COBIT 2019 Foundation: Phase 2 - Where Are We Now? - Complete Guide

COBIT 2019 Foundation: Phase 2 - Where Are We Now?

1. Why Is Phase 2 Important?

Phase 2: Where Are We Now? is a critical stage in the COBIT implementation journey because it establishes the baseline of your organization's current governance and management capabilities. Understanding your starting point is essential for several reasons:

• Foundation for Improvement: You cannot effectively plan improvements without understanding where you currently stand. This phase identifies existing strengths and weaknesses.
• Risk Identification: It reveals gaps in governance and management practices that may pose risks to the organization.
• Resource Planning: Understanding the current state helps allocate resources efficiently for improvement initiatives.
• Stakeholder Alignment: It provides a common understanding among stakeholders about the organization's governance maturity.
• Baseline for Measurement: It establishes metrics against which future progress can be measured and monitored.

2. What Is Phase 2: Where Are We Now?

Phase 2 is the assessment phase of the COBIT implementation roadmap. It involves evaluating the organization's current state across governance and management processes to understand:

• The maturity level of existing processes
• How well current practices align with COBIT principles
• Gaps between current state and desired state
• Organizational capabilities and constraints

Key Components of Phase 2:

• Current State Assessment: Evaluating existing governance structures, processes, and practices
• Capability Assessment: Measuring the maturity and effectiveness of IT governance and management processes
• Stakeholder Analysis: Understanding roles, responsibilities, and concerns of key stakeholders
• Risk and Compliance Review: Identifying current compliance gaps and risk exposures
• Resource Inventory: Assessing available skills, tools, and infrastructure

3. How Phase 2 Works

Phase 2 operates through a structured assessment process:

Step 1: Define Assessment Scope

Determine which processes, domains, and organizational units will be assessed. This involves:

• Identifying critical business processes that depend on IT
• Selecting specific COBIT processes to evaluate
• Determining assessment boundaries and depth
• Defining the organizational scope (enterprise-wide, specific units, or functions)

Step 2: Gather Information

Collect data about current governance and management practices through:

• Interviews: Conduct one-on-one or group interviews with process owners, managers, and staff
• Surveys: Distribute questionnaires to stakeholders
• Document Reviews: Analyze existing policies, procedures, and documentation
• Observations: Observe actual process execution
• Workshops: Facilitate group discussions to gather insights

Step 3: Analyze Current Processes

Evaluate how processes currently function:

• Document existing process workflows
• Identify who performs specific activities
• Understand decision-making mechanisms
• Review control mechanisms and monitoring practices

Step 4: Assess Maturity Levels

Evaluate each process against COBIT's capability maturity model. COBIT uses a maturity scale typically ranging from:

• Level 0 (Incomplete): Process is not performed or partially performed
• Level 1 (Performed): Process is executed informally
• Level 2 (Managed): Process is documented and executed with basic management
• Level 3 (Defined): Process is documented, communicated, and formalized
• Level 4 (Quantitatively Managed): Process is managed with quantitative objectives and metrics
• Level 5 (Optimized): Process is continuously improved and optimized

Step 5: Identify Gaps

Compare current state against desired future state to identify:

• Process gaps (missing processes or incomplete processes)
• Capability gaps (insufficient maturity levels)
• Resource gaps (insufficient skills, tools, or staffing)
• Knowledge gaps (lack of awareness or understanding)

Step 6: Document Findings

Create a comprehensive assessment report that includes:

• Current state baseline across all assessed processes
• Maturity levels for each process
• Identified gaps and deficiencies
• Risk implications of current gaps
• Stakeholder observations and feedback

4. Key Elements to Understand for Phase 2

Baseline Establishment: Phase 2 creates a measurable baseline that serves as the reference point for all future improvements. This baseline includes both qualitative descriptions and quantitative metrics.

As-Is State Documentation: Comprehensive documentation of how things currently operate, including process flows, responsibilities, tools, and technologies.

Gap Analysis: The difference between the current state (as-is) and the desired future state (to-be) identifies improvement opportunities and priorities.

Capability Assessment: Understanding not just what processes exist, but how effectively and maturely they are executed.

Stakeholder Engagement: Involving key stakeholders ensures accurate assessment and builds support for future improvements.

5. Exam Tips: Answering Questions on Phase 2: Where Are We Now?

Tip 1: Understand the Purpose Clearly

Remember that Phase 2 is fundamentally about assessment and establishing a baseline. Exam questions often test whether you understand that this is not about implementing changes yet, but about understanding the starting point. The key purpose is to:

• Establish the current state of governance and management
• Identify gaps between current and desired states
• Provide a foundation for planning improvements

Exam Tip: If a question asks what Phase 2 achieves first, the answer typically involves assessment, baseline establishment, or understanding the current state rather than implementing improvements.

Tip 2: Recognize Key Activities

Be familiar with the main activities conducted during Phase 2:

• Stakeholder interviews
• Process documentation review
• Capability assessment
• Gap analysis
• Risk identification

Exam Tip: Questions may ask which activity would be performed in Phase 2. Look for answers related to assessment, evaluation, and baseline establishment rather than implementation or change activities.

Tip 3: Know the Maturity Model

Be comfortable with COBIT's maturity levels (0-5) and be able to:

• Define each level accurately
• Understand what characteristics define each level
• Identify the differences between levels
• Understand that higher maturity equals better capability

Exam Tip: Exam questions often present scenarios and ask you to identify the maturity level. Focus on keywords like "informal," "documented," "quantified," and "optimized" which correspond to specific levels.

Tip 4: Distinguish Between Assessment Types

Understand different assessment approaches:

• Formal Assessment: Structured, comprehensive evaluation against COBIT standards
• Self-Assessment: Organization evaluates itself using internal resources
• Third-Party Assessment: External experts conduct the assessment

Exam Tip: When questions ask about assessment methods or approaches, consider the scope, resources, expertise required, and stakeholder acceptance implications.

Tip 5: Focus on Gap Analysis Outcomes

Understand what gap analysis reveals:

• Process Gaps: Missing or incomplete processes
• Maturity Gaps: Current maturity below target maturity
• Resource Gaps: Insufficient people, tools, or technology
• Knowledge Gaps: Lack of awareness or skills

Exam Tip: Questions may describe a gap and ask you to categorize it or suggest how to address it. Clearly understanding gap types helps you answer correctly.

Tip 6: Connect Phase 2 to Other Phases

Understand how Phase 2 relates to other implementation phases:

• Phase 1 (What Do We Want to Achieve): Defines the target state; Phase 2 compares to this target
• Phase 3 (What Do We Need to Do): Uses Phase 2 findings to create improvement roadmap
• Phase 4 (How Do We Get There): Uses Phase 3 roadmap to execute improvements
• Phase 5 (Did We Get There): Measures progress against Phase 2 baseline

Exam Tip: When answering questions about Phase 2's role in the broader implementation journey, emphasize that it provides essential input to subsequent phases by establishing the baseline and identifying gaps.

Tip 7: Recognize Stakeholder Importance

Understand that Phase 2 requires significant stakeholder involvement:

• IT management and staff
• Business process owners
• Risk and compliance officers
• C-level executives
• External advisors (if applicable)

Exam Tip: Questions may ask which stakeholders should be involved in assessments. Remember that Phase 2 requires broad participation to ensure accurate assessment and organizational buy-in.

Tip 8: Identify Common Phase 2 Outcomes

Know what deliverables Phase 2 produces:

• Current state assessment report
• Maturity level ratings for each process
• Gap analysis findings
• Risk assessment based on current gaps
• Prioritized list of improvement opportunities
• Baseline metrics for future monitoring

Exam Tip: When questions ask what Phase 2 delivers, look for answers related to assessment reports, baselines, gap analyses, and prioritized improvement opportunities.

Tip 9: Understand Challenges and Considerations

Be aware of challenges in Phase 2:

• Data Collection: Getting accurate information from busy stakeholders
• Resistance: People may not want to admit current deficiencies
• Scope Creep: Assessment can expand beyond defined boundaries
• Resource Constraints: Limited time and expertise for assessment
• Political Sensitivity: Findings may reflect poorly on some departments or leaders

Exam Tip: Scenario-based questions may present challenges. Think about how to address them in Phase 2—often the answer involves stakeholder communication, clear scope definition, and ensuring management support.

Tip 10: Practice Scenario Analysis

For scenario-based questions about Phase 2:

• Identify what information is available (assessment data)
• Determine what conclusions can be drawn from the scenario
• Recognize what Phase 2 activities or outputs the scenario describes
• Consider stakeholder perspectives and concerns
• Think about next steps (usually Phase 3 planning)

Exam Tip: Read scenario questions carefully. They often ask you to identify:

• What phase is being described (ensure it's Phase 2)
• What activity is occurring
• What the appropriate next step would be
• What the significance of findings is

Tip 11: Remember the "As-Is" vs "To-Be" Distinction

Phase 2 is about understanding the As-Is (current state):

• As-Is: How processes currently function (Phase 2 focus)
• To-Be: How processes should function (defined in Phase 1, addressed in Phases 3-4)

Exam Tip: If a question describes activities focused on understanding current processes, workflows, and capabilities, it's likely describing Phase 2 activities.

Tip 12: Study Real-World Contexts

Understand how Phase 2 applies across different scenarios:

• Organizations starting from scratch (minimal processes)
• Organizations with existing governance (assessing current maturity)
• Organizations post-acquisition (integrating different governance models)
• Organizations responding to regulatory changes (reassessing against new requirements)

Exam Tip: Context matters. A Phase 2 assessment in a newly formed company looks different from one in a mature enterprise. Tailor your answers to the scenario presented.

6. Common Exam Question Patterns for Phase 2

Pattern 1: "What is the primary objective of Phase 2?"
Answer: To establish the current state baseline and identify gaps between current and desired capabilities.

Pattern 2: "Which activity belongs to Phase 2?"
Look for assessment, evaluation, stakeholder interviews, document review, and capability assessment.

Pattern 3: "A process operates informally without documentation. What is its maturity level?"
Answer: Level 1 (Performed) or Level 0 depending on consistency.

Pattern 4: "What should happen after Phase 2 assessment is complete?"
Answer: Gap analysis findings inform the planning of improvements in Phase 3.

Pattern 5: "Who should participate in Phase 2 assessments?"
Answer: Process owners, IT management, business stakeholders, and sometimes external assessors.

7. Key Takeaways for Exam Success

• Phase 2 is about assessment and baseline establishment
• It creates an as-is view of current governance and management capabilities
• It produces gap analysis comparing current to desired states
• Understanding maturity levels is essential for capability assessment
• Phase 2 requires significant stakeholder engagement and data collection
• Phase 2 outcomes directly inform Phase 3 roadmap planning
• The assessment should be comprehensive yet focused within defined scope
• Challenges in Phase 2 often relate to data accuracy, stakeholder resistance, and scope management
• Always connect Phase 2 findings to the broader implementation journey
• Practice analyzing scenarios to identify Phase 2 activities and appropriate conclusions