COBIT 2019 Foundation: Level 0 - Incomplete Process

Level 0: Incomplete Process - Complete Guide

Why Level 0: Incomplete Process is Important

Understanding Level 0 (Incomplete) in COBIT 2019 is crucial for several reasons:

• Risk Assessment: Identifies organizations operating without defined processes, leading to unpredictable outcomes and high risk exposure
• Baseline Establishment: Helps establish where an organization currently stands before improvement initiatives
• Governance Foundation: Demonstrates the necessity of process implementation for effective IT governance
• Compliance Requirements: Essential for understanding minimum governance standards and regulatory compliance gaps
• Strategic Planning: Informs prioritization of process improvement efforts and resource allocation

What is Level 0: Incomplete Process?

Level 0 represents the lowest capability maturity level in the COBIT 2019 Capability Maturity Model (CMM). At this level:

• No Process Implementation: The process is either not implemented or not functioning as intended
• Unpredictable Outcomes: Results are inconsistent, unreliable, and dependent on individual efforts
• Lack of Systematic Approach: There is no standardized method, documentation, or formal structure
• Ad Hoc Activities: Any activities performed are informal, reactive, and not aligned with organizational objectives
• No Measurement: Performance is not measured, monitored, or managed
• Minimal Documentation: Little to no documented procedures, policies, or work instructions exist

Characteristics of Level 0: Incomplete

The following characteristics define an Incomplete Process at Level 0:

How Level 0: Incomplete Process Works

Understanding the mechanics of Level 0 helps identify it in real-world scenarios:

Typical Scenarios at Level 0

Scenario 1: Change Management Absent

• IT changes are made without formal approval or documentation
• Staff members make changes based on personal judgment
• No change control board or formal request process exists
• Consequences include frequent system outages and security incidents

Scenario 2: Risk Management Not Implemented

• Organizations operate without identifying or assessing risks
• Risk response is reactive—only addressing problems after they occur
• No risk register or systematic risk management framework
• Business objectives are frequently compromised by unforeseen issues

Scenario 3: Security Incident Response Undefined

• Security incidents are handled by whoever is available
• No incident response plan or procedures exist
• Investigation and remediation are inconsistent and often incomplete
• Forensic evidence may be lost due to lack of protocol

Why Organizations Remain at Level 0

• Lack of Awareness: Leadership may not recognize the importance of formal processes
• Resource Constraints: Insufficient budget or personnel to implement processes
• Organizational Culture: Informal, reactive culture resistant to structured approaches
• Legacy Systems: Outdated technology that cannot support structured processes
• Crisis Management Mode: Continuous firefighting leaves no time for process development

Progression from Level 0

To move beyond Level 0, organizations must:

• Define Processes: Establish clear, documented process definitions
• Assign Responsibilities: Designate roles and accountability
• Create Documentation: Develop procedures, policies, and work instructions
• Allocate Resources: Provide necessary tools, training, and personnel
• Implement Controls: Establish basic process controls and compliance mechanisms
• Begin Monitoring: Start measuring and tracking process performance

How to Answer Questions Regarding Level 0: Incomplete Process in an Exam

Common Question Types and Approaches

Type 1: Identification Questions

Example: "Which of the following best describes a Level 0: Incomplete process?"

Answer Strategy:

• Look for indicators of no formal implementation
• Identify keywords like "ad hoc," "reactive," "informal," "undocumented," "unpredictable"
• Recognize scenarios where processes are not systematically applied
• Avoid confusing with higher levels that show some structure or measurement

Type 2: Scenario-Based Questions

Example: "An organization frequently experiences IT security breaches with no documented incident response procedures. Which capability level is this organization most likely at?"

Answer Strategy:

• Identify absence of documented processes
• Note lack of systematic response or consistent approach
• Recognize reactive rather than proactive management
• Select Level 0 if there's no formal process implementation

Type 3: Characteristic Matching

Example: "Which of these is NOT a characteristic of Level 0: Incomplete?"

Answer Strategy:

• Eliminate options that describe any form of structured activity
• Eliminate options mentioning measurement or monitoring
• Eliminate options describing defined responsibilities
• Select the option that indicates some process maturity

Type 4: Gap Analysis Questions

Example: "What is the primary gap at Level 0: Incomplete that must be addressed to reach Level 1: Performed?"

Answer Strategy:

• Focus on process definition and documentation
• Emphasize establishing basic structure and responsibilities
• NOT measurement (that comes at Level 3)
• NOT optimization (that comes at Level 5)

Exam Tips: Answering Questions on Level 0: Incomplete Process

Tip 1: Remember the Progression Logic

COBIT 2019 Capability Levels progress logically:

• Level 0: Incomplete → No process
• Level 1: Performed → Process exists but informal
• Level 2: Managed → Process is defined and managed
• Level 3: Established → Process is standardized and documented
• Level 4: Predictable → Process is measured and controlled
• Level 5: Optimized → Process is continuously optimized

Exam Use: If a question describes any form of activity, it's likely NOT Level 0. Level 0 has essentially nothing in place.

Tip 2: Focus on Absence, Not Presence

Level 0 is defined by what is missing, not what exists:

• No documented process
• No assigned responsibilities
• No measurement or monitoring
• No systematic approach

Exam Use: When evaluating options, look for descriptions of lack or absence. Words like "no," "none," "absent," "undefined" are key indicators of Level 0.

Tip 3: Distinguish from Level 1

This is critical—Level 0 and Level 1 are often confused:

Exam Use: If the scenario describes any activity being performed, even informally, it's Level 1 or higher, NOT Level 0.

Tip 4: Recognize Real-World Level 0 Indicators

In exam questions, look for these concrete Level 0 red flags:

• Absence of formal procedures: "There is no documented procedure for..."
• Reactive crisis management: "The organization only responds to problems after they occur..."
• Individual dependency: "Success depends entirely on individuals..." or "...whoever happens to be available..."
• No coordination: "Different departments handle this differently..."
• No tracking: "We don't track or measure this process..."
• No accountability: "Roles and responsibilities are unclear..."

Tip 5: Understand the Gap to Level 1

Questions often ask what's needed to move from Level 0 to Level 1:

• Basic Process Implementation: Establish that the process is actually performed
• Minimal Documentation: Create at least basic procedure documentation
• Role Definition: Assign clear responsibilities for process execution
• Evidence of Performance: Show that the process activities are actually being done

Exam Use: If asked about improvement from Level 0, focus on getting the process actually performed, not on optimization, measurement, or advanced controls.

Tip 6: Watch for Trick Options

Exam creators often use these tricks:

• Trap: Options describing measurement or metrics
  Reality: Level 0 has NO measurement—that starts at Level 2 or higher
• Trap: Options describing automation or tools
  Reality: Level 0 doesn't even have basic processes to automate
• Trap: Options describing continuous improvement
  Reality: Level 0 organizations aren't even at the first stage of improvement
• Trap: Options describing training or competency programs
  Reality: These imply processes exist; they don't at Level 0

Tip 7: Use Process of Elimination

When uncertain:

1. Eliminate any option mentioning: measurement, monitoring, metrics, KPIs, automation, standards, training programs, continuous improvement
2. Eliminate any option showing: coordination, documentation, defined roles, systematic approaches
3. What remains: Should describe absence, ad hoc nature, or lack of implementation

Tip 8: Contextualize Within COBIT 2019 Framework

Remember that COBIT 2019 has specific governance and management objectives:

• Common scenarios at Level 0: Risk management, change management, security incident response, and governance processes that are not formally implemented
• Industry pattern: Smaller organizations or specific function areas that haven't yet formalized processes
• Exam context: Often appears in scenarios showing organizational problems or governance failures

Exam Use: When you see a scenario describing organizational chaos or frequent incidents in a specific area, Level 0 is likely the answer.

Tip 9: Quick Reference During Exam

If you need a quick mental checklist to identify Level 0:

• ✓ Is the process not documented? → Likely Level 0
• ✓ Is the process not performed consistently? → Likely Level 0
• ✓ Are roles unclear? → Likely Level 0
• ✓ Is there no measurement? → Could be Level 0 or 1
• ✓ Are results unpredictable? → Likely Level 0 or 1
• ✓ Is the response purely reactive? → Likely Level 0

Tip 10: Avoid Common Misconceptions

Misconception 1: "Level 0 means there's complete chaos."
Reality: Level 0 means the process itself isn't formally implemented—but the organization may function through individual competence.

Misconception 2: "Level 0 organizations always fail."
Reality: Level 0 organizations are high-risk but may survive through individual effort and external luck.

Misconception 3: "Moving to Level 1 requires extensive effort."
Reality: Level 1 only requires establishing that the process is performed—not making it perfect.

Misconception 4: "Level 0 has no activities at all."
Reality: Activities may occur, but they're not systematized, not documented, and not managed.

Sample Exam Questions and Answers

Sample Question 1

Question: "An organization experiences frequent IT security incidents with no documented incident response procedures. The incident response depends on whoever is available at the time, and there is no tracking or follow-up. At which capability level is this organization currently operating?"

A) Level 0: Incomplete
B) Level 1: Performed
C) Level 2: Managed
D) Level 3: Established

Answer: A) Level 0: Incomplete

Explanation: The lack of documented procedures, absence of systematic approach, and reactive ad hoc response are clear indicators of Level 0. The phrase "depends on whoever is available" especially indicates no formal implementation.

Sample Question 2

Question: "Which of the following is NOT a characteristic of a Level 0: Incomplete process?">

A) The process is performed in an ad hoc manner
B) The process is defined and documented in a standard procedure manual
C) Process results are unpredictable
D) Roles and responsibilities are unclear

Answer: B) The process is defined and documented in a standard procedure manual

Explanation: A documented standard procedure indicates at least Level 1 (Performed). Level 0 is characterized by the ABSENCE of such documentation.

Sample Question 3

Question: "What is the primary requirement to move an organization from Level 0: Incomplete to Level 1: Performed for a specific IT governance process?">

A) Implement automated monitoring and reporting tools
B) Establish that the process is actually being performed and assign clear responsibilities
C) Develop comprehensive metrics for measuring process effectiveness
D) Align the process with industry best practices and standards

Answer: B) Establish that the process is actually being performed and assign clear responsibilities

Explanation: Movement from Level 0 to Level 1 requires only basic implementation and assigned responsibility. Measurement (C), automation (A), and standardization (D) are requirements for higher levels.

Key Takeaways

• Definition: Level 0: Incomplete means the process is not implemented or is severely deficient
• Characteristics: Absence of documentation, unpredictable outcomes, ad hoc activities, unclear responsibilities
• Risk: Organizations at Level 0 face high risk of governance failures, security breaches, and operational incidents
• Exam Focus: Recognize Level 0 by the ABSENCE of structure, documentation, and systematic approach
• Distinction: Level 0 has essentially NO formal process; Level 1 has informal but actual process performance
• Improvement Path: Moving to Level 1 requires establishing basic process implementation, not sophisticated controls or measurement