Enabling Processes

CHAPTER 5
COBIT 5 PROCESS REFERENCE GUIDE CONTENTS
APO01 Process Practices, Inputs/Outputs and Activities (cont.)
APO01.01 Activities
1. Define the scope, internal and external functions, internal and external roles, and capabilities and decision rights required, including those IT activities
performed by third parties.
2. Identify decisions required for the achievement of enterprise outcomes and the IT strategy, and for the management and execution of IT services.
3. Establish the involvement of stakeholders who are critical to decision making (accountable, responsible, consulted or informed).
4. Align the IT-related organisation with enterprise architecture organisational models.
5. Define the focus, roles and responsibilities of each function within the IT-related organisational structure.
6. Define the management structures and relationships to support the functions and roles of management and execution, in alignment with the
governance direction set.
7. Establish an IT strategy committee (or equivalent) at the board level. This committee should ensure that governance of IT, as part of enterprise
����������� �� ���������� ���������� ������ �� ��������� ���������� ��� ������ ����� ����������� �� ������ �� ��� ���� ������
8. Establish an IT steering committee (or equivalent) composed of executive, business and IT management to determine prioritisation of IT-enabled
���������� ���������� �� ���� ���� ��� ������������ �������� �������� ��� ����������� ����� ������ �� �������� ��� ������� �������� ���������� ���
monitor service levels and service improvements.
�� ������� ���������� ��� ���� ���������� ��������� ���������� �������� ����������� ������� ���������� ������� ��������� ����������� ��� ���������� ��
well as required inputs for and expected outcomes of meetings.
10. Define ground rules for communication by identifying communication needs, and implementing plans based on those needs, considering top-down,
bottom-up and horizontal communication.
11. Establish and maintain an optimal co-ordination, communication and liaison structure between the business and IT functions within the enterprise
and with entities outside the enterprise.
12. Regularly verify the adequacy and effectiveness of the organisational structure.
Management Practice Inputs Outputs
APO01.02 Establish roles and responsibilities.
From Description Description To
Establish, agree on and communicate roles and
EDM01.01 Authority levels Definition of IT-related DSS05.04
responsibilities of IT personnel, as well as other
roles and responsibilities
stakeholders with responsibilities for enterprise IT, that
������� ������� ������� �������� ����� ��� �� ���������� EDM04.02 Assigned responsibilities Definition of supervisory APO07.01
��� �������� ����������� ���������� ����������������
for resource management practices
and accountability.
APO07.03 � ����� ����������� �����
� ������ ��� ������������
matrix
APO11.01 Quality management
system (QMS) roles,
responsibilities and
decision rights
APO13.01 Information security
management system
(ISMS) scope statement
DSS06.03 � ��������� ������
of authority
� ��������� ����� ���
responsibilities
Activities
1. Establish, agree on and communicate IT-related roles and responsibilities for all personnel in the enterprise, in alignment with business needs and
����������� ������� ��������� ���������������� ��� ����������������� ���������� ��� �������� ������ ��� ����������
2. Consider requirements from enterprise and IT service continuity when defining roles, including staff back-up and cross-training requirements.
3. Provide input to the IT service continuity process by maintaining up-to-date contact information and role descriptions in the enterprise.
4. Include in role and responsibility descriptions adherence to management policies and procedures, the code of ethics, and professional practices.
5. Implement adequate supervisory practices to ensure that roles and responsibilities are properly exercised, to assess whether all personnel have
sufficient authority and resources to execute their roles and responsibilities, and to generally review performance. The level of supervision should be in
line with the sensitivity of the position and extent of responsibilities assigned.
6. Ensure that accountability is defined through roles and responsibilities.
7. Structure roles and responsibilities to reduce the possibility for a single role to compromise a critical process.
Personal Copy of: Mr. Dong Hong Wang
53
Align, Plan and Organise