Level 3: Established (Defined) Process

COBIT 2019 Foundation: Performance Management - Capability Level 3 (Established/Defined Process)

Understanding COBIT 2019 Level 3: Established (Defined) Process

Why This Matters

Capability Level 3 represents a critical turning point in organizational maturity. At this level, processes move from being primarily reactive and responsive to becoming proactive, standardized, and repeatable. Understanding Level 3 is essential for COBIT 2019 Foundation exams because it demonstrates how organizations transition from informal, ad-hoc practices to structured, managed processes that deliver consistent results.

This level is particularly important because:

• It shows the organization has formal process definitions and documentation
• Processes are communicated across the organization
• There is consistent execution of defined processes
• The organization can demonstrate compliance and repeatability

What is Level 3: Established (Defined) Process?

Level 3, also known as the Established or Defined Process level, describes processes that are:

1. Formally Defined and Documented
Processes are documented, standardized, and available to all relevant stakeholders. These aren't just known informally but are explicitly written down with clear procedures, responsibilities, and workflows.

2. Communicable and Understood
The defined processes are communicated throughout the organization. Stakeholders understand what the process is, why it exists, and how to execute it. Training and awareness programs ensure consistent understanding.

3. Consistently Executed
The organization follows the defined processes in a consistent manner across different projects, teams, and departments. Deviations are identified and managed.

4. Subject to Basic Monitoring
There is basic monitoring and oversight to ensure processes are being followed. Metrics and measurements track process performance and compliance.

5. Accountable and Responsible
Clear roles and responsibilities are assigned. People know who is accountable for process execution and outcomes.

Key Characteristics of Level 3 Processes

• Process Definition: Written procedures and work instructions exist
• Process Documentation: Clear documentation of inputs, outputs, activities, and decision points
• Ownership: Process owners are identified and accountable
• Training and Awareness: Personnel are trained on the defined processes
• Compliance Monitoring: Basic checks ensure process adherence
• Performance Metrics: Basic measurement of process performance exists
• Configuration Management: Changes to processes are managed through a defined change control mechanism

How Level 3 Works in Practice

Performance Management Example:

In a Level 3 Performance Management capability, the organization would have:

• Defined Performance Indicators: KPIs for IT performance management are documented and standardized across the organization
• Formal Measurement Process: A documented procedure for collecting, analyzing, and reporting performance metrics
• Clear Responsibilities: Teams know who is responsible for collecting metrics, analyzing data, and reporting results
• Regular Monitoring: Performance is monitored on a regular schedule (daily, weekly, monthly)
• Performance Reviews: Regular reviews of performance data occur and are documented
• Documented Standards: Performance thresholds and targets are defined and documented
• Training on Processes: Staff are trained on how to execute performance management processes

Differences Between Levels 2 and 3

Level 2 (Repeatable but Intuitive):

• Processes are repeatable due to experienced people knowing how to do them
• Relies heavily on individual knowledge and informal practices
• Similar results are achieved, but documentation is minimal
• Processes are reactive and depend on individuals

Level 3 (Established/Defined):

• Processes are repeatable because they are formally defined and documented
• Processes are standardized across the organization
• Comprehensive documentation exists
• Processes are proactive and managed regardless of individuals
• Organization is not dependent on key individuals

Differences Between Levels 3 and 4

Level 3 (Established/Defined):

• Processes are stable and standardized
• Basic monitoring ensures compliance
• Performance metrics exist but may not be extensively analyzed
• Improvements are ad-hoc

Level 4 (Predictable/Managed):

• Processes are measured and controlled quantitatively
• Performance is predictable and consistently meets defined objectives
• Data is extensively used for decision-making
• Improvements are data-driven and systematic

Critical Elements for Level 3 Achievement

1. Process Definition
Establish clear, written process definitions that describe what, why, how, when, and who for each process.

2. Roles and Responsibilities
Define clear roles, responsibilities, and authority levels for process execution.

3. Documentation Standards
Develop and maintain comprehensive process documentation including procedures, work instructions, and forms.

4. Communication Plan
Communicate processes to all relevant parties through training, documentation, and awareness programs.

5. Monitoring and Compliance
Implement basic monitoring mechanisms to track process compliance and performance.

6. Performance Measurement
Define and collect basic metrics to measure process performance and effectiveness.

7. Change Management
Establish a formal change control process for managing modifications to defined processes.

8. Resource Allocation
Ensure adequate resources (tools, people, time) are allocated to support process execution.

Exam Tips: Answering Questions on Level 3: Established (Defined) Process

Tip 1: Recognize Key Phrases
Look for exam questions that contain these phrases indicating Level 3:

• 'formally defined and documented'
• 'standardized across the organization'
• 'consistently executed'
• 'documented procedures'
• 'clear roles and responsibilities'
• 'training and awareness programs'
• 'basic monitoring and compliance checks'
• 'process owners'

Tip 2: Understand What Level 3 is NOT
Level 3 is NOT:

• Completely informal (that's Level 1)
• Dependent on one person knowing how to do it (that's Level 2)
• Extensively measured and quantified (that's Level 4)
• Automatically optimized (that's Level 5)

Tip 3: Focus on Standardization and Documentation
The core of Level 3 is standardization through documentation. When you see questions about Level 3, think:

• Is the process documented?
• Is it standardized across the organization?
• Do people understand the process?
• Is there basic monitoring to ensure it's being followed?

Tip 4: Distinguish Between Ad-hoc and Defined
A common exam trick asks you to choose between Level 2 and Level 3. Remember:

• Level 2: Things work because experienced people know what to do (ad-hoc, informal)
• Level 3: Things work because there's a defined process everyone follows (formal, standardized)

Tip 5: Look for Process Ownership
Level 3 questions often mention process owners, process managers, or clear accountability. If a scenario discusses formal assignment of process responsibility, it's likely Level 3.

Tip 6: Identify Basic Metrics vs. Advanced Metrics
When questions discuss metrics:

• Level 3: Basic metrics track compliance and performance (e.g., process completion time, error rate)
• Level 4: Quantitative metrics with statistical analysis and process control limits

Tip 7: Recognize Change Control
Level 3 includes formal change control for processes. If a scenario mentions formal approval for changing procedures, this indicates Level 3 or higher.

Tip 8: Communication and Training Are Key**
Level 3 emphasizes communication. Look for:

• Training programs on the defined process
• Documentation available to all stakeholders
• Regular communication about the process

Tip 9: Use Elimination Strategy
For challenging questions:

• If it mentions no documentation → Level 1
• If it depends on one person → Level 2
• If it has documentation and formal process → Level 3
• If it has quantitative metrics and control → Level 4
• If it includes continuous optimization → Level 5

Tip 10: Practice Scenario Analysis
Break down scenarios into components:

• Is there a written process definition? ✓ (points to Level 3+)
• Is it standardized? ✓ (points to Level 3+)
• Is it consistently followed? ✓ (points to Level 3+)
• Is there basic monitoring? ✓ (points to Level 3+)
• Is there quantitative control? ✗ (rules out Level 4+)

Answer: Level 3

Common Exam Question Patterns

Pattern 1: Scenario with Process Documentation
Question: 'An organization has documented all IT performance management processes. Procedures are standardized and all staff have received training. What is the capability level?'
Answer Strategy: Look for documentation + standardization + training = Level 3

Pattern 2: Comparing Informal vs. Formal
Question: 'The team currently follows procedures informally, based on experience. Management wants to ensure consistency even if key people leave. What is the current level and target level?'
Answer Strategy: Current = Level 2 (dependent on people); Target = Level 3 (process-dependent)

Pattern 3: Metrics and Measurement
Question: 'The organization tracks basic performance metrics and compares them to defined targets. Is this Level 3?'
Answer Strategy: Yes, if it's basic metrics and thresholds. If it's statistical control limits, it's Level 4.

Pattern 4: Process Changes
Question: 'When a process needs to be updated, a formal change control process is followed. What does this indicate?'
Answer Strategy: Formal change control indicates Level 3 or higher. Combined with basic monitoring, it's Level 3.

Summary: Quick Reference for Level 3

Definition: Processes are formally defined, documented, standardized, and consistently executed with basic monitoring.

Key Word: 'Established' or 'Defined'

Main Features:

• Formal process documentation
• Standardized execution
• Clear roles and responsibilities
• Training and communication
• Basic monitoring and metrics
• Formal change control

How to Identify in Exams: Look for formal definitions, standardization, documentation, training, and basic monitoring without extensive quantitative control.

Common Pitfalls to Avoid:

• Don't confuse Level 2 (informal but repeatable) with Level 3 (formal and standardized)
• Don't assume Level 3 has the extensive metrics of Level 4
• Don't miss the importance of documentation in distinguishing Level 2 from Level 3
• Remember that training and communication are hallmarks of Level 3