COBIT 2019 Foundation: Phase 3 - Where Do We Want to Be?

COBIT 2019 Foundation: Phase 3 - Where Do We Want to Be?

Why Is Phase 3 Important?

Phase 3: Where Do We Want to Be? is a critical component of the COBIT implementation journey. This phase is essential because it:

• Defines the future state: Establishes a clear vision of what the organization aims to achieve through improved governance and management of enterprise IT.
• Sets realistic targets: Creates measurable objectives that guide the implementation of governance and management objectives.
• Aligns with business strategy: Ensures that IT governance improvements support overall organizational goals and strategic direction.
• Provides direction: Gives stakeholders a clear understanding of the improvement journey and what success looks like.
• Prioritizes initiatives: Helps identify which governance and management objectives should be addressed first based on organizational priorities.
• Enables change management: Provides a roadmap that facilitates organizational change and manages resistance to transformation.
• Supports resource allocation: Helps determine where investments and efforts should be focused for maximum impact.

What Is Phase 3: Where Do We Want to Be?

Phase 3 is the third phase in the COBIT 2019 implementation roadmap. It focuses on defining the target or future state of the organization's IT governance and management capabilities.

Key characteristics of Phase 3 include:

• Future state vision: Describes how IT governance and management should function to support business objectives.
• Target capability levels: Defines the desired maturity level (0-5) for each relevant governance and management objective.
• Timeline-based goals: Establishes timeframes for achieving different capability levels, which may include short-term, medium-term, and long-term goals.
• Stakeholder input: Incorporates perspectives from business leaders, IT management, and other stakeholders to ensure alignment with organizational needs.
• Risk and opportunity consideration: Takes into account organizational risk appetite and potential opportunities for improvement.
• Resource requirements: Identifies what resources, skills, and investments will be needed to reach the target state.
• Dependencies and sequencing: Recognizes interdependencies between different governance and management objectives and sequences improvements accordingly.

How Does Phase 3 Work?

Phase 3 operates through a structured process:

1. Review Current State Assessment (From Phase 2)

The team begins by reviewing the detailed findings from Phase 2 (Where Are We Today?), including:

• Current capability levels for each governance and management objective
• Identified strengths and weaknesses
• Performance metrics and gaps
• Root causes of deficiencies

2. Define Organizational Strategy and Priorities

Establish clear business objectives and organizational priorities that will guide the selection of target capability levels. This includes:

• Reviewing strategic business plans
• Identifying critical success factors
• Understanding stakeholder expectations
• Assessing risk appetite and tolerance

3. Determine Target Capability Levels

For each governance and management objective, establish target capability levels (0-5) that support organizational strategy:

• Level 0 (Incomplete): Process is not implemented or fails to achieve its purpose.
• Level 1 (Performed): Process is executed and achieves its purpose.
• Level 2 (Managed): Process is executed and managed; requirements, design, inputs, outputs, and information flows are controlled.
• Level 3 (Established): Process is executed and managed consistently, with defined standards and procedures.
• Level 4 (Predictable): Process is executed and managed with quantitative objectives and measures for effectiveness.
• Level 5 (Optimized): Process is continuously monitored and improved with focus on innovation and optimization.

4. Sequence Improvements

Develop a roadmap that sequences improvements across different timeframes:

• Quick wins (0-6 months): High-impact, low-effort improvements that build momentum
• Short-term (6-18 months): Foundational improvements that establish basic governance structures
• Medium-term (18-36 months): More complex improvements that enhance organizational capabilities
• Long-term (3+ years): Advanced maturity improvements and continuous optimization

5. Identify Implementation Enablers

Determine what is needed to achieve target states:

• People: Skills, competencies, organizational structure, and staffing requirements
• Processes: Process improvements, documentation, and procedural changes
• Technology: Tools, systems, and infrastructure investments
• Culture: Organizational mindset, values, and behavioral changes

6. Estimate Resource Requirements

Assess the resources needed for implementation, including:

• Financial investments
• Human resources and time commitments
• Technology and infrastructure costs
• Training and awareness initiatives

7. Create the Implementation Roadmap

Synthesize all findings into a comprehensive roadmap that shows:

• Target capability levels for each objective
• Timeline for achievement
• Sequencing and dependencies
• Resource requirements
• Key milestones and deliverables
• Success metrics and KPIs

Key Principles for Phase 3

• Align with strategy: Target levels must directly support organizational strategic objectives
• Be realistic: Goals should be ambitious but achievable within organizational constraints
• Consider interdependencies: Many governance and management objectives have dependencies that must be sequenced appropriately
• Balance quick wins and long-term improvements: Include both short-term wins for momentum and long-term strategic improvements
• Involve stakeholders: Ensure buy-in from business leaders, IT management, and other relevant parties
• Account for risk: Consider organizational risk appetite when setting capability levels
• Plan for enablers: Recognize that achieving target states requires investment in people, processes, and technology

Exam Tips: Answering Questions on Phase 3: Where Do We Want to Be?

Understanding Question Types

Exam questions on Phase 3 typically fall into these categories:

• Definition and purpose questions: What is Phase 3? Why is it important?
• Process questions: How does Phase 3 work? What are the steps involved?
• Objective questions: What are the objectives of Phase 3?
• Outcome questions: What are the expected deliverables and outputs?
• Application questions: How would you apply Phase 3 concepts in a given scenario?

Key Exam Tip #1: Know the Purpose and Context

Tip: Understand that Phase 3 is fundamentally about defining the desired future state of IT governance and management.

How to apply: When answering questions, always emphasize that this phase is about setting targets and defining where the organization wants to be, not where it currently is (that's Phase 2) or how to get there (that's Phase 4).

Example answer structure: "Phase 3 is important because it establishes target capability levels and creates a vision for the organization's governance and management improvements based on strategic objectives."

Key Exam Tip #2: Remember the Capability Maturity Levels (0-5)

Tip: Be thoroughly familiar with all five capability levels and what they represent.

How to apply: When questions ask about setting targets or determining future states, be able to explain why certain capability levels are appropriate for specific objectives based on organizational strategy and risk.

Study points:

• Level 0 = Not implemented
• Level 1 = Process performs its function
• Level 2 = Process is managed and controlled
• Level 3 = Process is standardized and consistent
• Level 4 = Process is measured and predictable
• Level 5 = Process is optimized and continuously improved

Key Exam Tip #3: Connect Phase 3 to Business Strategy

Tip: Always link Phase 3 activities back to organizational strategy and business objectives.

How to apply: When answering scenario-based questions, explain how target capability levels should be determined by business strategy, not by what's technically possible or what competitors do.

Example: "While competitors may have achieved Level 5 in a particular objective, the organization's strategy might only require Level 3, making further investment inefficient."

Key Exam Tip #4: Understand the Sequencing and Roadmap Concept

Tip: Phase 3 isn't just about setting levels; it's about creating a sequenced roadmap.

How to apply: Be prepared to discuss how improvements should be sequenced across different timeframes and how dependencies between objectives affect sequencing.

Key concepts to remember:

• Quick wins build momentum
• Foundational objectives may need to be addressed before advanced ones
• Some objectives are dependencies for others
• Realistic timelines are crucial for success

Key Exam Tip #5: Know the Four Enablers Framework

Tip: Phase 3 includes identifying enablers needed to achieve target states: People, Processes, Technology, and Culture (often remembered as the COBIT enablers).

How to apply: When questions ask about what's needed to achieve target states, mention the enablers framework and provide specific examples for each category.

Example answer: "To achieve the target capability level, the organization needs to invest in people (training and hiring), processes (documentation and standardization), technology (new tools), and culture (mindset shift)."

Key Exam Tip #6: Distinguish Phase 3 from Phase 2 and Phase 4

Tip: Exam questions may test your understanding of how the phases differ.

Key distinctions:

• Phase 2 (Where Are We Today?): Assessment of current state and capability levels
• Phase 3 (Where Do We Want to Be?): Definition of future state and target capability levels
• Phase 4 (How Do We Get There?): Planning of implementation activities and initiatives

How to apply: Always identify which phase a question is asking about before answering. Look for keywords like "current," "target," or "implementation" to determine the phase.

Key Exam Tip #7: Focus on Stakeholder Involvement and Buy-in

Tip: Phase 3 emphasizes the importance of stakeholder engagement in defining target states.

How to apply: In answers, mention the importance of involving business leaders, IT management, and other stakeholders to ensure alignment and obtain buy-in for the improvement roadmap.

Example: "Phase 3 requires input from diverse stakeholders to ensure target capability levels align with business strategy and have organizational support."

Key Exam Tip #8: Understand Risk Appetite and Realistic Goal-Setting

Tip: Target capability levels should be aligned with organizational risk appetite and realistic given organizational constraints.

How to apply: When answering questions about target setting, discuss how the organization's risk tolerance and available resources should influence which capability levels are realistically achievable.

Example: "An organization with limited IT budget and risk-averse leadership might set Level 2 targets, while a growth-focused organization with strong IT investment might target Level 4."

Key Exam Tip #9: Recognize Phase 3 Deliverables

Tip: Be familiar with the key outputs and deliverables of Phase 3.

Main deliverables include:

• Target capability levels for each governance and management objective
• Implementation roadmap with timeline
• Resource and investment requirements
• Sequencing and dependency analysis
• Success metrics and KPIs
• Enabler requirements (people, processes, technology, culture)
• Stakeholder buy-in and approval

Key Exam Tip #10: Practice Scenario-Based Analysis

Tip: Many exam questions present scenarios requiring you to apply Phase 3 concepts.

How to prepare:

• Practice analyzing organizational strategies and translating them into target capability levels
• Work through examples of sequencing improvements based on dependencies
• Develop the ability to identify appropriate capability levels based on different organizational contexts
• Practice explaining why certain targets are realistic or unrealistic given organizational constraints

Example scenario analysis approach:

1. Identify the organization's strategic priorities
2. Determine which governance and management objectives are critical to those priorities
3. Assess what capability levels would be needed to support those objectives
4. Consider dependencies and sequencing
5. Identify required enablers and resources
6. Create a realistic timeline

Key Exam Tip #11: Use the COBIT Core Model Terminology

Tip: Be familiar with the terminology used in the COBIT 2019 Core Model, including governance objectives and management objectives.

How to apply: When answering questions, use the correct terminology (e.g., "governance objectives" rather than "control objectives," which is COBIT 5 terminology) to demonstrate your knowledge of COBIT 2019.

Key Exam Tip #12: Remember Phase 3 Is About Consensus and Buy-in

Tip: Phase 3 is not just a technical exercise; it's about building organizational consensus and obtaining stakeholder buy-in.

How to apply: In your answers, emphasize the importance of communication, collaboration, and consensus-building in establishing realistic and achievable target capability levels.

Example: "While the assessment team might recommend Level 5 for a critical objective, Phase 3 involves stakeholder consultation to ensure the target is realistic and has organizational commitment."

Common Exam Question Patterns

Pattern 1: Definition Questions

"What is the primary purpose of Phase 3 in the COBIT implementation roadmap?"

Answer approach: Define Phase 3 as the phase where target capability levels are set and a future state vision is established based on strategic objectives.

Pattern 2: Application Questions

"An organization has completed Phase 2 and identified that their governance objective 'Strategic Alignment' is at Level 1. What should Phase 3 focus on for this objective?"

Answer approach: Explain that Phase 3 should determine what level is needed based on business strategy (might be Level 3 or 4), and identify the sequencing and enablers needed to get there.

Pattern 3: Comparison Questions

"How does Phase 3 differ from Phase 2 in the COBIT implementation roadmap?"

Answer approach: Clearly distinguish that Phase 2 assesses current state while Phase 3 defines desired future state and targets.

Pattern 4: Process Questions

"What are the key steps involved in Phase 3?"

Answer approach: Outline the structured process: review Phase 2, define strategy, determine targets, sequence improvements, identify enablers, estimate resources, create roadmap.

Pattern 5: Enablers Questions

"An organization wants to achieve Level 4 for a critical management objective. What should Phase 3 identify regarding enablers?"

Answer approach: Discuss the need to identify requirements for all four enabler categories: people (skills, training), processes (standardization), technology (tools), and culture (mindset).

Quick Review Checklist for Phase 3

Before your exam, ensure you can answer these questions:

• ☐ What is Phase 3 in the COBIT implementation roadmap?
• ☐ Why is Phase 3 important for IT governance?
• ☐ What is the relationship between Phase 2 and Phase 3?
• ☐ What are the five capability maturity levels (0-5)?
• ☐ How should target capability levels be determined?
• ☐ What is the role of organizational strategy in Phase 3?
• ☐ What are the four enablers identified in Phase 3?
• ☐ How should improvements be sequenced?
• ☐ What are the key deliverables of Phase 3?
• ☐ What is the difference between Phase 3 and Phase 4?
• ☐ How do you determine if a target is realistic?
• ☐ Why is stakeholder involvement important in Phase 3?
• ☐ How do dependencies affect sequencing in Phase 3?

Final Exam Success Strategy for Phase 3 Questions

1. Read carefully: Identify whether the question is about Phase 3 specifically or comparing it with other phases.

2. Identify the question type: Determine if it's asking for definition, process, application, or comparison.

3. Connect to business: Always relate Phase 3 concepts to business strategy and organizational objectives.

4. Use structured thinking: Answer with a clear structure (problem → analysis → solution).

5. Include specific terminology: Use COBIT 2019 terminology such as "governance objectives," "management objectives," "capability levels," and "enablers."

6. Provide examples: Where possible, include concrete examples to illustrate your understanding.

7. Show the big picture: Explain how Phase 3 fits into the overall COBIT implementation roadmap.

8. Emphasize integration: Show how Phase 3 integrates information from Phase 2 and prepares for Phase 4.