Since I was a child, I have been good at mathematics and my sister, who is one year older than me, has often taken advantage of this by explaining theories to me in order to do her homework. I did not mind because numbers always fascinated me.
When I first downloaded COBIT® 2019, the methodology and framework fascinated me just the same. According to COBIT 2019, certain design factors can shape organizations’ information and technology (I&T) governance systems, including strategy and goals, the risk profile, the I&T-related issues, the compliance requirements, the role of IT and the sourcing model. The design factors and focus areas can influence the priority of governance and management objectives. Some of the objectives may be important for an organization while others may be less important or even ignored. The COBIT 2019 design process results in the specific relative importance of each governance and management objective expressed as percentages—real numbers that have been calculated by industry experts.
The Balanced Scorecard (BSC) is another tool that can be used for strategic alignment and performance review. It helps organizations get an all-encompassing view of their performance. Instead of using only financial measurements, an organization can assess its performance from multiple perspectives, such as customer, internal process and learning and growth. The BSC can be applied to I&T from the following perspectives:
- Organizational—How well I&T is aligned to business strategy
- Customer—How satisfied the internal or external customers are
- Operational—How well I&T operates in supporting the business and IT processes
- Future—How well the organization is prepared for future changes
The context of these perspectives is different for each organization and depends on many factors, such as the type of organization, the role of I&T, the culture, the business strategy, the risk landscape and whether the organization operates in a highly regulated environment.
The most important objectives coming from the COBIT 2019 design process are classified under the four IT BSC perspectives, and all the objectives under a specific perspective should be formulated based on what is important to the organization.
The prioritized objectives should also be linked with relevant key performance indicators (KPIs) that represent success. The relative importance of each objective for an organization can be used as the relative weight for the corresponding KPI. For each KPI, a target should be set, and the comparison of the target with the actual KPI achievement gives the result. At this point, mathematics can be used to normalize the numbers:
- Zero means the target has been reached
- A positive number means the organization has outperformed
- A negative number represents a pain point
The numbers give a granularity to assess the I&T performance, and the aggregated summary number of all perspectives provides the overall I&T organization performance. Comparing these numbers over the years can assist in identifying positive or negative trends in the achievement of the relevant objectives.
But what about the pain points? An IT BSC can be built using a one parent to many children relationship between entities that formulates a multilayer tree structure or even a lot of trees. The entities can be designed in consecutive layers to best fit the needs of the organization—there is no magic recipe, and it depends on the specific organization.
Relevant KPIs should be mapped to each perspective at all levels. In a multilayered IT BSC, the KPIs and the set target are relevant to the objective for each level, and the trees can go all the way down to the employees and be linked to their performance. Stakeholders align their actions toward achieving the targets of the relevant KPIs. Trees full of positive and negative numbers give us the whole picture and enables the message of management to be clearly expressed in numbers across the organization to ensure that efforts are aligned to making these numbers positive.
“Mathematics, rightly viewed, possesses not only truth, but supreme beauty”
―Bertrand Russell, A History of Western Philosophy
Editor’s note: For further insights on this topic, read Ioannis Routsis’s recent Journal article, “Lost in the Woods: COBIT 2019 and the IT Balanced Scorecard,” ISACA Journal, volume 3, 2021.
Don't forget—Members can earn free CPE from ISACA Journal quizzes!