Governance and Management Objectives

1. Overview of the COBIT Core Model

Welcome to the G&G management objective section. Before we start this section, I will tell you a story and explain the terminology in simple language. And then we will go through the official definitions. This introduction is not part of the exam and you won't find it anywhere in the official books, but it will help you to understand the basic terminology. Here is the story: Cobbt was originally created for auditors. And you know what auditors do? They will come and inspect it and tell you what you are doing incorrectly. So, do you believe the auditor is really that smart that he knows exactly how everything in your system should work? No way. Nobody knows everything. That's why auditors are using Cobbit. Consider Cobbt to be a checklist of hundreds or thousands of things that must be done in your it in order for it to function properly, safely, and efficiently. An example of such things in the checklist may be to evaluate and prioritise changes in your So the most important changes get done first, and that is just one item out of these hundreds. The checklist is really huge, so we need to give it some kind of structure. Let's divide these hundreds of items into four different areas, and let's call these areas Governance and Management Objectives. Our example Evaluate and prioritise changes would be an area called "Manage It Changes." We can group even more and divide these governance and management objectives into five parts,which we will call five domains You can find a complete checklist divided into 40 governance and management objectives and five domains in one book if you have downloaded the COBIT 2019 framework for governance and Management Objectives.The book is structured into 40 chapters,so each objective has its own chapter. This structure is called the Cobidt.Cormodel. From now on, this information will be updated and include the official definitions. The COBIT model is divided into five parts. Five domains, one called EDM, Evaluate, Direct, and Monitoris for governance, and you can find objectives that must be achieved by the governing body of the company. An example can be an objective called "EDM four-ensured resource optimisation." So the governing body of an organization, let's say Nike, must ensure that the Nike IT department has the right people, processes, and technology to support the entire business, including online and ideally effectively and at optimal cost. So Nike governing bodies are making sure that HR is doing their job in planning what people and skills will be needed for the future. The IT managers are preparing their technological roadmaps and there is perhaps a plan for sourcing people or technologies by vendors and so on. This EDM Zero Four objective, as well as all the other 39 objectives, are described in great detail in COBET and later we will see how to find this information. The remaining four domains contain objectives that must be achieved by the management of the company. The first one is APO, or Align, Plan, and Organize,which is an equivalent of basically creating and maintaining the strategy of the company for the future. Perhaps you've heard the terms "technological roadmaps" and "plans," which are examples. An example of one objective is the APO Five managed portfolio. This is for management. So the IT management of Nike must make sure that all the initiatives in IT such as projects,programs, new services and technology are prioritised and the most important projects get done first, and if some of the current services, applications and technology are no longer used, they make sure that they get decommissioned and don't waste the company's resources for support. The next management domain is build, acquire, and implement, and these are all objectives related to changes, projects, modifications, building new parts of the infrastructure, and similar. An example Here is Bai at six managed. It changes. Again, it is an objective for management to solve. It managers ensure that infrastructure changes are properly evaluated, approved, tested, and managed and controlled. DSS Deliver. The service and support domain is focused on operations, so you can find user requests and incident management. Problem management and similar objectives are here. An example of an objective in this domain is DSS two-managed service requests and incidents, which means that incidents and requests coming from the users' service desk are recorded. analysed and solved on time and the user communicated the status, so we can say the service requests and incidents are really well managed. And the last management domain is ME – monitor, evaluate, and assess, which is focused on measurement, optimisation, and improvement. For example, the MEA three manage compliance with external requirements objective instructs IT management to continuously monitor changes in laws and regulations and ensure that they are followed. These are just a few examples. Let's now have a look at the five domains displayed with all 40 objectives. These five domains are displayed here, and inside them you can see all 40 objectives. The topdog blue domain is the EDM domain for governance and the light blue are the APO Bai DSS domains. Just as we've described them, here is the sameinformation just it is not in the form of rectangles but as a list of all 40 objectives that the governing body must fulfill. I keep mentioning that all 40 objectives must be fulfilled by it, but please don't forget about various design factors which we've learnt about previously. Not every company will be fulfilling all of these objectives formally. We will cover that more late in the course. What is important now is that you understand all the objectives. So we will go now one by one and clarify their purpose. We will clarify why each objective is there and what it can do for you. While we'll do that, you can try to think about how this objective is fulfilled in your current company and whether it would be useful. Let us begin with the domain for governance, evaluate, direct, and monitor. So this will be a task for the governing body of the organization. You can see the purpose statement for each of these five governance objectives. I've already explained one example of the EDM domain in this lecture. But now I want to show you all of the objectives one by one. EDM One and Shoot administration Framework setting and maintenance In simple language, it means that your governing body, most senior directors, are doing the job. So they are meeting, setting the overall rules and governance for it and setting the way rules will be controlled within the organization. EDM Shared Advantages Delivery again, this is the responsibility of the governing body who makes sure that the company gets value for money from it. When you invest in it, in people, technology, infrastructure, do you get value for that money from It?Does it support your business well for that money? EDM three ensured danger. Optimization tells the governing body to keep checking whether the IT relatedrisks, such as outages, security breaches, and similar, are not too high and don't exceed tolerance. Idiom four. I've explained previously. This is the objective that I've explained earlier in this lecture on the Nike example. The objective ensures that the company has the right people, processes, and technology to support the entire business, including online andideally effectively and at optimal cost. And EDM Five is about working with stakeholders. Remember, governance are the rules that come from various stakeholders' stakeholder needs, such as customer needs,government regulation, employee needs, and others. To identify all these stakeholders and get to know their needs and process them is the goal of this objective. These purpose statements are just very high-level descriptions of each objective. If you are interested in what is hidden behind this objective in detail, you will find that out in the next lecture. Governance and Management Objectives Detailed Guidance So for now, we just go with these high-level statements. Let's continue with each objective within the APO domain. APO One managed Its management framework tells the management that they should set up proper organizationalstructure, processes, policies, procedures, and other governance components so the company works well in compliance with the rules of the governing body. APO Two tells the management to have a proper roadmap of where the organisation is going and how it wants to support its business. Which services and capabilities should it provide in the future to support the business well? APO three ensures that the organisation has captured, defined, and is maintaining their architecture. It consists of different building blocks thatthe It consists of.Building blocks can be of various types. Someone calls it the front end and the back end. Someone designed a transition operation and similar. Managed innovation is self-explanatory. It requires that the company be exploring and exploiting new possibilities, new technologies, and managedPortfolio, as we've explained earlier in this lecture, is the objective that ensures that all the initiatives in it, such as projects, programmes, new services, and technology, are prioritized, approved, or declined for implementation or decommissioning. Managed budgets and costs is just as the title says, having budgets and costs under control. And this is the second page for the APO domain. These objectives are mostly self-explanatory. I will just add a brief description to each of the eight managed relationships. This is an objective that tells the IT management to build a partnership with its customers and not only external but internal as well, such as HR, marketing, and finance. These are all its customers and we should have a long-term relationship with them. Many of you know APO's nine service agreements as SLAs. These are agreements between it and the businesses about various service parameters. For example, how available the service is or must be, and how quickly it will be repaired if it fails. As you can see, you also need managed vendors to maintain the quality of your IT infrastructure, control IT-related risks, and protect the critical data that your IT infrastructure processes. Let's move to the main objectives. This is the domain where new things get done, changes and portfolio decisions get implemented. Managed Programs is about managing programs, or we can say groups of related projects in an organised way to implement new services. New Software and Systems Capturing and processing requirements for that new software is part of the new system or software, and it has its own goal as well, which is this one managed requirements definition, which specifies how the pieces of the new software are recorded, stored, and built. It means preparing for installations and that is the Bai Three managed solutions, identification, and building. The new systems have to be available and have enough capacity, and we have rules to ensure that, and that is this objective. Managed availability and capacity management is quite an interesting objective. Its goal is to manage people who are affected by the change, especially their emotions and related behavior. Have you heard of the emotional cycle of a change? People generally don't like change, and when you are implementing new software systems, there will be different negative emotions like in this picture. As time goes by, you can see that a person may experience denial, anger, and depression. That is why we have an extraobjective called "manage organisational change" to help people absorb the change. And the sixth bar is for managing smaller chunks of change rather than projects or programs. Even a smaller update of a server is a change and should be managed even if it's not a project. More Bai was successful here. It changes, acceptance, and transitioning is an objective that makes sure that customers' users are prepared for a new solution. There is a plan for release, acceptance, testing, and proper communication with the customers and users. Bai Eight is a goal that instructs management to take care of the information and knowledge required in it. Examples could be knowledge bases Managed Assets is about managing all components that we have in it,especially hardware and software we have in It.We call them assets. If these assets need to be managed with extra detail, especially with links to each other and with capturing their particular configurations, This is the goal of managed configuration objectives. Finally, from the Bi domain, there are managed projects. Project management is about coordinating and managing new initiatives and building new systems in terms of costs, resources, and time. The DSS domain contains these six objectives. Managed Operations is about operating, maintaining, and monitoring your IT infrastructure. Managed service requests on incidents are ensuring that incidents and various requests from the users get processed and are well managed problems.The objective is to tell the IT management how to work on the root causes of incidents. Managed Continuity explains how to get it ready for disasters. You may know this area as disaster recovery. We need to manage security, of course, and also business process controls, which means that we help the customer with their business by monitoring whether what they do makes sense. For example, we can monitor whether prices on the companyISAB website make sense by testing whether they are not zero or whether they are not completely out of long term average and similar. And the MEA domain is managed Performance and conformancemonitoring is about setting the right metrics and KPIs throughout the organisation so we can find out if things go wrong with them. For example, we measure the number of major incidents per week per month or the number of failed changes, so if these numbers go high, we can intervene. systems of internal control you can imagine,like internal audit, which checks whether its systems and processes comply with internal rules or governanceexceptions are reported, proper monitoring is in place. And, like MEA three, it is concerned with ensuring that the company complies with external laws and regulations. Managed assurance is establishing an internal audit mechanism within it. For example, establishing rules that assuranceproviders are independent and qualified, and that assurance activities are planned and managed,taking risks into consideration. So we focus on risky areas first. For example, wow, are you overwhelmed? That was a long overview. Just to name the titles and briefly describe the objectives that they must achieve or perform. It's a huge list, and we haven't gone into any details here. As we said at the beginning of this lecture, there are hundreds of tasks for it and they are divided into these four objectives. So once we go to the next lecture, you will see where to find the details for each objective. If some of the objectives explained within this lecture didn't make sense to you, and you would like to find out how it really works and how it looks in detail, we will see how to find that out in the next lecture.

2. Governance and Management Objectives Detailed Guidance

Let's finally have a look at that magical checklist, which was the whole previous lecture. You can find it in the governance and management objectives book. In this book, each governance and management objective has its own chapter. In each chapter, there are seven parts, where each part is dedicated to one governance component. Please recall our lecture, Components of a Governance System,where we said that in order for it to be governed and managed well, it needs processes, organisational structures, people, and so on. We learned all seven of them and, remember, it was the picturelike flower here. Besides these seven parts, each objective also contains high-level information like Domain Name, Focus Area, and GoalCascade, which means which goals is It supporting.Then seven components and also related guidance where you can find more information about this objective outside Cobbit. But this is still theoretical. Let's have a look inside the book. Now let's say that Night Company wants to improve the way they do changes in it. They have a lot of failed and unauthorised changes. You, as the boss, want to see if COBIT can help you open the Governance and Management ObjectiveBook and find chapter Bai: Six Manage Changes. At the beginning of the chapter, you will find domain name management, objective namefocus, area description, and purpose. You can see the example here. The domain name is Bell Acquire and Implement. The full name of the management objective is Bai Six. Manage. It changes. "Focus error" is basic. The Cobbt Core model description is an overall explanation of what this objective teaches you, or we can say what the IT management must do. Here it says that it has to manage all changes in a controlled manner,including standard changes and emergency maintenance. Further, you can see the purpose, which is to enable fast and reliable delivery of change to the business and mitigate the risk of negatively impacting the stability of the change environment. Further, in the chapter you can find the goals the Bai Six are supporting. We call them alignment goals and enterprise goals. If you forget what alignmentgoals and enterprise goals mean, Please watch the lecture goal cascade again. And here are the goals for Bai Six. You don't have to study the content of Bai Six for the exam. It is just an example, but let's explore the example a bit anyway, so we can imagine what Alignment Goals and Enterprise Goals look like for this particular objective, Manage It Changes. This objective supports the Enterprise Goal EGOne portfolio of competitive products and services. So if the entire enterprise has this goal portfolio of competitive products and services, then you must implement this Managed It Changes objective. In the Goal Cascade lecture, you can see that each Enterprise Goal needs to be supported by one or more Alignment Goals. And here you can see that EG One is supported by Alignment Goal AG, Six Agility to turn business requirements into operational solutions. So our managed changes objectively support this AG Six goal. To help you verify whether you are really reaching your goals, you can see a few metrics below each goal. Now let's see the content of BaiSix for each of these seven components. Let's start with processes. Each Bai Six process component contains one or more management practises metrics. How to measure these practises and each practise consists of activities which are step-by-step guides on how to execute the process. Let's go through this example. As an IC manager, you realise that the way changes are handled in Nike is a bit haltick. The IT staff complains that changes suddenly appear in the infrastructure without them knowing. Users complain that some of the changes shouldn't be made and were initiated by people who have no right to initiate such changes and other issues. So you look at the COBIT manage changes process and you can see the first practise which says that the company must evaluate, prioritize, and authorise change requests. This practise is described instead of activities numbered from one to seven. Here you go through all these activities one by one and you see that number one tells you that you need an official change request for anyone who wants a change. This is beneficial because if someone wants to make a change, they can do so on your infrastructure without informing the others. This would be very dangerous. Activity two and three say that change requests must be categorised and prioritized,which makes very good sense too. You don't want to spend time on change requests that are just cosmetic adjustments of the website while an important security patch is waiting. And activity four is telling you that the right people must approve such a change, and we could continue further later. You will also see clearly defined responsibilities. Who is responsible for these practises within your company? Now you can see very clearly how these objectives and the processes inside them can help you with problematic areas. They help you solve problems and reduce stress by providing structure clarity. Next to activities, you can see a capability level. The higher the level, the more mature the process is. When such activity exists, we will explain how to work with capability levels and how to measure processmaturity in the next section on performance management. For each process, you can find suggestions to related frameworks, norms, and guidance that are on the market and you can find the process described there as well. Here is related guidance for our Bai Six. You've already heard that ITL also described the change management process pretty well, so you may want to review that and perhaps find a solution for your problems there as well. Let's see what organisational structures look like for Bai Six. Do you remember I promised to show you the responsibilities for each managed change process practice? Here they are in the form of a race table. On the left hand side, you can see each practice. Remember to check the practise of evaluating, prioritizing, and authorising change requests. At the top, you have the management roles that are responsible for making sure this practise gets executed. Well, they have the R letter and one person is ultimately accountable, which is the CIO. Here he has the A letter. If you would like to see what each of these roles means, please refer to the Governance and Management objectives books. Appendix B: organisational structures Overview and descriptions Each of these roles is described in Appendix B. I was talking about the racy table. The letters mean they are responsible, accountable, and consulted. I informed, consulted and informed roles depending on the organisational context and priorities. They are not included in COBET, same as for processes. If there is related market guidance referring to organisational structures,they will be included here. Next in the book, you can see sections related to information flows and items. For each practice, you can find inputs and outputs. Inputs may originate from another process. For example, an incident's root cause can be an input into managing changes. Output may then be sent to another process change plan and schedule. Output is sent to Bai Seven, which is a process for overall transition planning. Here we can see the mechanism for a managed change process. For example, for Bai Six, practice, evaluate, prioritize, and outrage change requests. You need an imported, integrated, and configured solution. Components and output will be changed per planned schedule for people's skills and competencies. Either the Information Age sphere or the Ecopetenance Framework ECF. These are frameworks outside of the scope of this course,but you can easily google them if you're interested. Here is an example for our BaiSix regarding principles, policies, and procedures. You can find atable with relevant principles, policies, and procedures for each objective, such as our example for Bai Six. Here similar for culture, ethics and behavior. For each objective, you can find a table with recommendations for culture, ethics, and behaviour, such as our example for Bai Six. Here you can see that some components, such as processes and organisational structures, are described in great detail,whilst skills, culture, ethics, and some other components just contain a brief sentence or two. That is because historically, when Kobet evolved, it contained only processes. Recently, the authors have been adding other components, but these newly added components are still described very briefly, which is a shame, but hopefully in the future they will be described in similar maturity as the processes are. And again for information flow principles,policies, procedures, and cultural ethic behavior. If it is relevant, you can find related guidance recommendations. We don't have any here for Bai Six. Finally, the last two components, infrastructure and applications, It provides detailed guidance on third-party services,types of infrastructure, and categories of applications. Here is an example for our BII six. You can see that Kobet recommends using configuration and change management tools. Examples of commonly used tools are ServiceNow binsmade, HP service manager, Owao manage engine and many more. If you are interested in how these tools work, there are plenty of YouTube videos or articles online. Just type the title of the video into Google or search for it on YouTube. That was a long walkthrough, right? We have checked the change management for Nike, but I strongly recommend you open the book now. Governance and Management Objectives Think of an area that doesn't work well in your company and find relevant objectives. If everything works great, just pick an objective that sounds interesting to you and you'd like to know more about it. Then find the relevant chapter for your chosen objective and look at its content. You don't need it for the exam, but it is practical for your daily work. You can find suggestions, solutions to your problems, or new ideas here. And this is the end of the whole section. Governance and Management Objectives By now you should be comfortable with the term "governance objective." Domain of Management Objectives In a perfect world, you should be able to give an example of an objective and its purpose and say in which domain you can find this objective. If not, I recommend you go through the last video lectures multiple times. The terminology is not easy and it requires a lot of attention and thinking from your side.

3. Governance and Management Objectives Practical Walkthrough – OPTIONAL

In the previous lecture, I recommended you try to pick one objective from the COBIT coremodel and discover how it looks in the Governance and Management Objectives book. If you manage that and it all seems clear to you, feel free to skip this lecture. If you still have doubts about whether you understood correctly, or if you didn't look into the book, I have prepared this walkthrough of an objective in my own copy of the book. I will select an objective now and we will proceed together to explore how it is defined in the Governance and Management Objectives book. Imagine Nike has the following long-term problems. Users are calling the service desk and are confused when their incidents get soft. They are doing their best, but it doesn't seem like enough. Customers complain that its systems and apps are too slow, but it guarantees that they are as fast as specified. It's the best in the world, doing a great job, but it's never enough for the customers. There is quite a lot of confusion about what it should provide to users and at what level of speed, availability, and security. This leads to a lot of confusion and hate between it and the users. These are signs that IT management is not doing its job in terms of agreements with the business customers. In other words, management is not fulfilling their objective. Managed Service Agreements Hey Nike It managers, let's stake this book and see the solution. APO Nine managedService Agreements is the full name of the management objective. This objective is in the book starting on page 113 and going up to page 117. I'm opening my own copy and going straight to page 113. You can see a very clear description here. So let me mark the description very clearly that this objective helps to align its products and services with what the business needs and expects. And that is exactly our trouble. Its users think they should get more from it, and it is doing its best. Apparently, the expectations are not aligned at all. If Nike wants to have competitive products and services and be optimised for their internal business process functionality, Okay, we are talking about enterprise goals and alignment goals. The goal must be set to deliver services in line with business requirements, which is currently not the case in Nike, as we saw that trouble. So in this Enterprise Goals Section and Alignment Goals Section, you can see which situation makes this objective very important. By situation, I mean when the company wants to have it aligned with business. If you want to measure such alignment, you can, for example, measure the percentage of users and customers satisfied with services and their levels, meaning availability, how fast you solve incidents and similar metrics. Well, that's great to know, but what to do in detail step by step? You can see that this is a component process part, right? So here is the section process. First you must identify the services or products. So we are here. That means that you have to identify what exactly is provided to the users and what is not. Do we provide email service, Internet portal service, video conference service, HR, evidence service,logistics for transportation, timesheets for employees, mobile phones, laptops and so on? In the activity sections here, you can see that you must first assess current IT services and their levels. This is the first point of how fast they are,how quickly you solve incidents, and so on. Next, you analyse and discuss with the customers what they need and how fast, how quick and further activities.Analyze what you already have and what the customer needs. So these activities, one to six, This was the first practise identify It services.Let's go to the next one. Moving to the next practise here,which is the second one, It makes services possible. This is a list of available services. You must record all the services that you provide or the Nike it provides into some form of catalogue or menu for the customers and users so they can see what they can get with all the details. If you go to a restaurant, you get a clear menu, right? You don't start discussing with the staff what they're cooking today, how fast it will take in the restaurant, which probably would be helpful as well for us. Next practice So, the third one is also very important to define and prepare service agreements. You must sit with the customer and write everything down. First you negotiate. The customer will tell you they want 100% availability, so you must explain to them what is possible and how much it costs. At the end, you agree on 80% and a reaction time for incidents of 8 hours. For example, you write that down and publish it within the company so everyone is very clear what it is delivering and what the customer is expecting. So I explain all this in my own language, in plain language, but it is described within these activity sections. Well, and that's not the end of the job. You must continuously monitor and, at a certain interval, show the customer that you are really fulfilling what you've agreed to, and that will be the next time you monitor and report service levels. It's our fourth practice. If you don't fulfil what you've agreed on, you inform the customer about the upcoming improvements that you are planning. From the customer's side, if the availability or response time is too low for them or anything from the agreed target SLAs, they have to tell you. Together, you will agree on what to do about it. Honestly, these discussions, while all the activities within this objective, are so crucial that if the IT management doesn't do them, at least informally,most of the IT stuff may suffer. Furthermore, if such a situation persists for an extended period of time, it may escalate into a war between it and the business. If you would like to see examples, references, and more definitions of how to perform these activities,you can see the related guidance section here. It's at the end of each management practise section. You can find such references. Okay, there is one more management practise about reviewing service agreements and contracts, which you can see the details here. But now comes the great part. If this objective is not well fulfilled in Nike, it and these practises or activities are not done, and you've even never seen such a written agreement, they are usually called SLAs. Which managers are to blame? Of course we don't blame him. We suggest an improvement. Here they are. We have the B-component organisational structure. We call this racimatrix. Ultimately, the CIO and CTO are accountable. They have the letter A and other roles, and they are the ones who should perform the tasks. So explore this Racimatrics.You notice the functions and roles in your So these are the people who should execute this practise or delegate. Of course, they are managers. And how did I know that there were SLAs? I can say how did I know? What are the outputs of these activities? We have another section with inputs and an output section. While the official name is A, the C component,information flows, and items mark it here. But they are inputs and outputs. The most important outputs are: we can check together service catalogs, the menus for users to remember. I was talking about that and SLAs (servicelevel agreements) where everything is written down. Each service will have its own service level agreement and it will be clear when the service is available. How long does it take to give access to the user? How long does it take to correct an incident and everything else that should be clear between it and the customers and users? You can see some more outputs and even inputs into these practises and activities. You can explore. Let's move further. We are moving to the D component, so the inputs and outputs of each practise are recorded and we are moving to the D component people skills and competencies. As you can see, this part is brief. It's just referring us to the incompetence framework and skill framework for the information age. This framework is useful when I managers want to see what skills and competencies their people should have to be able to execute these activities and practices, build a catalogue of services, and work with SLA and ecomponent policies and procedures. This section is also very brief. It only says that since we've covered many activities and rules, what must be done? You may want to write them down and make them official. policies and procedures. Once you set up these written agreements between you and the customer, they will only work if the company has a culture where it's normal to respect such agreements. So we are talking about these components: culture, ethics, and behavior. So this is the recommendation within this section, and the last component is G: Services, Infrastructure, and Applications. Well, you should have a tool, perhaps a document management system, where you can store the SLAs. Of course, technology to enable you to monitor whether the SLAs are fulfilled is also needed. As you can see here, and I mentioned this in the previous lecture, the last few components are very brief. Whilst the first component process is very detailed, We can check you see the G component and the F component Oops. I jumped the component People Skills components because they are very brief and as we go through the process, we go through multiple practises and many activities within them. So the processes are very detailed. This is most likely due to Corbettorigins, which was originally focused on processes, particularly heavily on processes. That's it. We have seen the complete managed service agreements, managed service agreements, and APONine objective management objectives. Some parts were very detailed, and I've skipped some details, but we've seen the key information. Fantastic. We saw the solution to our trouble in Nike. It's pretty impressively detailed, isn't it? And now imagine that you can cover lots of your troubles in it just by looking into the Governance and Management Objectives book. So isn't it worth the attention?

ExamSnap's Isaca COBIT 2019 Practice Test Questions and Exam Dumps, study guide, and video training course are complicated in premium bundle. The Exam Updated are monitored by Industry Leading IT Trainers with over 15 years of experience, Isaca COBIT 2019 Exam Dumps and Practice Test Questions cover all the Exam Objectives to make sure you pass your exam easily.