Aligning COBIT 5.0 and ISO/IEC 38500

Greetings everyone and welcome in

today's webinar. Today, we will be

discussing a very interesting topic from

risk and management portfolio topic

regarding the aligning cobit 5 and ISO

38,500 for effective IT governance. My

name is Alba Keqa, the PCB organizer of this

webinar, and the guest for today is Mr

Orlando Olumide, the chief trainer for

training heist limited. Olease write your

questions and comments in the question

box in the right hand control panel. and

Mr. Orlando will answer to them

accordingly in the end of the

presentation please. Mr. Orlando, you may

start the presentation. Thank you. Okay, so

good. It's afternoon where I am, so

good afternoon everybody. I hope

everybody can hear me clearly, all right.

My name is Orlando once again, and

it's my pleasure to be here. And I will

be driving this webinar today,

aligning kid 5 and ISO

38500. that's a mistake actually. It's

meant to ISO 38500, not, not 38 5,000, Alma,

so please dear. We'll change that

before we put it up. Finally, it's going

to be ISO

38500 for effective IT governance. Okay.

So, I've been doing it for definitely

more than a decade, possibly a decade and

a half that I've been doing it, and

especially around it management and

governance all right. So I've been

exposed to the methodology called COBIT from

the organization called ISO/IEC.

They are also the owners of

qualifications like CESA and CM, I've

been exposed to the methodology from

version three. I think now had to be

around 2003 thereabout version

three of COBITS, and I've been familiar with

version three version four version 4.1,

and the latest of them now which is

called COBIT 5, is the fifth version of

COBIT. And I've been familiar with them, and

I know what it is in terms of using IT

for IT governance, but about a couple of

years ago. I also came in contact with um

ISO

38500, which is corporate governance.

Corporate governance for the

management of

IT as a standard. So when you look at the

new, that new document, you see that very

much they, they referred a lot to COBIT 5

inside of the document in itself. Okay.

The actual name for it is Corporate

governance of IT, all right. So, 38500 so a

lot of they referred a lot to COBIT 5. Inside

of it, so by doing work for various

clients, I noticed that if I'm going to

be able to do this effectively, if I'm

going to be able to do deliver ISO 38500

effectively to a client or for a client.

I have to literally be an expert at

using COBIT 5 because COBIT 5 is the

extended document that provides the

guidelines, and a lot of guidance for

how to actually get an organization

certified on ISO 38500. So that's why we

came up with this topic, and it's my

pleasure to be here. Okay, I'll quickly

move on. So, I've said in here. Let me

just do this,

okay. So I said, "What does COBIT have to

offer, and what is contained in the

extensive body of knowledge?" COBIT 5,

as far as version 4, COBIT 5 used to

be a 400+ page document when they

came up with COBIT 5 almost two years ago.

They completely blew it open, and it's

become a much more broad and a bigger

document than what it used to be. okay. So

now, COBIT is probably like almost 700 pages

of work that is even

being improved and added more more

more documents are added onto it on a

daily basis. So we're going to look at

what it's got to offer, and we're going

to look at what is the complimentary

value that ISO 38500 brings to an

organization. So, well that's going to be

the key point that we're going to be

looking at today. Okay, so COBIT used to be

one one one document, as I said you could

it gives to a 400 plus page document. But

now, COBIT 5 is a family of documents. There is

the 94/95 page document, which is the

framework, which is like the baseline

document that provides guidance to the

other parts then there the other

document that we call the enabling

process and the enabling information. And

we also now have the professional

guides, and as of today, you've got

implementation information security

assurance risk. So if you just, what I

have on the board on on this slide says

that there, what, one, two, three, four,

five, six, seven documents as of today

and none of those documents, all of them

go about a 100 page, plus some of them

go as much as 200 pages. So you're right

to say that as of today, COBIT is the

Thousand Pages what of guidance for an

organization that is looking to do IT

governance. Okay, and it's, it's well,

it's still relatively brand new, very few

organizations are the ones that have

come up with it, or sorry that are that

have adopted it as are today. So still

very much brand new. And, it's going to,

it is the, it is the document when it

comes to IT governance. It is the

guidance for the entire world when it

comes to IT governance. And as I go

through this slide, you will see why it

is extremely important, and why people

who do IT governance need to have a huge

level of expertise using COBIT, and why

anybody who's looking to do ISO, ISO

38500 also needs to be able to know COBIT

adequately. Otherwise, they will not be

able to effectively deliver ISO 38500

because the document in itself does

refer to COBIT a lot, okay. All right. So

once again, you've got this diagram that

shows a lot of the documents. So it said

that about at least seven documents as

today which will amount to about a

pages worth of guidance for IT

governance, okay. Good, so one of the

things that COBIT talks about and anybody

who's been doing COBIT for a while will

remember that

in version four, it had something. it

called it. the characteristics of

information where it talks about

efficiency, accuracy, effectiveness. And it

came up with seven different

characteristics of information. They're

still very much relevant. So, COBIT uses

the concept of information. It

doesn't, so a lot of people think that

it's about the technology, no. It is about

information, so when you say Information

technology primary is information

technology is secondary. So COBIT really does

look at information and says, "Information

is a key resource for the enterprise." And

an organization needs to be able to

manage their information adequately from

when it is created to when it is

destroyed all right. Just to say that you

know the increasingly information is the

lifeline or the blood of the

organization. So it's very important that

that anybody, any organization clearly

understands the value of information

when you want to do IT governance. You

don't start from technology. This is how

COBIT is different from IT. This is how COBIT

is different from Toga or any of those

other methodologies. It is complimentary

and it relies on a lot of those other

methodologies, but very most importantly

is the fact that the information in

itself is what it is that drives the

organization, okay. Information is the

blood is the lifeline of the

organization. And it's, it has to be

adequately and

appropriately managed, okay. So, this is

very very important in fact in the COBIT

document, you have loads and loads of

pages that talks about information and

describes information. The information

life cycle how it's created how IT

should be managed. We needs to work with

it you know it's, it's extensive when it

comes to its description of information,

okay. I'll go on quickly. So, what are the

business concerns that have made us

develop the COBIT guide or the COBIT document

in itself first and foremost, obviously,

as I said, is to ensure that the quality

of information that is used within the

business can be

reliable because business decisions are

made based on information. So, it's

it's important that the

business is guaranteed that the

information that they have is clear and

it's useful. Now, we say well generate

business value from IT enabled

investment. So the business just

interested in, that IT

delivers value to them. So it's important

and it is critical that every

every where

information

driven, you cannot manage information

appropriately, orology, adequately except

you,

andrology

that you know in line regulations that you stay

in line with everything that with

regards to the organizations. These are

real business concerns that have driven

why COBIT has been created and developed

uh for the use of the Enterprise, okay. So

apart from the concerns what is driving

this,

right, what's driving this and COBIT has. In

fact, in this slide, I only put about five

of them COBIT talks about 11 things that are

driving the development of COBIT, right. One

of them obviously is saying that you

know to provide stakeholders with a lot

of comfort, right. If you look at the

first point, it says determining what

they expect from information and related

technology benefits acceptable level of

risk, at what cost. So, this is very

important. These are the things that are

driving the use and development of

COBIT addressing the dependency of

enterprise success on external

business and it such as Cloud

providers and service providers. So this

conversation rings true. Remember in IT,

IT speaks about having your three

types of service providers, and your four

types of suppliers. IT says,

you should look at the categorization of

your suppliers because every IT

department, every IT department has a set

of service providers, and a set of

suppliers so it's important that that is

managed dealing with the amount of

information that the enterprise has got

to deal with. So if you look at big data

and all the conversation around all

the conversation, around big data, all the

conversation around the cloud usage and

storage it's all dealing with

information, and ensuring that the

business has adequate information when

they need them. Yesterday night, I was

still reading an article that was

focused on on how hard has

metamorphosized into spark and how spark

has metamorphized into a new one. The,

and everybody's talking about how these

huge database systems are helping

organizations with regards to storage,

and how information is been provided. So,

that's important also the technology

changes everybody, every day. There's a

new invention from a technology, from

technology provider whether it's

Microsoft or Cisco or it's Oracle or

Citrix or vmw.

There's a new conversation on a daily

basis with regards to IT. So IT

needs to be managed adequately because

also the investment in IT has become

very much material, right. Further to that

innovation, so I take, I mean I work

with organizations in trying to help

them develop their Innovation

capabilities. Now, one one consistent

conversation that keeps coming up is,

"How can we innovate?" And I say, you can't

innovate without IT. This is 2015 IT.

cannot be done. The how well you can

innovate is very much dependent on how

well you know how to use it. So

whether you're using websites whether

you're using social media, whether you're

using mobile apps, it all comes down to

that so because of these varying

issues right. Those are the drivers for

the development of COBIT 5 in itself. So let

me quickly get to this COBIT talks about

five principles. ISO 38500 also talks

about six principles, all right. Each of

the principles have been named

differently and are addressing

different things, but there's an

alignment between the five principles

that are in COBIT 5 and the six principles

that is 38500 speaks about. The core

of the COBIT document is around these five

principles meeting stakeholders, needs

covering the Enterprise ENT to end

applying a single integrated framework

enabling a holistic approach and

separating governance from management.

These are the five principles that

drive an organization from a COBIT

perspective. And I'll quickly go into

them so number one says meeting

stakeholder needs IT says that the idea

behind information. And information

technology will be to give comfort to

stakeholders to meet their needs

actually COBIT came up with a with a list of

22

broad needs of businesses. I mean 22

needs of businesses with regards to

the needs of businesses. A long list of

22 items that are that most businesses

will find out are their stakeholder

needs, right. Also, within stakeholder

needs, it talks about the concept of

value creation and since the value

creation in itself is a governance

objective, just like strategy. It is a

governance objective, right. I mean, if you,

as I said once again, if you've been

doing COBIT for a while is see what the

value creation relies on what benefit

realization, ensuring that you optimize

risk and you optimize resources. So those

three key things are very important when

you think about value, and says here

clearly, enterprises exist to create

value for their stakeholders. So when

we're talking about stakeholders here, we

mean both internal and external

stakeholders. So you've got to think

about what is important to the

stakeholders and how

information, tech information and

related technology can help provide

that value to stakeholders. So that's

what governance is, about, it's about also

it's also about negotiating. IT's about

negotiating, and deciding among different

stakeholders their value interest and

the government governance system should

consider all stakeholders when making a

all these decisions around benefit

realization and risk optimization and

resource

optimization. So it's important and

essential that you understand that who

are the stakeholders and what exactly

are their requirements, especially from a

value perspective. Okay, so COBIT is,

everybody needs to, to go register on

the on, the ISAKA website, so that they

can get their own personalized versions

of the kit document because you,

you, IT does, IT's a brilliant, IT's a

brilliant set of documentation, IT comes.

IT's got 17 Enterprise goals that it

came up with saying that these are the

top 17 things that are important to an

organization. Then it came up with

another 17 related IT goals. And then IT

puts up a metric that aligns the

Enterprise goals to the IT goals using

primary and secondary relationships. IT

was brilliant, was the work of a genius.

In reality, and I already mentioned to

you, IT came up with 22 stakeholder

needs or business needs, needs. So all

these are within the document, and he

uses the popular balance score card

so IT just didn't come up with 17 things

as a long list. It came up with 17

different things aligned to the seven

perspectives of the balance score card.

So it was really brilliant work. So, you

can look at the financial objectives of

a business, the customer objectives, the

internal process objectives and the

people objectives of a business on the

Enterprise. And also from an IT

perspective, and he shows how these 22

business needs are cascaded into 17

Enterprise goals, cascaded into 17 IT

related goals before we then come up

with what is referred to as the enaer

goals. So, this is real good guidance for

IT departments everywhere to be able to

use to drive uh their work with regards

to COBIT in itself, all right. So the next

principle, I should have put principle

two here. Says IT covers the entire

Enterprise. COBIT is not just for a

department, it's not just for a unit. It's

not just for the head office. COBIT covers

the entire organization, end to end, so

when COBIT uses the concept of end to end. It

means IT covers the entire organization

from beginning to the end, all right. So

IT's integrated governance for the

entire organization. IT covers all

functions and processes within the

business whether they're internal or

external. So it doesn't matter the

department, you cannot say that, "Oh, a

particular department is exempt," no. All

the department in the organization are

adequately covered and look looked after

within the COBIT document, okay. Then, he

talks about something called a

governance approach. Once again, it brings

some roles together. And he says that

there's a set of roles called the owners,

and the

stakeholders. You can call that the

people the shareholders of the business,

and the delate their governance

responsibility. They delegate it to the

govern, to the governing body. The

governing body in turn is accountable

to the stakeholders. That's very

important. The governing body sets

directions for management. So that

management will be the third set of

people that we're talking about here or

the, their set of roles management and

management in in turn is monitored

by by the government body. So, the

government body sets direction for

and, they also

monitor the things that they've set. The

objectives that have been set for them

finally management instructs and aligns

operations and execution. And they, in

turn, they report, they report to

management. So this is very important

delegation, in terms of understanding, who

the owners and stakeholders are the

government body. The management and in

turn and finally operations and

execution. So these are four roles and

this talks about governance. So, I think

governance is a board conversation. There

should be a subcomittee at the board

level, not just at the management level

at the board level for IT governance. And

this is not the IT steering committee.

This is a different committee looking at

the governance of IT. The third principle

here talks about applying a single

integrated framework, and all it just

says in here is that you know COBIT works

with every other framework is before

they developed. COBIT had loads of other

documents. But, IT risks it. All sorts of

other documents hope it

integrates clearly and cleanly with all

those documents. Number two: to integrate

COBIT integrates with everything. Whether

it's TOA for Enterprise, architecture, IT

for IT service management, or any of the

ISO standards. They're all adequately

integrated with COBIT with COBIT. Okay, number

four. IT talks about the holistic

approach. So this holistic approach says

that, you know, there are seven enablers

and from a from a COBIT perspective, these

seven things are the things that enable

an organization to achieve IT governance.

First and foremost is the principles, the

policies and the frameworks. Number two

are the processes. Number three is the

governance are the organizational

structures. Four is the culture, the

ethics and the behavior of the people.

Five is information, Six is Services,

infrastructure and application and

Finally, it is people skills and their

competences. So, holistic approach

literally just says that, you know what.

You've got to look at these seven things.

IT calls them

enablers. So you can and if you can see

from the list. Some of them are soft. Some

of them are

hard. So if you look at the things that

are soft is principles, processes,

organization of the structure, culture,

ethics. The concept of information

people's skills and competences. These

are a lot of the things that people

would do it, usually forget about they

forget about this. They leave IT out. They

don't take it into consideration and COBIT

says that you've got to, you've got to

take these seven enablers, that's what it

calls them. COBIT has got this brilliant

diagram where it connects the seven of

them, and you can see Information,

services, infrastructure and people below

all of them connecting to the central

backbone the in, this instance is like

the ESB like the Enterprise service. BS

here is the principle the IES, and the

Frameworks that are adopted by the IT or

by the organization in itself. So IT's

brilliant when IT comes to getting

this done. That's what IT calls

holistic, all right. And finally COBIT

talks about, okay. Before that, it talks

about enabling process and this enabling

process says that each of those seven

enablers that we've looked at IT

provides adequate guidance to ask a

couple of questions. I actually have a

document that I did where I created

the seven

enablers on the as R headers. And I

put stakeholder goals, life cycles and

good practices as column headers. So for

each of those enablers, you will have

stakeholders that are

applicable goals that are

applicable life cycle that is applicable

to each of them, and good practices that

means for seven different enablers for

each one of them, yeah. COBIT talks about

their stakeholders their goals, their

life cycle and their good practices. It

was great work. It's brilliant work that

was done further to that, he also talks

about performance management, which says

that you know what those seven enablers.

How do we judge them in terms of their

performance? What are the metrics that we

can use to measure whether they are

happening

effectively wise? So it will ask you

these generic questions saying that a

stakeholder needs a addressed enable

goals achieved, then say that is life

cycle management, and are good practices

applied. And of course, if you look at

this, it clearly shows that some of them

are leading indicators, and some of them

are lagging indicators, so to speak. So

some of them, they're before the fact

it's they're like critical success

factors like the lead indicators, you put

them in place ahead of time before time

while the lagging indicators are after

you, you. Those are, that's how you will

check whether things are functioning

effectively.

So it's kind of a post is the post

indicators while the lead indicators

they are pre-indicators okay. So, the

fifth principle, which is also, which is

really where I think,

I think this is the high, this is the

high point of of this entire thing. It

talks about separating governance from

management I think this is the, this is

the high point of everything. When COBIT came

up, we're 37

different

processes, and amongst the 37 he CED out

four five of them and called them

governance processes. And IT then created

five domains, and one of those domains is

a governance domain. I think it was the

wor I think it is great because hearing

lies a real difference because a lot of

people are confused, and say what does

itel give that COBIT does not give. What does

COBIT have that this does not have? The key

thing is that COBIT emphasizes five

processes that are strictly governance

processes, not management processes. So COBIT

makes a clear distinction between what

is the governance of IT and what is the

management of IT. Okay, so governance

ensures that stakeholder needs

conditions and options are evaluated.

Management plans, builds and runs and

monitors the in alignment with direction

that has been sent. This is key and this

is fundamental that you understand the

difference between

governance and management. Okay so before

I go to the what I'll consider to do the

most important slide of this entire

presentation, I'll stop here first

which is this slide that. So there are

four domains. The first domain is called

the EDM, right. Evaluate direct monitor,

right, which is the governance domain and

then the other four domains, which you

call the nickname for them. I like to say

it's plan, build, run and monitor. Even

though that's not the full name, right.

So but those are, that's how the the

the that's what I, I like to call the

nicknames of these four domains. And it's

important that you understand all these

four domains adequately. APO means align

plan and organize.

BAI means build acquire and Implement.

RUN means deliver service and support,

and the final one, which is called

monitor, talks about monitor

evaluate and assess. I've also done some

other documents where I've aligned those

four primarily to itel to try and draw

parallels between itel, and these four

domains but itel does not speak about

governance. Governance primary is champion

and described by COBIT, and hearing Li is

the great thing when it comes to COBIT. So

these are the five domains. If I move

into this diagram, and if you, if you have,

if you can't remember anything that I've

said, and if you forget this entire

presentation. Do not forget this slide.

This slide is the single most important

slide um uh on this presentation. And it

talks about these five domains, and it

then brings the 37 different processes

it brings them into these five domains.

I'm going to need you to look at this. So,

if you look at the top five, the top five

are all governance ensuring. The

governance framework setting and

maintenance benefits delivery risk

optimization, resource optimization,

stakeholder transparency. They all belong

to COBIT to the governance domain then we

move to align, plan and organize and

there you see the IT management

framework is literally find the itle

there talks about man strategy, you can

see manage enterprise, architecture. It's

referring to TOA there, manage innovation,

manage portfolio right budget and cost

financial management. That's what it's

saying human resources, relationship

service agreements, supply management

quality managing risk, and finally

managing security. So there, the 13 of

them under align, plan and organize and

some of you who are very familiar with

it, we already see some similarities in

that, all right. So, it has borrowed

some of them, but it has made it much

more extensive. So it also has build

acquire and Implement which align to the

things that you will find under service

design in it, right. One of the great

things I like about this, it's separated.

IT's brought up the conversation of

program and project management, which IT

does not focus on the law, and it's

brought up the conversation around

organizational change, which is

brilliant. This is not talking about

chain management as IT people understand

it like RFCs and things like that. This

is talking about organizational chain

management, then he also talks about

deliver services, support, manage

operations, which is very much like

operations and itle. And finally, it's got

monitor, evaluate and assess, which is

very much like CSI. So there are very

there a lot of alignment between COBIT and

COBIT, but the brilliant portion in here are

the things that IT cover, and the

governance layer that is on this diagram.

Once again, if you can't remember this

entire presentation, and you can't

remember anything that we must have said.

Please remember, this particular slide

as it is. These are the 37 processes for

governance and management is called the

process reference model, and there are 37

of them, right. It is extensive. It is a

brilliant piece of work that has been

done, and anybody who is in IT governance

needs to be familiar with this tech

seven um, uh, IT processes, all right. Good.

So, there's a. there, there a full document

that COBIT's got. The, the document is

called the implementation guidance

documen,t and it gives a lot of guidance

in terms of how do you use COBIT? How do

you get value out of COIT? What triggers

COBIT usage? Who should be using COBIT

during the life cycle of an organization?

When should they use COBIT? So, it's also a

really great document. It's one of the

seven documents that I described

up, and it just gives implementation

guidance on how COBIT is is meant to be

used, okay. So it does talk about some

some success factors for implementation

top management everybody knows that IT

governance belongs to the board, and the

board has to show that they really do

know and understand IT governance. All

parties supporting the governance

and mental processes to understand the

the

an IT objective tailoring COBIT. So COBIT does

require a lot of expertise, so I work

with a lot of organizations. Sometimes

that are struggling from they know what

COBIT is they have the documentation. They

bought IT, but they still don't how to

use IT. So IT doesn't need a lot of

tailoring. So that an organization can

get adequate value from IT, okay. And

there a lot of factors within the

the internal and exteral enterprise

environment that must be taken into

consideration the ethics of the

organization. Their mission, their goals,

their operative model. Their

management style, their risk capital. All

that has got to be adequately taken into

consideration, all right. So this is

another great piece of work that was

done COBIT. It's called the

implementation life cycle. It's also very

brilliant. IT decides to look at the

implementation, not just thinking about

IT from a project or program perspective,

but IT looks at it from four different

perspectives. First and foremost, is IT

would ask you the same questions that?

You have on in itle used to be called

the or, it's called the CSI approach

where it says that, you know, you just ask

you some questions. Where are we now?

Where do we want to be? Where do we need

to be? How do we get there? All those

questions, right. But IT then brings the

next layer. We talks about program

management, and he says that, you know,

what from a program perspective? How do

we manage implementation from a program

perspective that he says that there's

another layer which a lot of IT people

fail to realize?

I've suffered a lot from that we talks

about change enablement, IT projects are

change projects. They organizational

change initiatives, and every

organization needs to adequately manage

those change initiatives, to be able to

get adequate, adequate value from this.

So it's important, and it's extremely

essential that you drive this from a

change perspective. Otherwise, you will

not get value out of using the

methodology like COBIT. Finally, he also

talks about the continual Improvement

life cycle, which is really good which

also just says that, you know, how do we

ensure that whatever good work we've

done today is sustained within the

organization? So the sustenance of the

great work that is done. The measurement

and sustenance is very much almost

aligns to, you know, the seven step

Improvement life cycle in itel, is what

this is about. So this is also another

great piece of work done by COBIT that just

allows you to look at uh implementation

of COBIT in itself, not just thinking about

it from a project or program perspective,

but also thinking about IT as a change

initiative, and finally thinking about

how will the initiative be sustained

within the

organization, all right. Great, so COBIT

borrows from COBIT, borrows a lot of

measurements from ISO, okay. There's a

method. There's an ISO standard called

1550 War, which a lot of people are not

familiar with. He also borrows from

cmmi because cmmi talks about both

maturity and capability models. And I

can't really go into the details of that,

but if you if you know K4 and if you

know, most organizations, most people

speak about their, the maturity of

their processes, so they talk about a

maturity model. A lot of organizations

talk about a maturity model. The maturity

of their processes,

right. COBIT goes further because cmmi also

goes further. If you look at cmmi for

development, specifically IT, not only

speaks about maturity of processes but

then also looks at the

capability. Capability is at a much lower

level, so while maturity is looking at it

at a much higher level capability goes

into details and allows you to look at

processes at a low level, right. So, the

capability talks about level 0 1 2 3 4

and 5: incomplete, performed, managed,

established, predictable and optimized.

And the C document goes into a lot of

explanation into before you can judge an

organization and say your supply

management is established. How did you

arrive at that? What did they score? How

did you look at it? What was the criteria?

All that information is included in

some of the co-documents, but it's good

to understand that you can look at

processes, not just from a maturity

perspective, but also from a capability

perspective, all right. There been, there's

been there's one of the webinars

that I did hold with PCB, and we talked

about we looked at cmmi. Specifically, so

this is really great so you can look at

this it says you know incomplete perform

managed, and what is the criteria of the

description for you to say that an

organization is at any of these levels

of capability. So this is really

and this is great, all right. So enough

about COBIT. So, that I don't spend the

entire day speaking about COBIT once again

as I said you really cannot do ISO 38500.

except you know COBIT because the ISO 38

500 document in itself does refer COBIT in

itself. So you can't really work with the

standard without understanding the best

practice. And as I've said in time past, a

lot of the standards are developed from

best practice. So it's important that an

organization completely adopts a lot of

the best practice. So, the stand you can't

really if an organization wants to

achieve a proper standard. They need to

go to ISO

38500. If the business want to plaque,

they want to brand themselves they want

to be able to say to people that you

know what we've achieved the ISO

standard for IT governance. Then they

need to go to ISO

38500. That is what they need to do. So

it's important that people understand

where each of these things complement

each each other. Where does ISO 38500

compliment COBIT? When we work for clients,

we try and ensure that we marry these

four things together. We marry ISO 38500

with 27 with 20 and with

2231 because it's easier to marry them

from a standard perspective. I've seen

organizations. Sometimes, they will write

all the standards that they write COBIT.

It's not from ISO, so if you're doing ISO,

it makes sense that you marry the four

of them from an ISO perspective, all

right. So this is really good just like

27,000 relies a lot on the nist document

in itself. 20,000 relies on itail 38,000,

38500 relies on COBIT, so it's good that

you can draw a line and marry this

together, but I've seen a few

organizations who are adopting 38 by.

So as part of that adoption process,

they've got to really do a lot of COBIT

work and this is, this would really be

great and interesting all right. So

um, so what ISO 38500 focuses primarily on

governance. It does not speak about the

extensive part, when you start to look at

all the 37 processes and all the

stuff that's got to do with management.

No, it really just says you know

directors should govern IT and they

should do it through three main tasks,

right. And the number one task is

evaluate the current and future use of

IT direct preparation and implementation

plan. Monitor confirmance. Confirmance so

the standard in itself sets out six

principles for good corporate governance.

So, and this principles they express

the preferred nehavior with regards to

decision making, the statement of each

principle refers to what should happen

but does not necessarily talk about how

you should refer to COBIT for that, and each

of the principles is then tied to to the

model. So it's good that you see

something like this. So we talk about the

business pressures. Business needs

corporate governance of IT. We talked

about EDM earlier in COBIT: elevate, direct,

and monitor and plans and policies.

Proposals come from the businesses and

how this affects ICT projects and

operations.

So this, this is really what it is. It's

good to achieve a IT 38500, but you cannot

achieve 38500, except you've already done

COBIT I will, I will, I cannot overstress

that so IT will be good that you, you, you

know that and that you take that into

consideration. Okay, good. So I'll move on,

I'll quickly speak about these five

principles so that we can round up

principle. Number one just talks about

responsibility, so the business and the

it should collaborate in a

partnership utilizing appropriate

communication to ensure that you know it

is done appropriately. Then the it

executive themselves, acting on behalf

of the board and chaired by the board. It's a very,

It's a very effective mechanism for

evaluating directing IT directors of

small

organizations should get very much

involved with what is happening. From an

IT perspective, that's why you see that

some small organizations,

literally of IT reports to chief

operations officer in some organizations.

So, so talk about responsibility being

one of the principles, the other

principle here . It talks about strategy,

so it says that you know strategy is

extremely complex. It needs to be

involved at the strategy level. It should

not wait till the end. It should not be

fed secondary information. It needs to

work closely with the business to ensure

that you know, they understand the

strategy, and that they can deliver very

much in line with the strategy of the

business. Once again, COBIT does an extremely

good job of explaining a lot of this. ISO

38500, when you buy it from the

site. It's just about, I think it's

probably less than 20 pages, and it just

speaks about these things at the high

level if you really want to get this and

to understand how we should do it you

need to refer to the COBIT document, okay.

And yeah, so IT talks about balance COBIT

card aligning balance score card from

the business and the IT balance score

card. So balance score card is not just

used by the business is also used by the

IT department. So you can have, you can

have an IT balance for then we have what

is referred to as

acquisition. And I already mentioned how

important service providers and vendors

are within the entire space of

IT governance. So acquisition of

anything that is IT in terms of

resources needs to be looked at

adequately. It needs to be managed. It

needs to be aligned, and you need to

ensure that you get the adequate return

on investment. You've got to pick the

right technology. You've got to pick the

right technology

provider. These things are very important

before value can be delivered. So

technology has got to be both fits for

Value that are ffor use and fit for purpose

in itself. So it's got to meet both the

utility and the warranty

components as it is. So IT solutions

support the business. So acquisition has

got to be looked at. You don't just allow

procurement departments, sometimes, that

do not understand how IT should be

procured to go ahead with it without

adequately involving the IT department,

okay. Or the people who know about IT so

there must be a lot of governance around

the acquisition of IT. That's what this

is saying. And principle four, once again

is talking about

performance says the performance is, got

to be looked at. You've got to come up

with your csfs and your kpis and all

this to be adequately looked at in terms

of performance management. We

looked at lagging indicators, leading

indicators key goal indicators, key

performance

indicators and performance in itself

even needs to be sustained, and you know

what they say, "If you can't measure it,

then it does not exist." So it's important

that you understand how performance

works how performance measurement should

be done. And how if you need to build the

performance scorecard, how it should be

done for it and the metrics that you're

using for IT governance. Are they the

appropriate metrics, and do they provide

the right information. So apart from

performance is also the concept of

conformance. Conformance just says that

IT governance we should be worried about

regulatory issues. We should be worried

about statutary issues. We should be

worried about whether we're meeting

everything that's got to do with law and

order. Meeting all of them in place and

you know so it's for in a lot of

countries. ISO 27,000, ISO 20,000 even

ISO 38500 is not a nice to have. It's a

must have, especially in the financial

services industry. So the conversation

around meeting regulatory requirements

is a boardroom discussion that needs to

be had and had

regularly. And that's what conformance

is referring to, right. So are we

conforming to everything that has been

laid down. Finally, there's a people

element to IT. Do we have the right

people? Are people doing the right things

are they adequately trained? Do we have

the right skills within the IT

department to deliver value to the

business, you know? Within an ISO, there's

not one of the things you look at within

an ISO assessment in an organization.

Do they have skilled people? Do they have

trained people? So these things are very

important for a human behavior

perspective. And it's very important and

essential that all this is adequately

done. So that's primarily it from an ISO

38500 perspective. It really really just

looks at these seven principles, and

refers to COBIT a lot. It is really around

what is it that COBIT does have to offer to

the organization. Remember what it

is that I said, that I gave you the 37

processes within COBIT and how governance

has been separated from management and

the person are very important, then I

showed you this one that talked about

how IT governance needs to be

implemented in an organization, not just

thinking about it from a program

perspective. But thinking about IT from a

program change and continual Improvement

perspective. And finally is about the

adoption of cmmi capability measurement

capability model for using it within IT

governance, not just using the maturity

model. So this is a significant

Improvement on of version five over

the COBIT version four as it is,

all right. So and of course, the six

principles that are discussed under ISO

38500 so primarily. That is it. There's

not a whole lot that is about, about this

beyond this. I believe we're going to

put this up on the internet and

people can download it and they can

listen to this again, and they can

download some of the materials. All the

diagrams and a lot of those things

belong directly to Isaka and I've

already said mentioned that in my

presentation, so for you to

effectively do IT governance or for you

to have effective IT governance. You've

got to marry these two. You've got to

marry COBIT 5 and ISO 38500 effectively

for an

organization, okay, okay. Thank you very

much. I would like to take the questions

now. Thank you very much for this

presentation, Mr. Orlando. We have a

few questions over here. I will start and

you may answer, just a few of them.

The first one is are there other

major are there any other major

differences among COBIT 4.1 and COBIT

5.0. Well, there quite a bit a lot of the

differences apart from the use of

maturity and capability there. There's a

couple of other differences. The way of

course, I mean, they've separated it.

They've added the governance layer to IT,

and the process is here now 37, which is

much more than what you used to have in

um uh COBIT 4 in itself. And um the way the

extra documents have also been done. It's

much broader than what it is. The older

COBIT did not take risk IT. V-IT, all those

documents into consideration. But 5 has

added all of them. So all I'm, all I'll say

that there probably a 50% difference

between 4 and 5. So it's quite huge in

terms of the additions that have been

added onto

it. Thank you. The next question is, "Can

I use COBIT 5 as a statement for

criteria for specific audit

conclusions?" Oh, yes so very, very much.

A lot in fact, a lot of people when it

comes to their audit the controls and

the findings and the conclusions. A lot

of what it is that is being used by a

lot of organizations is taken directly

out of COBIT

5 as of today. So yes, you can use it for

your audit conclusions, and you can use

it to defend and substantiate your

position once. Once you follow through

with COBIT there, can't be anything

higher than

that, okay. Yes, thank you. The third

question is, "Which businesses are

using more COBIT

5?" Every industry. Every single

industry: financial services probably

possibly be number one.

Telecommunications,

manufacturing services, industry,

everybody. There's no better

governance. IT governance. Methodology in

the world that COBIT 5 right now. So

everybody who is concerned about IT

governance in every single industry is

using COBIT.

Thank you. The next question is,

what is the difference between ISO

38,500 2015 and ISO 38,500

2008? What was the other one that you

said? I didn't hear

that. I didn't, I didn't get

that. May I repeat the

question? Yes, please. What is the

difference between ISO

38,500 2015 with ISO

38,500 2008.

Oh yeah. Well I mean the the 2015 version

is better aligned to COBIT. That's the

primarily, that's it. So the 2015 version

it refers to COBIT 5 in fact, it really

does it's really about COBIT 5. It just

provides some extra guidance that I

showed within those principles but

it's better aligned. The older version,

the

2008 referred to the older COBIT a bit,

but this new one really refers to COBIT 5.

The major

difference. And the last question is,

is the COBIT 5 framework superior to the

other

frameworks as such as ITAL and ISO

27,000

series? I don't think it's, it's about

superiority. That's a, that's not a word

that I want to use, but I would say it's

much more complete. IT looks at it from a

much broader perspective, looks at the

business more thoroughly,

and then you know brings in much more

than how IT looks at it. It's beyond

service management is beyond enterprise

architecture. It is beyond all the things.

So I'll say, it's much more holistic, much

more complete um in comparison, but I

would say

superior. Thank you again, Mr. Orlando,

for this excellent presentation. I

want to thank all the attendees as well

for taking the time out of your business

schedule to join us. We hope you enjoy

this webinar. We have received all your

questions, and because the time is limited

we will answer to your question

individually by email. Please check PCB's

webinar schedule in our website www.

pcb.com or our official social

media network since next week, we are

organizing webinars on interesting

topics. Next Monday on 9th of October, we

are hosting a webinar on the topic ISO

21,500: a guidance to project managers on

ISO 21,500 project management

standard. Thank you again, and see you in

the next webinars, thank you. Mr.

Orlando. All right, thank you very much.

Thank you, much appreciated. Alright.