Phase 6: Did We Get There?

Phase 6: Did We Get There? - Complete COBIT 2019 Foundation Guide

Introduction to Phase 6: Did We Get There?

Phase 6: Did We Get There? represents the final and critical evaluation phase in the COBIT 2019 implementation roadmap. This phase focuses on measuring, monitoring, and validating whether the organization has successfully achieved its intended governance and management objectives through the implementation of COBIT practices.

Why Phase 6 is Important

Strategic Importance:

• Provides objective evidence of implementation success and value realization
• Enables continuous improvement by identifying gaps and areas for refinement
• Demonstrates return on investment (ROI) to stakeholders and leadership
• Ensures accountability and transparency in governance practices
• Helps organizations understand whether control objectives have been met
• Supports compliance with regulatory and legal requirements
• Establishes a baseline for future enhancements and optimization

Without Phase 6, organizations cannot confidently assert that their COBIT implementation has been successful or understand what adjustments may be needed.

What is Phase 6: Did We Get There?

Definition: Phase 6 is the assessment and validation phase where organizations measure the effectiveness and maturity of their implemented COBIT governance and management practices against pre-defined targets and success criteria.

Key Characteristics:

• Measurement-Focused: Utilizes metrics and key performance indicators (KPIs) to evaluate implementation success
• Comparative Analysis: Compares actual results against planned objectives and target maturity levels
• Holistic Evaluation: Assesses all governance and management domains covered in the implementation
• Evidence-Based: Relies on concrete data and documentation to validate achievements
• Stakeholder Reporting: Communicates results to all relevant parties including leadership, auditors, and boards
• Continuous Assessment: Not a one-time activity but an ongoing process to maintain and improve governance

How Phase 6 Works

Step 1: Define Success Criteria and Targets

• Review the objectives established in earlier phases
• Establish specific, measurable, achievable, relevant, and time-bound (SMART) success criteria
• Define target maturity levels for each governance and management process
• Align success criteria with business objectives and strategic goals
• Document expected outcomes and key performance indicators (KPIs)

Step 2: Establish Measurement and Monitoring Framework

• Identify appropriate metrics for each COBIT domain and process
• Determine data collection methods and frequency
• Assign responsibility for measurement activities
• Create dashboards and reporting mechanisms
• Establish baseline measurements for comparison
• Define acceptable ranges and thresholds for metrics

Step 3: Conduct Assessment Activities

• Perform maturity assessments using COBIT assessment models
• Review implemented controls and their operational effectiveness
• Evaluate process documentation and evidence of execution
• Conduct interviews with process owners and stakeholders
• Analyze metrics data collected during the monitoring period
• Compare actual implementation against design specifications

Step 4: Analyze Results and Identify Gaps

• Compare actual maturity levels against target maturity levels
• Identify areas where implementation meets or exceeds targets
• Identify gaps where implementation falls short of objectives
• Analyze root causes of any significant deviations
• Determine impact of gaps on business objectives and risk profile
• Prioritize gaps based on business criticality and risk exposure

Step 5: Report Findings and Validate Achievement

• Prepare comprehensive assessment reports for different stakeholder groups
• Present findings to governance bodies and leadership
• Validate achievements against defined success criteria
• Obtain stakeholder acknowledgment of results
• Document lessons learned and best practices
• Communicate results transparently across the organization

Step 6: Plan Continuous Improvement

• Develop remediation plans for identified gaps
• Prioritize improvement initiatives based on business impact
• Allocate resources for closing gaps and enhancement
• Establish timeline for next assessment cycle
• Integrate learnings into ongoing governance processes
• Create feedback loops for continuous optimization

Key Activities in Phase 6

Assessment Activities:

• Self-Assessments: Internal evaluation by process owners and teams
• Independent Assessments: Third-party evaluation for objectivity and credibility
• Maturity Model Assessments: Using COBIT's five-level maturity scale
• Process Compliance Reviews: Verifying processes operate as designed
• Control Effectiveness Testing: Validating that controls are working as intended

Measurement and Monitoring:

• Tracking KPIs in real-time dashboards
• Monitoring process cycle times and efficiency
• Measuring quality and accuracy of outputs
• Assessing stakeholder satisfaction and engagement
• Monitoring risk indicators and control performance
• Collecting quantitative and qualitative data

Reporting and Communication:

• Executive summaries for senior leadership
• Detailed technical reports for process teams
• Board-level governance reports
• Audit and compliance documentation
• Stakeholder presentations and feedback sessions
• Trend analysis and predictive reporting

COBIT Maturity Levels in Phase 6 Assessment

Phase 6 evaluates implementation against COBIT's five capability maturity levels:

• Level 0 - Incomplete: Process is not implemented or fails to achieve its purpose
• Level 1 - Performed: Process is executed and achieves its purpose, but may be informal
• Level 2 - Managed: Process is planned, executed, and monitored with defined procedures
• Level 3 - Defined: Process is standardized, documented, and integrated with other processes
• Level 4 - Quantitatively Managed: Process is controlled using quantitative objectives and measurements
• Level 5 - Optimized: Process is continuously improved and adapted to changing business needs

Metrics and KPIs in Phase 6

Common Categories of Metrics:

• Process Metrics: Efficiency, cycle time, error rates, throughput
• Quality Metrics: Accuracy, completeness, timeliness of outputs
• Compliance Metrics: Policy adherence, regulatory compliance, control operation rates
• Business Metrics: Business value realization, cost savings, risk reduction
• Stakeholder Metrics: Satisfaction levels, engagement rates, feedback scores
• Risk Metrics: Incident frequency, resolution time, risk exposure reduction

Challenges in Phase 6

• Data Collection Difficulties: Gathering reliable and complete measurement data from multiple sources
• Defining Appropriate Metrics: Selecting metrics that truly reflect process effectiveness
• Resource Constraints: Allocating sufficient resources for assessment activities
• Stakeholder Alignment: Ensuring all parties agree on success criteria and target levels
• Organizational Resistance: Overcoming resistance to honest assessment of implementation gaps
• Continuous Monitoring: Maintaining ongoing measurement beyond initial assessment
• Interpreting Results: Accurately analyzing data and identifying root causes of deviations

Best Practices for Phase 6 Implementation

• Start with Clear Baselines: Establish initial capability measurements before implementing changes
• Use Multiple Assessment Methods: Combine self-assessment, independent assessment, and ongoing monitoring
• Focus on Business Outcomes: Align measurements with business impact rather than only process metrics
• Automate Data Collection: Implement tools to automatically capture measurement data where possible
• Establish Clear Accountability: Assign clear ownership for measurement and reporting activities
• Communicate Transparently: Report both successes and gaps honestly to all stakeholders
• Plan for Continuous Improvement: Use assessment results to drive ongoing enhancement activities
• Involve Leadership Support: Ensure executive sponsorship of assessment activities and follow-up actions
• Document Everything: Maintain comprehensive documentation of assessment methodologies, data, and findings
• Schedule Regular Reassessments: Conduct periodic reassessments to track progress and identify new gaps

Exam Tips: Answering Questions on Phase 6: Did We Get There?

1. Understand the Core Purpose:

• Remember that Phase 6 is fundamentally about measurement and validation of implementation success
• Key words to look for in questions: assessment, maturity, measurement, gap analysis, validation
• When answering, emphasize that this phase determines whether objectives have been achieved

2. Know the Sequence and Context:

• Recognize that Phase 6 comes after implementation in the COBIT roadmap
• Understand how Phase 6 relates to earlier phases: it measures whether Phases 1-5 initiatives were successful
• If asked about timing, Phase 6 activities occur post-implementation and continue as ongoing activities

3. Master the Assessment Components:

• Be familiar with the key elements: defining success criteria, establishing measurement framework, conducting assessments, analyzing results, reporting findings, planning improvements
• When a scenario describes assessment activities, identify which of these components it represents
• Multiple choice questions often test whether you can match activities to their appropriate phase

4. Remember the Maturity Levels:

• Be prepared to apply the five COBIT maturity levels (Incomplete, Performed, Managed, Defined, Quantitatively Managed, Optimized)
• Questions may present scenarios requiring you to identify current vs. target maturity levels
• Understand that organizations rarely jump multiple maturity levels quickly

5. Focus on Metrics and KPIs:

• When asked about measurement, think about what to measure, how to measure it, and how often to measure
• Common exam questions ask which metrics would be appropriate for specific processes
• Remember that metrics should be SMART: Specific, Measurable, Achievable, Relevant, Time-bound

6. Distinguish Assessment Types:

• Know the difference between self-assessments and independent assessments
• Understand when each type is appropriate (e.g., independent assessments provide more credibility for external reporting)
• Questions may ask which assessment type would be most appropriate for specific situations

7. Recognize Gap Analysis Concepts:

• Gap analysis is critical in Phase 6; questions often test this concept
• Be able to identify: current state (as-is), target state (to-be), and gap (difference)
• Understand that gap analysis drives remediation planning and continuous improvement

8. Apply Stakeholder Reporting Principles:

• Know that different stakeholders need different types of reports and levels of detail
• Executive leadership needs high-level summaries and business impact information
• Technical teams need detailed process-level findings and recommendations
• Boards need governance-level assurance about control effectiveness

9. Connect to Business Objectives:

• Strong exam answers connect Phase 6 activities to business value and strategic objectives
• When describing measurement, explain why specific metrics matter for the business
• Remember that COBIT implementations should support business goals, not exist in isolation

10. Handle Scenario-Based Questions:

• For case studies, identify what Phase 6 activities are being described or should be performed
• Look for clues like words such as: assess, measure, evaluate, validate, monitor, report
• If a scenario describes problems with measurement or reporting, consider what Phase 6 improvements are needed

11. Avoid Common Misconceptions:

• Don't confuse Phase 6 with implementation (that's Phase 5). Phase 6 is about measuring the results of implementation
• Don't assume Phase 6 is a one-time activity; it includes ongoing monitoring
• Don't overlook the importance of honest gap reporting; attempting to hide gaps is not best practice
• Don't forget that assessment results should drive continuous improvement planning

12. Structure Your Answer:

• For essay or longer-answer questions, structure responses as: Purpose → Activities → Measurement → Reporting → Improvement
• Start with why Phase 6 is important (establishes credibility)
• Explain what specifically would be measured
• Describe how assessment would be conducted
• Address how results would be communicated
• Conclude with next steps for continuous improvement

13. Use COBIT Terminology:

• Use proper COBIT terms in exam answers: capability maturity, process assessment, key performance indicator (KPI), baseline, target level
• This demonstrates understanding and aligns with what the exam expects
• Avoid generic terms when COBIT-specific terminology is available

14. Remember the Purpose of Assessment:

• Assessment is not punitive; it's about understanding current state and planning improvement
• Honest assessment, even when showing gaps, is better than attempting to hide problems
• Assessment provides valuable data for strategic decision-making

15. Practice with Examples:

• Consider practical examples: How would you measure IT service management effectiveness? How would you assess security control implementation? How would you determine if governance improvements have reduced risk?
• The ability to apply concepts to realistic scenarios is often tested in exams

Sample Exam Questions for Phase 6

Question 1: An organization has completed implementation of COBIT practices in its IT governance framework. Which Phase 6 activity would be most appropriate to determine if the implementation has achieved its intended business outcomes?
Answer: Conducting capability maturity assessments and comparing results against target maturity levels, combined with measurement of key performance indicators related to business objectives.

Question 2: What is the primary difference between a self-assessment and an independent assessment in Phase 6?
Answer: Self-assessments are conducted by internal teams with direct process knowledge but may lack objectivity, while independent assessments are conducted by external parties and provide greater credibility and impartiality, though may require more resources.

Question 3: An organization discovers through Phase 6 assessment that their IT process maturity is at Level 2 but the target level is Level 4. What should be their immediate next step?
Answer: Conduct gap analysis to identify specific gaps between current and target states, determine root causes, and develop a prioritized remediation plan with resource allocation and timelines for improvement.

Conclusion

Phase 6: Did We Get There? is essential for validating COBIT implementation success and driving continuous improvement. By mastering the assessment methodologies, measurement frameworks, and reporting approaches outlined in this guide, you'll be well-prepared to answer exam questions about this critical phase. Remember that successful Phase 6 implementation requires clear success criteria, robust measurement processes, honest assessment and reporting, and commitment to using results for ongoing optimization of governance and management practices.