Phase 4: What Needs to Be Done? - COBIT 2019 Foundation Guide

Phase 4: What Needs to Be Done? - Complete Guide

Understanding Phase 4 in COBIT 2019 Implementation

Why Phase 4 is Important

Phase 4: What Needs to Be Done? is a critical stage in the COBIT 2019 implementation lifecycle. This phase is important because it:

• Translates the current state assessment into actionable improvement initiatives
• Bridges the gap between where the organization is and where it needs to be
• Provides a clear roadmap for governance and management improvements
• Ensures that improvement efforts are prioritized based on organizational objectives
• Establishes the foundation for sustainable change and continuous improvement
• Helps allocate resources effectively by identifying what needs immediate attention

What is Phase 4: What Needs to Be Done?

Phase 4 is the planning and prioritization phase of the COBIT 2019 implementation framework. It involves analyzing the gap between the current state assessment (from Phase 3) and the desired target state, then developing a comprehensive improvement roadmap.

In this phase, organizations:

• Define the target maturity levels for governance and management processes
• Identify specific gaps and deficiencies in current practices
• Develop detailed improvement plans with clear objectives and outcomes
• Prioritize improvement initiatives based on business value and risk
• Establish timelines and resource requirements for implementation
• Create governance structures to oversee improvement initiatives

Key Components of Phase 4

1. Target State Definition

Organizations must clearly define what their desired future state looks like. This includes:

• Target maturity levels for each governance and management process
• Alignment with business strategy and objectives
• Consideration of regulatory and compliance requirements
• Realistic assessment of organizational capabilities

2. Gap Analysis

A comprehensive gap analysis identifies the differences between current and target states by examining:

• Process gaps: missing or inadequate governance processes
• Capability gaps: lack of skills, tools, or resources
• Knowledge gaps: insufficient understanding of COBIT principles
• Technology gaps: inadequate systems or infrastructure

3. Prioritization

Not all improvements can be addressed simultaneously. Organizations must prioritize based on:

• Business impact and strategic value
• Risk levels and compliance requirements
• Resource availability and constraints
• Dependencies between improvement initiatives
• Stakeholder expectations and readiness

4. Improvement Roadmap Development

A detailed roadmap includes:

• Specific improvement initiatives and projects
• Clear timelines and milestones
• Resource requirements and allocation
• Success criteria and key performance indicators (KPIs)
• Communication and change management plans

5. Governance Structure

Establishing clear governance for improvements includes:

• Defining roles and responsibilities
• Creating steering committees and working groups
• Establishing decision-making processes
• Setting up monitoring and control mechanisms

How Phase 4 Works

Step 1: Review Current State Assessment

Begin by thoroughly reviewing the findings from Phase 3 (Where Are We Now?), including:

• Current maturity levels across all processes
• Identified strengths and weaknesses
• Key findings and observations
• Stakeholder feedback and concerns

Step 2: Define Desired Target State

Work with leadership and stakeholders to establish:

• Target maturity levels for each process area
• Alignment with business strategy and risk appetite
• Timeline for achieving target state
• Constraints and enablers for change

Step 3: Conduct Comprehensive Gap Analysis

Systematically identify gaps across multiple dimensions:

• Process gaps: Which processes are missing or incomplete?
• People gaps: What skills and competencies are needed?
• Technology gaps: What tools and systems are required?
• Organizational gaps: What structural or cultural changes are needed?

Step 4: Develop Improvement Initiatives

Create specific, measurable improvement projects including:

• Clear objectives and expected outcomes
• Scope and deliverables
• Resource requirements (people, budget, time)
• Success metrics and KPIs
• Risk mitigation strategies

Step 5: Prioritize Improvements

Use prioritization criteria to rank initiatives:

• Strategic alignment: How well does it support business objectives?
• Risk mitigation: How much does it reduce organizational risk?
• Business value: What is the expected return on investment?
• Dependencies: What other initiatives must be completed first?
• Feasibility: Can it be realistically achieved with available resources?

Step 6: Create Implementation Roadmap

Develop a phased approach showing:

• Quick wins that can be achieved in the short term (0-6 months)
• Medium-term improvements (6-18 months)
• Long-term strategic initiatives (18+ months)
• Dependencies and sequencing of initiatives
• Resource allocation across phases

Step 7: Establish Governance Framework

Set up structures to oversee implementation:

• Steering committee with executive sponsorship
• Project management office (PMO) for coordination
• Working groups for specific improvement areas
• Communication channels and reporting mechanisms

Key Outputs of Phase 4

By the end of Phase 4, organizations should have:

• Target State Definition: Clear description of desired future capabilities and maturity levels
• Gap Analysis Report: Detailed identification of gaps between current and target states
• Improvement Roadmap: Prioritized plan showing what needs to be done and when
• Business Case: Justification for improvements including costs, benefits, and risks
• Governance Structure: Clear roles, responsibilities, and decision-making processes
• Change Management Plan: Strategy for managing organizational change and stakeholder engagement

Exam Tips: Answering Questions on Phase 4: What Needs to Be Done?

Understanding Common Question Types

Type 1: Definition Questions

These questions ask what Phase 4 is or its purpose.

Example: "What is the primary purpose of Phase 4: What Needs to Be Done? in COBIT 2019 implementation?"

Answering Strategy:

• Focus on the gap analysis and improvement planning aspects
• Emphasize bridging the gap between current and target states
• Include elements of prioritization and roadmap development
• Connect to business objectives and risk mitigation

Type 2: Process and Activities Questions

These questions ask what activities occur in Phase 4 or how it works.

Example: "Which of the following is NOT a key activity in Phase 4: What Needs to Be Done?"

Answering Strategy:

• Recall the seven steps: review current state, define target state, gap analysis, develop initiatives, prioritize, create roadmap, establish governance
• Eliminate activities that belong in other phases (e.g., detailed implementation of processes belongs in Phase 5)
• Focus on planning and prioritization rather than execution
• Remember that Phase 4 is about planning WHAT needs to be done, not HOW to do it

Type 3: Gap Analysis and Prioritization Questions

These questions focus on identifying gaps or prioritizing improvements.

Example: "An organization has limited resources. Which improvement initiative should be prioritized first in Phase 4?"

Answering Strategy:

• Consider strategic alignment with business objectives
• Evaluate risk reduction potential
• Assess resource requirements and availability
• Look for quick wins and dependencies
• Prioritize initiatives that enable other improvements (enablers)

Type 4: Scenario-Based Questions

These present a situation and ask what should be done in Phase 4.

Example: "An organization has identified multiple governance weaknesses. How should these be addressed in Phase 4?"

Answering Strategy:

• Follow the logical sequence of Phase 4 steps
• Show understanding of prioritization principles
• Consider all dimensions: process, people, technology, organization
• Include governance and change management considerations

Key Concepts to Remember for Exams

1. Phase 4 is Planning-Focused, Not Implementation-Focused

Remember that Phase 4 answers the question "What needs to be done?" not "How do we do it?" (which is Phase 5). This distinction is crucial for exam questions that might try to confuse the phases.

2. Prioritization is Critical

Phase 4 is heavily focused on prioritizing improvements. Be ready to discuss prioritization criteria:

• Strategic value and business alignment
• Risk impact and compliance requirements
• Resource requirements and availability
• Dependencies and interdependencies
• Feasibility and organizational readiness

3. Gap Analysis Dimensions

Understand that gaps exist in multiple dimensions:

• Process gaps: Missing or inadequate processes
• Capability gaps: Skills, knowledge, and competency gaps
• Technology gaps: Tool and system deficiencies
• Organizational gaps: Structure, culture, and governance gaps

4. Target State Definition

Be clear about what "target state" means - it's the desired future maturity level, not a description of specific solutions or implementations. The target state should:

• Align with business strategy
• Be realistic and achievable
• Consider risk appetite and constraints
• Be clearly defined and measurable

5. Improvement Roadmap Characteristics

The improvement roadmap should be:

• Phased (short-term, medium-term, long-term)
• Prioritized based on business value and risk
• Resource-constrained and realistic
• Clear about dependencies and sequencing

Common Exam Question Patterns

Pattern 1: "Which of the following is a PRIMARY output of Phase 4?"

Correct answers typically include: improvement roadmap, gap analysis report, target state definition, prioritized initiatives, governance structure.

Incorrect answers might include: actual implementation of processes (Phase 5), detailed training materials (Phase 5), performance metrics from current state (Phase 3), or initial assessment findings (Phase 1-2).

Pattern 2: "In Phase 4, what should be done FIRST?"

The correct answer is almost always to review and understand the current state assessment from Phase 3. You cannot plan improvements without understanding where you currently are.

Pattern 3: "Which criterion should NOT be used when prioritizing Phase 4 improvements?"

Avoid answers that mention random selection, favoritism, or arbitrary factors. All prioritization should be based on business value, risk, resources, and strategic alignment.

Pattern 4: "An organization must choose between two improvement initiatives. Initiative A has high strategic value but requires significant resources. Initiative B has lower strategic value but requires fewer resources. Which should be prioritized?"

The answer depends on the organization's stated constraints and objectives. However, the strategic value is typically weighted more heavily, but resource constraints must be realistic. A well-rounded answer would discuss both options' trade-offs.

Study Tips for Phase 4 Exam Success

Tip 1: Understand the Phase Progression

Memorize where Phase 4 fits in the overall sequence:

• Phase 1: Awareness and Commitment
• Phase 2: Assessment Activities
• Phase 3: Where Are We Now? (Current State)
• Phase 4: What Needs to Be Done? (Planning)
• Phase 5: How Do We Get There? (Implementation)

Understanding this context helps you answer questions about what should and shouldn't be happening in Phase 4.

Tip 2: Create a Gap Analysis Matrix

For studying, create a matrix showing:

• Different gap dimensions (process, capability, technology, organizational)
• Examples of gaps in each dimension
• How each gap type is addressed in improvement initiatives

Tip 3: Study Real-World Prioritization Examples

Practice prioritizing improvement initiatives using real-world scenarios. Consider:

• Why would an organization prioritize compliance-related improvements?
• What makes a "quick win" worth prioritizing early?
• How do dependencies affect prioritization order?

Tip 4: Understand the Governance Framework

Be familiar with typical Phase 4 governance structures:

• Steering Committee (Executive oversight)
• Program Management Office (PMO) (Coordination and control)
• Working Groups (Detailed work on specific areas)
• Communication channels and reporting

Tip 5: Know the Difference Between Target State and Implementation Strategy

This is a critical distinction often tested:

• Target State (Phase 4): "We need to reach maturity level 3 in Process X by 2024"
• Implementation Strategy (Phase 5): "We will hire a process manager, implement a workflow system, and conduct training to reach maturity level 3"

Tip 6: Review COBIT 2019 Maturity Model

Understanding the maturity model helps with Phase 4 questions because:

• Target states are expressed in maturity levels
• Gap analysis compares current maturity to target maturity
• Progression through maturity levels requires different initiatives

Red Flags: Incorrect Answer Patterns to Avoid

Red Flag 1: Implementation Details

If an answer talks about actually implementing a process, conducting training, or deploying a system, it's probably Phase 5 or later, not Phase 4. Phase 4 is about planning what needs to happen, not making it happen.

Red Flag 2: Current State Assessment

If an answer focuses on assessing or measuring current state, it's Phase 3. Phase 4 assumes the current state assessment is complete and focuses on what to improve.

Red Flag 3: Arbitrary Prioritization

Avoid answers suggesting improvements are prioritized by executive preference, team expertise, or ease of implementation without consideration of business value and risk.

Red Flag 4: Vague Target States

Incorrect answers might suggest target states like "improve governance" without specific maturity levels or measurable objectives.

Practice Question Examples

Question 1: "Which of the following BEST describes the primary focus of Phase 4: What Needs to Be Done?"

A) Implementing governance processes and controls
B) Assessing the current maturity of processes
C) Planning and prioritizing improvement initiatives based on gap analysis
D) Monitoring and reporting on implementation progress

Correct Answer: C - Phase 4 is about planning and prioritizing. A is Phase 5, B is Phase 3, D is Phase 6.

Question 2: "During Phase 4, an organization identifies the following gaps: compliance risk (high), operational efficiency (medium), and process documentation (low). Given limited resources, which should be addressed FIRST?"

A) All gaps should be addressed simultaneously
B) Process documentation, as it's the easiest to complete
C) Compliance risk, due to higher business impact and risk
D) Operational efficiency, as it provides immediate value

Correct Answer: C - Risk and compliance are typically prioritized highest. While quick wins matter, risk mitigation takes precedence.

Question 3: "What is the relationship between the target state definition and the improvement roadmap in Phase 4?"

A) The target state is created after the improvement roadmap is completed
B) The target state describes the desired end result, and the roadmap shows how to get there
C) The target state and roadmap are the same thing
D) The target state is only for compliance, while the roadmap addresses operational improvements

Correct Answer: B - The target state defines where we want to go; the roadmap outlines the path to get there. This is a critical relationship to understand.

Final Exam Day Tips

1. Read Questions Carefully

Pay special attention to words like "Phase 4 specifically," "output of Phase 4," "should happen in Phase 4," etc. These help identify what phase the question is really about.

2. Use Elimination Strategy

If unsure, eliminate answers that clearly belong to other phases. This often leaves you with the correct answer.

3. Think Sequentially

Remember that Phase 4 depends on Phase 3 completing first. If a question asks "what happens in Phase 4," answers should build on Phase 3 findings.

4. Consider Business Context

Phase 4 questions often have a business context. Always consider how improvements align with business objectives and risk appetite.

5. Balance Quick Wins with Strategic Value

Be ready to discuss the tension between quick wins (easy, visible progress) and strategic initiatives (higher business value, longer timeline). Phase 4 roadmaps typically include both.

By thoroughly understanding Phase 4: What Needs to Be Done?, studying the key concepts, practicing with exam-style questions, and remembering these tips, you'll be well-prepared to answer any Phase 4 questions on your COBIT 2019 Foundation exam with confidence.