Aligning COBIT 5.0 and ISO/IEC 38500

greetings everyone and welcome in

today's webinar today we will be

discussing a very interesting topic from

risk and management portfolio topic

regarding the aligning cobit 5 and ISO

38,500 for Effective it governance my

name is albaa the PCB organizer of this

webinar and the guest for today is Mr

Orlando Alum the chief trainer for

training Heist limited please write your

questions and comments in the question

box in the right hand control panel and

Mr orando will answer to them

accordingly in the end of the

presentation please Mr Orlando you may

start the presentation thank you okay so

good uh it's afternoon where I am so

good afternoon everybody I hope

everybody can hear me clearly all right

my name is Orlando once again and uh

it's my pleasure to be here and I will

be driving this uh webinar today

aligning kid 5 and ISO

38500 that's a mistake actually it's

meant to ISO 38500 not not 38 5,000 ala

so please that uh we'll change that

before we put it up finally it's going

to be ISO

38500 for Effective it governance okay

so I've been doing it for definitely

more than a decade possibly a decade and

a half that I've been doing it and

especially around it management and

governance all right so I've been

exposed to the methodology called K from

the organization called isaka I

a CA they are also the owners of um

qualifications like cesa and CM I've

been exposed to the methodology from

version three I think now had to be

around 2003 uh thereabout um version

three of Co and I've been familiar with

version three version four version 4.1

and the latest of them now which is

called um kid 5 is the fifth version of

Co and I've been familiar with them and

I know what it is in terms of using it

for it governance but about a couple of

years ago I also came in contact with um

ISO

38500 which is Corporate governance um

uh um corporate governance for the

management of

it as a standard so when you look at the

new that new document you see that very

much they they referred a lot to K 5

inside of the document in itself okay

the the actual name for it is Corporate

governance of it all right so 38500 so a

lot of they referred a lot to K 5 inside

of it so by doing work for various

clients I noticed that if I'm going to

be able to do this effectively if I'm

going to be able to do deliver Isa 38500

effectively to a client or for a client

I have to literally be an expert at

using kit 5 because kit 5 is the

extended document that provides the

guidelines and a lot of uh guidance for

how to actually get an organization

certified on ISU 38500 so that's why we

came up with this topic and it's my

pleasure to be here okay I'll quickly

move on so I've said in here uh let me

just do this

okay so I said what does Co have to

offer and what is contained in the

extensive body of knowledge called kit 5

uh as far as version four kid 5 used to

be a 400 plus page document when they

came up with Co 5 almost two years ago

they completely blew it open and it's

become a much more Broad and a bigger

document than what it used to be okay so

now C is probably like almost 700 pages

of uh of of um of of work that is even

being improved and and added more more

more documents are added onto it on a

daily basis so we're going to look at

what it's got to offer and we're going

to look at what is the complimentary

value that ISO 38500 brings to an

organization so well that's going to be

the key point that we're going to be

looking at today okay so k k used to be

one one one document as I said you could

it gives to a 400 plus page document but

now K is a family of documents there is

the 94 95 page document which is the

framework which is like the Baseline

document that provides guidance to the

other parts then there the other

document that we call the enabling

process and the enabling information and

we also now have um the professional

guides and as of today you've got

implementation uh information security

Assurance risk so if you just what I

have on the board on on this slide says

that there what uh one two three four

five um six seven documents as are today

and none of those documents all of them

go about uh a 100 Page Plus some of them

go as much as 200 pages so you're right

to say that as of today K is the

Thousand Pages what of guidance for an

organization that is looking to do it

governance okay and um it's it's well

it's still relatively brand new very few

organizations are the ones that have

come up with it or sorry that are that

have adopted it as are today so still

very much brand new and um it's going to

it is the it is the document when it

comes to it governance it is the

guidance for the entire world when it

comes to it governance and as I go

through this slide you will see why it

is extremely important and why people

who do it governance need to have a huge

level of expertise using covid and why

anybody who's looking to do ISO ISO

38500 also needs to be able to know Co

adequately otherwise they will not be

able to effectively deliver ISO 38500

because the document in itself does

refer to Kit a lot okay all right so

once again you've got this diagram that

shows a lot of the documents so it said

that about at least seven documents as

today which will amount to about a,

Pages worth of um guidance for it

governance okay good so one of the

things that K talks about and anybody

who's been doing k for a while will

remember that

in version four it had something it

called it the characteristics of

information where it talks about

efficiency accuracy Effectiveness and it

came up with seven different

characteristics of information they're

still very much relevant so copy uses

the the concept of information it it

doesn't so a lot of people think that

it's about the technology no it is about

information so when you say Information

Technology primary is information

technology is secondary so k really does

look at information and says information

is a key resource for the Enterprise and

an organization needs to be able to

manage their information adequately from

when it is created to when it is

destroyed all right just to say that you

know the increasingly information is the

lifeline or the blood of the

organization so it's very important that

that anybody any organization clearly

understands the value of information

when you want to do it governance you

don't start from technology this is how

kit is different from it this is how kit

is different from toga or any of those

other methodologies it is complimentary

and it relies on a lot of those other

methodologies but very most importantly

is the fact that the information in

itself is what it is that drives the

organization okay information is the

blood is the lifeline of the

organization and it's it has to be

adequately and

appropriately uh managed okay so this is

very very important in fact in the C

document you have loads and loads of

pages that talks about information and

describes information the information

life cycle how it's created how it

should be managed we needs to work with

it you know it's it's extensive when it

comes to its description of information

okay I'll go on quickly so what are the

business concerns that have made us

develop the co guide or the C document

in itself first and foremost obviously

as I said is to ensure that the quality

of information that is used within the

business can be

reliable because business decisions are

made made based on information so it's

it's important that the

business is guaranteed that the

information that they have is clear and

it's useful now we say well generate

business value from it enabled

investment so the bus business just

interested in ited inuring that it

delivers value to them so it's important

and it is critical that um every

every where

information

driv you canot manage information

appropiately orology adequately except

you

andology

that you know in line reg that you stay

in line with everything thatat with

regards to the organizations these are

real business concerns that have driven

why uh K has been created and developed

uh for the use of the Enterprise okay so

apart from the concerns what is driving

this

right what's driving this and K has in

fact in this slide I only put about five

of them K talks about 11 things that are

driving the development of Co right one

of them obviously is saying that you

know to provide stakeholders with a lot

of comfort right if you look at the

first point it says determining what

they expect from information and related

technology benefits acceptable level of

risk at what cost so this is very

important these are the things that are

driving the use and develop velopment of

Co addressing the dependency of

Enterprise success on um external

business and it such as um Cloud

providers and service providers so this

conversation Rings true remember in itel

itel speaks about um having your three

types of service providers and your four

types of um of uh of suppliers it says

you should look at the categorization of

your suppliers because every it

Department every it department has a set

of service providers and a set of

suppliers so it's important that that is

managed dealing with the amount of

information that the Enterprise has got

to deal with so if you look at big data

and all the conversation around um all

the conversation around Big Data all the

conversation around the cloud usage and

storage it's all dealing with

information and ensuring that the

business has adequate information when

they need them yesterday night I was

still reading an article that was

focused on on how Hardo has um

metamorphosized into spark and how spark

has metamorphosized into a new one the

and everybody's talking about how these

huge database systems are helping

organizations with regards to storage

and how information is been provided so

that's important also the technology

changes every Mone every day there's a

new invention from a techn from

technology provider whether it's

Microsoft or Cisco or it's Oracle or

Citrix or vmw

there's a new conversation on a daily

basis with regards to um uh it so it

needs to be managed adequately because

also the investment in it has become

very much material right further to that

uh Innovation so I I take I mean I work

with organizations in trying to help

them develop their Innovation

capabilities now one one consistent

conversation that keeps coming up is uh

how can we innovate and I say you can't

innovate without it this is 2015 it

cannot be done the how well you can

innovate is very much dependent on how

well you know how to use it so um

whether you're using websites whether

you're using social media whether you're

using mobile apps it all comes down to

that so because of these varying

issues right those are the drivers for

the development of K 5 in itself so let

me quickly get to this K talks about

five principles ISO 38500 also talks

about six principles all right each of

the principles have been named

differently and are uh are addressing

different things but there's an

alignment between the five principles

that are in kit 5 and the six principles

that is 38500 speaks about but the core

of the co document is around these five

principles meeting stakeholders needs

covering the Enterprise ENT to end

applying a single integrated framework

enabling a holistic approach and

separating governance from management

these are the five uh principles that

drive an organization from a CO

perspective and I'll quickly go into

them so number one says meeting

stakeholder needs it says that the idea

behind information and information

technology will be to give Comfort to

stakeholders to meet their needs

actually K came up with a with a list of

22 two

broad needs of businesses I mean 22

needs of businesses with regards to um

the needs of businesses a long list of

22 items that are that most businesses

will find out are their stakeholder

needs right also within stakeholder

needs it talks about the concept of

value creation and since the value

Creation in itself is a governance

objective just like strategy it is a

governance objective right I mean if you

as I said once again if you've been

doing Co for a while is see what the the

value creation relies on what benefit

realization ensuring that you optimize

risk and you optimize resources so those

three key things are very important when

you think about value and says here

clearly Enterprises exist to create

value for their stakeholders so when

we're talking about stakeholders here we

mean both internal and external

stakeholders so you've got to think

about what is important to the

stakeholders and how

um information Tech information and

related technology can help uh provide

that value to stakeholders so that's

what governance is about it's about also

it's also about negotiating it's about

negotiating and deciding among different

stakeholders their value interest and

the government governance system should

consider all stakeholders when making a

all these decisions around benefit

realization and risk optimization and

resource

optimization so it's important and

essential that you understand that who

are the stakeholders and what exactly

are their requirements especially from a

value perspective okay um so K is go

everybody needs to um to go register on

the on the isaka website so that they

can get their own personalized versions

of um of the kit document because you

you it does it's a brilliant it's a

brilliant set of documentation it comes

it's got 17 Enterprise goals that it

came up with saying that these are the

top 17 things that are important to an

organization then it came up with

another 17 related it goals and then it

puts up a metric that aligns the

Enterprise goals to the it goals using

primary and secondary relationships it

was brilliant was the work of a genius

in reality and I already mentioned to

you it came up with 22 uh stakeholder

needs or business needs needs so all

these are within the document and he

uses the the popular balance score card

so it just didn't come up with 17 things

as a long list it came up with 17

different things aligned to the seven

perspectives of the balance score card

so it was really brilliant work so you

can look at the financial objectives of

a business the customer objectives the

internal process objectives and the

people objectives of a business on the

Enterprise and also from an IT

perspective and he shows how these 22

business needs are cascaded into 17

Enterprise goals cascaded into 17 it

related goals before we then come up

with what is referred to as the enaer

goals so this is real good guidance for

it departments everywhere to be able to

use to drive uh their work with regards

to to Co in itself all right so the next

uh principle I should have put principle

two here says it covers the entire

Enterprise Co is not just for a

department it's not just for a unit it's

not just for the head office K covers

the entire organization end to end so

when K uses the concept of end to end it

means it covers the entire organization

from beginning to the end all right so

it's integrated governance for the

entire organization it covers all

functions and processes within the

business whether they in internal or

external so it doesn't matter the

department you cannot say that oh a

particular department is exempt no all

the department in the organization are

adequately covered and look looked after

within the co document okay um then he

talks about something called a

governance approach once again it brings

some roles together and he says that

there's a set of roles called the owners

and the

stakeholders you can call that the

people the shareholders of the business

and the delate their governance

responsibility they delegate it to the

Govern to the governing body the

governing body in in turn is accountable

to the stakeholders that's very

important the governing body sets

directions for management so that

management will be the third set of

people that we're talking about here or

the thir set of roles management and

management in in turn is monitored

by by the government body so the

government body sets direction for

um and um they also

monitor the things that they've set the

objectives that have been set for them

finally management instructs and aligns

operations and execution and they in

turn they report they report to

management so this is very important

delegation in terms of understanding who

the owners and stakeholders are the

government body the management and in

turn and finally operations and

execution so these are four roles and

this talks about governance so I I think

governance is a board conversation there

should be a subcomittee at the board

level not just at the management level

at the board level for it governance and

this is not the it steering committee

this is a different committee looking at

the governance of it the third principle

here talks about applying a single

integrated framework and all it just

says in here is that you know K works

with every other framework is before

they developed Co had loads of other

documents V it risk it all sorts of

other documents hope it

integrates clearly and cleanly with all

those documents number two to integrate

K integrates with everything whether

it's TOA for Enterprise architecture it

for IT service management or any of the

ISO standards they're all adequately

integrated with Co with Co okay number

four it talks about the holistic

approach so this holistic approach says

that you know there are seven enablers

and from a from a CO perspective these

seven things are the things that enable

an organization to achieve it governance

first and foremost is the principles the

policies and the Frameworks number two

are the processes number three is the

governance are the organizational

structures four is the culture the

ethics and the behavior of the people

five is information six is Services

infrastructure and application and

finally it is people skills and their

competences so holistic approach

literally just says that you know what

you've got to look at these seven things

it calls them

enablers so you can and if you can see

from the list some of them are soft some

of them are

hard so if you look at the things that

are soft is principles processes

organization of the structure culture

ethics the concept of information

people's skills and competences these

are a lot of the things that people

would do it usually forget about they

forget about this they leave it out they

don't take it into consideration and Co

says that you've got to you've got to

take these seven enablers that's what it

calls them Kit has got this brilliant

diagram where it connects the seven of

them and you can see Information

Services infrastructure and people below

all of them connecting to the central

backbone the in this instance is like

the ESB like the Enterprise service BS

here is the principle the IES and the

Frameworks that are adopted by the it or

by the organization in itself so it's

brilliant when it comes to to getting

this done that's is what it calls

holistic all right and finally Kobe

talks about okay before that uh it talks

about enabling process and this enabling

process says that each of those seven

enablers that we've looked at it

provides adquate guidance to ask a

couple of questions I actually have a

document that I did where I created um

the the the seven

enablers um on the as R headers and I

put stakeholder goals life cycles and

good practices as column headers so for

each of those enablers you will have

stakeholders that are

applicable goals that are

applicable life cycle that is applicable

to each of them and good practices that

means for seven different enablers for

each one of them yeah K talks about

their stakeholders their goals their

life cycle and their good practices it

was great work it's brilliant work that

was done further to that he also talks

about Performance Management which says

that you know what those seven enablers

how do we judge them in terms of their

performance what are the metrics that we

can use to to measure whether they are

happening

effectively wise so it will ask you

these generic questions saying that a

stakeholder needs a addressed enable

goals achieved then say that is life

cycle manag and are good practices

applied and of course if you look at

this it clearly shows that some of them

are leading indicators and some of them

are lagging indicators so to speak so

some of them they're before the fact

it's they're like um critical success

factors like the lead indicators you put

them in place ahead of time before time

while the lagging indicators are after

you you those are that's how you will

check whether things are functioning

effectively

so it's kind of a post uh is the post

indicators while the lead indicators

they are pre- indicators okay so the

fifth principle which is also which is

really where I think

um I think this is the high this is the

high point of of this entire thing it

talks about separating governance from

management I think this is the this is

the high point of everything when K came

up we 37

different

processes and amongst the 37 he CED out

four five of them and called them

governance processes and it then created

Five domains and one of those domains is

a governance domain I think it was the

wor I think it is great because hearing

lies a real difference because a lot of

people are confused and say what does

itel give that K does not give what does

k have that this does not have the key

thing is that K emphasizes five

processes that are strictly governance

processes not management processes so K

makes a clear distinction between what

is the governance of it and what is the

management of it okay so governance

ensures that stakeholder needs

conditions and options are evaluated

management plans builds and runs and

monitors the in alignment with direction

that has been sent this is key and this

is fundamental that you understand the

difference between

governance and management okay so before

I go to the what I'll consider to do the

most important slide of this entire

presentation I I'll stop here first

which is this slide that so there are

four domains the first domain is called

the EDM right evaluate Direct monitor

right which is the governance domain and

then the other four domains which you

call the nickname for them I like to say

it's plan build run and monitor even

though um that's not the full name right

so uh but those are that's how the the

the that's what I I like to call the

nicknames of these four domains and it's

important that you understand all these

four domains adequately APO means align

plan and organiz

build means build acquire and Implement

run means deliver service and support

and the final one which is called

monitor talks about um uh uh monitor

evaluate and assess I've also done some

other documents where I've aligned those

four primarily to itel to try and draw

parallels between itel and these four

domains but iel does not speak about

governance governance primar is champion

and described by Co and hearing Li is

the great thing when it comes to co so

these are the five domains if I move

into this diagram and if you if you have

if you can't remember anything that I've

said and if you forget this entire

presentation do not forget this slide

this slide is the single most important

slide um uh on this presentation and it

talks about these five domains and it

then brings the 37 different processes

it brings them into these five domains

I'm going to need you to look at this so

if you look at the top five the top five

are all governance ensuring the

governance framework setting and

maintenance benefits delivery risk

optimization resource optimization

stakeholder transparency they all belong

to K to the governance domain then we

move to align plan and organize and

there you see the it management

framework is literally ref findy to itle

there talks about man strategy you can

see manage Enterprise architecture it's

referring to TOA there manage Innovation

manage portfolio right budget and cost

financial management that's what it's

saying Human Resources relationship

service agreements Supply management

quality managing risk and um finally

managing security so there the 13 of

them under align plan and organized and

some of you who are very familiar with

it we already see some similarities in

that all right uh so it has borrowed

some of them but it has made it much

more extensive so it also has build

acquire and Implement which align to the

things that you will find under service

design in it right one of the great

things I like about this it's separated

it's brought up the conversation of

program and project management which it

does not focus on the law and it's

brought up the conversation around

organizational change which is

brilliant this is not talking about

chain management as it people understand

it like rfc's and things like that this

is talking about organizational chain

management then he also talks about

deliver Services support manage

operations which is very much like

operations and itle and finally it's got

monitor evaluate and assess which is

very much like CSI so there are very

there a lot of alignment between kit and

it but the brilliant portion in here are

the things that it cover and the

governance layer that is on this diagram

once again if you can't remember this

entire presentation and you can't

remember anything that we must have said

please remember this particular uh slide

as it is these are the 37 processes for

governance and management is called the

process reference model and there are 37

of them right it is extensive it is a

brilliant piece of work that has been

done and anybody who is in it governance

needs to be familiar with this Tech

seven um uh it processes all right good

so there's a there there a full document

that Kit's got the the document is

called the implementation guidance

document and it gives a lot of guidance

in terms of how do you use kit how do

you get value out of Kit what triggers

kit usage who should be using Coit

during the life cycle of an organization

when should they use Co so it's also a

really great document it's one of the

seven documents that I described

uppr and it just gives implementation

guidance on how Co is is meant to be

used okay so it does talk about some

some success factors for implementation

top management everybody knows that it

governance belongs to the board and the

board has to show that they really do

know and understand it governance all

parties supporting the governance

andmental processes to understand the

the

an IT objectiv tailoring kit so kit does

require a lot of expertise so I work

with a lot of organizations sometimes

that are struggling from they know what

Co is they have the documentation they

bought it but they still don't how to

use it so it doesn't need a lot of

tailoring so that an organization can

get adequate value from it okay um and

there a lot of factors within the the

the internal and exteral Enterprise

environment that must be taken into

consideration the ethics of the

organization their mission their goals

their Opera operative model their

management style their risk Capital all

that has got to be adequately taken into

consideration all right so this is

another great piece of work that was

done by K it it's called The

implementation life cycle it's also very

brilliant it it decides to look at the

implementation not just thinking about

it from a project or program perspective

but it looks at it from four different

perspectives first and foremost is um it

would ask you the same questions that

you have on in itle used to be called

the or it's called the CSI approach

where it says that you know you just ask

you some questions where are we now

where do we want to be where do we need

to be how do we get there all those

questions right but it then brings the

next layer we talks about program

management and he says that you know

what from a program perspective how do

we manage implementation from a program

perspective that he says that there's

another layer which a lot of it people

fail to realize

I've suffered a lot from that we talks

about change enablement it projects are

change projects they organizational

change initiatives and every

organization needs to adequately manage

those change initiatives to be able to

get adequate um adequate value from this

so it's important and it's extremely

essential that um you drive this from a

change perspective otherwise you will

not get value out of using the

methodology like Co finally he also

talks about the continual Improvement

life cycle which is really good which

also just says that you know how do we

ensure that whatever good work we've

done today is sustained within the

organization so the sustenance of the

great work that is done the measurement

and sustenance is very much almost

aligns to you know the seven step

Improvement life cycle in itel is what

this is about so this is also another

great piece of work done by Co that just

allows you to look at uh implementation

of Co in itself not just thinking about

it from a project or program perspective

but also thinking about it as a change

initiative and finally thinking about

how will the initiative be sustained

within the

organization all right great so K

borrows from K borrows a lot of

measurements from ISO okay there's a

method there's an ISO standard called

1550 War which a lot of people are not

familiar with he also borrows from

cmmi um because cmmi talks about both

maturity and capability models and I I

can't really go into the details of that

but if you if you know K4 and if you

know most organizations most people

speak about their matur the maturity of

their processes so they talk about a

maturity Model A lot of organizations

talk about a maturity model the maturity

of their processes

right Co goes further because cmmi also

goes further if you look at cmmi for

development specifically it not only

speaks about maturity of processes but

then also looks at the

capability capability is at a much lower

level so while maturity is looking at it

at a much higher level capability goes

into details and allows you to look at

processes at a low level right so the

capability talks about level 0 1 2 3 4

and five uh incomplete performed managed

established predictable and optimized

and the C document goes into a lot of

explanation into before you can judge an

organization and say your supply

management is established how did you

arrive at that what did they score how

did you look at it what was the criteria

all that information is is included in

some of the co documents but it's good

to understand that you can look at

processes not just from a maturity

perspective but also from a capability

perspective all right there been there's

been there's one of the the webinars

that I did hold with PCB and we talked

about we looked at cmmi specifically so

this is really great so you can look at

this it says you know incomplete perform

managed and what is the criteria of the

description for you to say that an

organization is at any of these levels

of uh capability so this is really

and this is great all right so enough

about Co so that I don't spend the

entire day speaking about Co once again

as I said you really cannot do ISO 38500

except you know Coit because the iso 38

500 document in itself does refer Co in

itself so you can't really work with the

standard without understanding the best

practice and as I've said in time past a

lot of the standards are developed from

best practice so it's important that an

organization completely adopts a lot of

the best practice so the stand you can't

really if an organization wants to

achieve a proper standard they need to

go to ISO

38500 if the business want to plaque

they want to Brand themselves they want

to be able to say to people that you

know what we've achieved the iso

standard for it governance then they

need to go to ISO

38500 that is what they need to do so

it's important that people understand

where each of these things complement

each each other where does I 38500

compliment Co when we work for clients

we try and ensure that we marry these

four things together we marry ISO 38500

with 27 with 20 and with

2231 because it's easier to marry them

from a standard perspective I've seen

organizations sometimes they will write

all the standards that they write co co

it's not from ISO so if you're doing ISO

it makes sense that you marry the four

of them from an ISO perspective all

right so this is really good just like

27,000 relies a lot on the nist document

in itself 20,000 relies on itail 38,000

uh 38500 relies on Co so it's good that

you can draw a line and marry this

together but I've seen a few

organizations who are adopting 38 by

so as part of that adoption process

they've got to really do a lot of Coit

work and this is this would really be

great and interesting all right so

um so what I 38500 focuses primarily on

governance it does not speak about the

extensive part when you start to look at

all the 37 uh processes and all the

stuff that's got to do with management

no it really just says you know

directors should govern it and they

should do it through three main tasks

right and the number one task is

evaluate the current and future use of

it direct preparation and implementation

plan monitor confirmance confirmance so

the standard in itself sets out six

principles for good corporate governance

so uh and this principles they express

the preferred Behavior with regards to

decision making um the statement of each

principle refers to what should happen

but does not necessarily talk about how

you should refer to K for that and each

of the principles is then tied to to the

model so it's good that you see

something like this so we talk about the

business pressures business needs

corporate governance of it we talked

about EDM earlier in Co evalate direct

and monitor and plans and policies

proposals come from the businesses and

how this affects ICT projects and

operations

so this this is really what it is it's

good to achieve a 38500 but you cannot

achieve 38500 except you've already done

Co I will I will I cannot overstress

that so it will be good that you you you

know that and that you take that into

consideration okay good so I'll move on

I'll quickly speak about these five uh

principles so that we can Round Up

principle number one just talks about

responsibility so the business and the

it should collaborate in a

partnership utilizing appropriate

communication to ensure that you know it

is done appropriately then the it

executive themselves uh acting on behalf

of the board and chaired by Bo is very

It's very effective mechanism for

evaluating directing it directors of

small

organizations should get very much

involved with what is happening from an

IT perspective that's why you see that

some small organizations um

literally uh of it reports to chief

operations officer in some organizations

so um so talk about responsibility being

one of the principles the other

principle here it talks about strategy

so it says that you know strategy is

extremely complex it needs to be

involved at the strategy level it should

not wait till the end it should not be

fed secondary information it needs to

work closely with the business to ensure

that you know um they understand the

strategy and that they can deliver very

much in line with the strategy of the

business once again K does an extremely

good job of explaining a lot of this ISO

38500 when you buy it from the

site it's just about I think it's

probably less than 20 pages and it just

speaks about these things at the high

level if you really want to get this and

to understand how we should do it you

need to refer to the co document okay um

and yeah so it talks about balance C

card aligning balance score card um from

the business and the IT balance score

card so balance score card is not just

used by the business is also used by the

IT department so you can have you can

have an IT balance for then we have what

is referred to as

acquisition and I already mentioned how

important service providers and vendors

are within the entire uh space of um of

it governance so uh acquisition of

anything that is it in terms of

resources needs to be looked at

adequately it needs to be managed it

needs to be aligned and you need to

ensure that you get the adequate return

on investment you've got to pick the

right technology you've got to pick the

right technology

provider these things are very important

before value can be delivered so

technology has got to be both fits for

Value I fit for use and fit for purpose

in itself so it's got to meet both the

utility and the warranty um um

components as it is so it Solutions

support the business so acquisition has

got to be looked at you don't just allow

procurement departments sometimes that

do not understand how it should be

procured to go ahead with it without

adequately involving the IT department

okay or the people who know about it so

there must be a lot of governance around

the acquisition of it that's what this

is saying and principle four once again

is talking about

performance says the performance is got

to be looked at you've got to come up

with your csfs and your kpis and all

this to be adequately looked at in terms

of Performance Management um uh we

looked at lagging indicators leading

indicators uh key goal indicator s key

performance

indicators and um performance in itself

even needs to be sustained and you know

what they say if you can't measure it

then it does not exist so it's important

that you understand how performance

Works how performance measurement should

be done and how if you need to build the

performance scorecard how it should be

done for it and the metrics that you're

using for it governance are they the

appropriate metrics and do they provide

the right information so apart from

performance is also the concept of

conformance conformance just says that

it governance we should be worried about

regulatory issues we should be worried

about statutary issues we should be

worried about um whether we're meeting

everything that's got to do with Law and

Order meeting all of them in place and

you know so it's for in a lot of

countries um ISO 27,000 ISO 20,000 even

ISO 38500 is not a nice to have it's a

must have especially in the financial

services industry so the conversation

around meeting regulatory requirements

is a boardroom discussion that needs to

be had and had

regularly um and that's what conformance

is referring to right so are we

conforming to everything that has been

laid down finally there's a people

element to it do we have the right

people are people doing the right things

are they adequately trained do we have

the right skills within the IT

department to deliver value to the

business you know within an ISO there's

not one of the things you look at within

an ISO assessment in in an organization

do they have skilled people do they have

trained people so these things are very

important for me human behavior

perspective and it's very important and

essential that all this is adequately

done so that's primarily it from an is 3

38500 perspective it really really just

looks at these seven principles and

refers to co a lot it is really around

what is it that K does have to offer to

the organization ation remember what it

is that I said that I gave you the 37

processes within K and how governance

has been separated from management and

the7 person are very important then I

showed you this one that talked about

how it governance needs to be

implemented in an organization not just

thinking about it from a program

perspective but thinking about it from a

program change and continual Improvement

uh perspective and finally is about the

adoption of cmmi capability measurement

capability model for using it within it

governance not just using the maturity

model so this is a significant

Improvement on of version five over um

the kit version version four as it is

all right so and of course the six

principles that are discussed under ISO

38500 so primarily that is it um there's

not a whole lot that is about about this

Beyond this uh I believe we're going to

put this up up on the internet and

people can download it and um they can

listen to this again and they can

download some of the materials all the

diagrams and a lot of those things

belong directly to isaka and I've

already said mentioned that in my

presentation so for for you to

effectively do it governance or for you

to have effective it governance you've

got to marry these two you've got to

marry kit 5 and ISO 38500 effectively

for an

organization okay okay thank you very

much I would like to take the questions

now uh thank you very much for this

presentation uh Mr Orlando uh we have a

few questions over here I will start and

uh you may answer just a few of them uh

the first one is um are there other

major are there any other major

differences among CIT 4.1 and CIT

5 oh well there quite a bit a lot of the

differences apart from the use of

maturity and capability there there a

couple of other differences the way of

course I mean um they've separated it

they've added the governance layer to it

and the process is here now 37 which is

much more than what you used to have in

um uh kit 4 in itself and um the way the

extra documents have also been done it's

much broader than what it is the older

Coit did not take risk it V it all those

documents into consideration but 5 has

added all of them so all in all I'll say

that there probably a 50% difference

between 4 and five so it's quite huge in

terms of the additions that have been um

added onto

it thank you the next question is uh can

I use cobit 5 as a statement for

criteria for specific audit

conclusions oh yes so very very much uh

a lot in fact a lot of people when it

comes to their audit the controls and

the findings and the conclusions a lot

of what it is that is being used by a

lot of organizations is taken directly

out of K

5 as at today so yes you can use it for

your audit conclusions and you can use

it to defend and substantiate your

position once once you follow through

with covid there can't be anything

higher than

that okay yes thank you uh the third

question is uh which businesses are

using more C

5 uh every industry every single

industry uh Financial Services probably

possibly be number one

telecommunications

Manufacturing Services industry

everybody there's no better

governance it governance methodology in

the world that Co 5 right now so

everybody who is concerned about it

governance in every single industry is

using C

SP thank you uh the next question is

what is the the difference between ISO

38,500 2015 and ISO 38,500

2008 what was the other one that you

said I didn't hear

that I didn't I didn't get

that uh may I repeat the

question yes please what is the

difference between ISO

38,500 2015 with ISO

38,500 2008

oh yeah well I mean the the 2015 version

is better aligned to Kit that's the

primarily that's it so the 2015 version

it refers to Kit 5 in fact it really

does it's really about kobit 5 it just

provides some extra guidance that I

showed within those um principles but

it's better aligned the older version

the

2008 um referred to the older k a bit

but this new one really refers to K 5

the major

difference and the last question is um

is the cobit 5 framework superior to the

other

Frameworks as such as I I and ISO

27,000

series I don't think it's it's about

superiority that's a that's not a word

that I want to use but I would say it's

much more complete it looks at it from a

much broader perspective looks at the

business more thoroughly

and um then you know brings in much more

than how it looks at it it's beyond

service management is beyond Enterprise

architecture it is beyond all the things

so I'll say it's much more holistic much

more complete um in comparison but I

would say

Superior uh thank you again Mr Orlando

for this excellent presentation um I

want to thank all the attendees as well

for taking the time out of your business

schedule to join us we hope you enjoy

this webinar we have received all your

question and because the time is limited

we will answer to your question

individually by email please check pcb's

webinar schedule in our website www.

pcb.com or our official soci social

media Network since next week we are

organizing webinars on interesting

topics next Monday on 9th of October we

are hosting a webinar on the topic ISO

21,500 a guidance to project managers on

ISO 21,500 project manag management

standard thank you again and see you in

the next webinars thank you Mr

Orlando all right thank you very much

thank you much appreciated all right