment indicators with COBIT® 5 PRM.

The points to be noted here are:

  • For each Process Attribute, the process capability assessments from level 1.1 to level 5.2 is again based on PAI consisting of:

  • Generic Practice or GP

  • Generic Resource or GR

  • Generic Work Product or GWP

  • These are further amplified for Process Attribute 1.1 that is process performance consisting of additional performance assessment based on the performance indicators: o

  • Base Practices or BP

  • Work Products or WP

In the next section, we will discuss assessing process capability.

Assessing Process Capability

The table on the section lists the generic practices and work products for the Performance Management attribute.

 

Result of Full Achievement of the Attribute

 

Generic Practices (GPs)

 

Generic Work Products (GWPs)

a.Objectives for the performance of the process are identified.

GP 2.1.1—Identify the objectives for the performance of the process. The performance objectives, scoped together with assumptions and constraints, are defined and communicated.

GWP 1.0—Process documentation should outline the process scope.

GWP 2.0—Process plan should provide details of the process performance objectives.

b.Performance of the process is planned and monitored.

 

 

GP 2.1.2—Plan and monitor the performance of the process to fulfil the identified objectives. Basic measures of process performance linked to business objectives are established and monitored. They include key milestones, required activities,estimates and schedules.

GWP 2.0—Process plan should provide details of the process performance objectives.

GWP 3.0—Process performance records should provide details of the outcomes. Note: At this level, the record of process performance may be in the form of reports, issue registers and informal records.

c.Performance of the process is adjusted to meet plans.

GP 2.1.3—Adjust the performance of the process. Action is taken when planned performance is not achieved. Actions include identification of process performance issues and adjustment of plans and schedules as appropriate.

GWP 4.0—Quality record should provide details of action taken when performance is not achieved.

In the next section, we will focus on mapping Process Assessment Model or PAM to Process Reference Models or PRMs.

Mapping PAM to PRMs

To ensure the mapping of the PAM to the PRM, the following pointers are used:

  • A Process Assessment Model provides an explicit mapping from the relevant elements of the model to the processes of the selected Process Reference Model and to the relevant Process Attributes of the measurement framework.

  • The mapping must be complete, clear and unambiguous.

  • The mapping of the indicators within the Process Assessment Model will be:

  • the purpose and outcome of the processes in the specified Process Reference Model;

  • the Process Attribute including the results of achievements listed for each Process Attribute in the measurement framework.

The mapping enables Process Assessment Models that are structurally different to be related to the same Process Reference Model.

In the next section, we discuss the process capability levels.

Process Capability Levels

The image below lists the attributes of each process capability level. There are six levels of capability that a process can achieve, including an ‘incomplete process’ designation if the practices in it do not achieve the intended purpose of the process:

  • Level 0 is known as the Incomplete process. Here, the process is not implemented or fails to achieve its process purpose. At this level, there is little or no evidence of any systematic achievement of the process purpose.

  • Level 1 also known as the Performed process has one attribute. The implemented process achieves its process purpose.

  • Level 2 is known as the Managed process and has two attributes. The previously described performed process is now implemented in a managed fashion that is, the process is planned, monitored and adjusted and its work products are appropriately established, controlled and maintained.

  • Level 3 also known as the Established process has two attributes. The previously described managed process is now implemented using a defined process that is capable of achieving its process outcomes.

  • Level 4 known as the Predictable process has two attributes. The previously described established process now operates within defined limits to achieve its process outcomes.

  • Level 5 known as the optimizing process has two attributes. The previously described predictable process is continuously improved to meet relevant current and projected business goals.

It is to be noted that each capability level can be achieved only when the level below has been fully achieved. For example, a process capability level 4 which is, Predictable process, requires the process measurement and process control attributes to be largely achieved, and the attributes for the process capability level 3 to be fully achieved.

In the next section, we discuss the Process Attribute rating scale.

Process Attribute Rating Scales

The COBIT® assessment process measures the extent to which a given process achieves Process Attributes. This is expressed using the following rating scale:

  • N or Not achieved rating consists of Process Attributes with 0 to 15% achievement. There is little or no evidence of achievement of the defined attribute in the assessed process.

  • P or Partially achieved rating is made up of Process Attributes with 15% to 50% achievement. There is some evidence of an approach to, and some achievement of, the defined attribute in the assessed process.

  • L or Largely achieved rating consists of Process Attributes with 50% to 85% achievement. There is evidence of a sound, systematic approach to the significant achievement of the defined attribute in the assessment.

  • F or Fully achieved rating consists of Process Attributes with 85% to 100% achievement. There is evidence of a complete and systematic approach and full achievement of the defined attribute in the assessment.

In the next section, we will focus on Process Attribute ratings and capability levels.

Process Attribute Ratings and Capability Levels

The following table illustrates how the Process Attributes are organized into logical levels representing the capability levels. For example:

  • Achieving level 1 capability requires PA 1.1 to be fully or largely achieved.

  • Achieving level 2 requires both PA 2.1 and PA 2.2 to be fully or largely achieved and PA 1.1 to be fully achieved.

  • Achieving level 3 requires both PA 3.1 and PA 3.2 to be fully or largely achieved and PA 1.1, 2.1 and 2.2 to be fully achieved.

  • This continues till capability levels 4 and 5 are achieved. In the next section, we will discuss target process capabilities.

Target Process Capabilities

Depending on the purpose of the assessment, the assessed capability is compared with a target or desired capability. The table given below shows an example of the same:

This table may be used as reference while conducting actual assessments. As shown in the table, there is a target capability rating, for example, L or ‘Largely achieved’ and F or ‘Fully achieved’, for each of the processes and attributes. However, on assessment, the achieved rating may either fall short of the target rating or meet the target rating.

In the next section, we will focus on consequence of capability gaps.

Consequence of Capability Gaps

The ISO/IEC 15504 approach is not a risk-based assessment as per the Sarbanes-Oxley Audit standard 5 which recommends that organizations do a risk assessment to determine the areas to be audited and assessed.

It is a prescriptive approach for the assessment of process capability. Two facts on this approach are as follows:

  • an assessment is not done in isolation.

  • It is done for process improvement purposes

Therefore, deficiencies or gaps have some consequences.

The table below summarises the nature of any gap that may exist within a given process capability and the seriousness of consequence if such gaps are not plugged in or filled.

Capability level where the gap occurs

Nature of consequence

Seriousness of consequence

5—optimizing process

inability to achieve or evaluate process improvements

Lowest













 

Highest

4—Predictable process

Inability to quantify performance or detect problems early

3—Established process

Inconsistent process performance across the organization

2—Managed process

Cost or time overruns and unpredictable product quality

1—Performed process

Missing work products and process outcomes not achieved

It is very evident that if a gap occurs at level 1, leading to missing work products, the basic process outcomes are not achieved. It is the highest level of seriousness in terms of the capability of the process. Whereas, if a gap occurs at level 5 the seriousness of capability is low because the process is already quite capable and is delivering required outcomes. Therefore, risk assessment needs to be introduced at the process improvement stages and not at the process assessment stage.

Summary

Let us summarise what we have learned in this lesson:

  • The COBIT® assessment process measures the extent to which a given process achieves specific attributes relative to that process, called Process Attributes or PA.

  • Some assessment indicators are Generic Practice, Generic Resource, Generic Work Product and Base Practices.

  • Assessing process capability involves three steps, namely, identifying performance objectives, planning and monitoring process performance and adjusting process performance to meet plans.  

  • There are six process capability levels starting from level 0 to level 5.

The next lesson talks about Process Attributes and Process Capability Levels.

  • Disclaimer
  • PMP, PMI, PMBOK, CAPM, PgMP, PfMP, ACP, PBA, RMP, SP, and OPM3 are registered marks of the Project Management Institute, Inc.

We use cookies on this site for functional and analytical purposes. By using the site, you agree to be cookied and to our Terms of Use. Find out more

Request more information

For individuals
For business
Name*
Email*
Phone Number*
Your Message (Optional)

By proceeding, you agree to our Terms of Use and Privacy Policy

We are looking into your query.
Our consultants will get in touch with you soon.

A Simplilearn representative will get back to you in one business day.

First Name*
Last Name*
Email*
Phone Number*
Company*
Job Title*

By proceeding, you agree to our Terms of Use and Privacy Policy