itil v3 and cobit v.4.1 project report
TRANSCRIPT
ITM 592 Project Final Report
Alignment of COBIT v4.1 metrics to Event, Incident and Problem Management processes of ITIL
v3.
Submitted by
Armağan Şahin
Supervised by
Burçin Bozkaya
9/9/2009
2008/2009 Summer
© Sabanci University
Page | 0
Contents
Introduction …………………………………………………………………………..…………2
A brief history of ITIL .……………………………………………………………..….…...…..4
ITIL v3 Core Books.……………………………………………………………………….…....6
A brief history of COBIT………………………………………………………....…………......8
A closer look-in to the COBIT v4.1……………………………………………..………………9
Basic COBIT Principle……………………………………………………………...………......12
Maturity Models of COBIT …………………………………………………………...…..……15
Performance Measurement in COBIT ……………………..…………………………...……....17
The COBIT Framework Model………………………………………... ………………...…….17
Methodology…………………………………………………………………. ……...………...21
Metric Alignment ……………………………………………………………...….……...….…24
Explanations and Conclusions …………………………………………………....….…..…….24
References……………………………………………………….………………….………..…25
Appendix………………………………………………………………………….….……...….25
A. Post Project Analysis………………………………………………………………………...25
A.1. Initial Plan………………………………………………………………………….….…...25
A.2. Updated Plan………………………………………………………………………...……. 25
A.3. Realized Tasks………………………………………………………………….…..…..…..26
Page | 1
Introduction
In today’s rapidly changing IT world, every enterprise needs certain type of
information according as its field of activity to realize the main goals of the businesses and
customers. It can be increasing revenues or cutting costs that are concrete indicators or it can
be more abstract issues which are about the quality of services that a service provider
supplies. Delivering services can be tough because the term “Service” is not a flat term
measuring when it is compared to costs or benefits which can be represented in dollars. At
this point, a set of five core books called “ITIL”(The Information Technology
Infrastructure Library) which are prepared by the Office of Government Commerce(OGC)
helps the businesses by providing codes of practice in support of Total Quality and creating a
common vocabulary in order to help organizations for maintaining IT capabilities and
managing their service management processes. When it comes to measure the quality of
services, the businesses may need to recourse to different methods.
COBIT which means “The Control OBjectives for Information and related
Technology” also serves for measuring the IT services besides its helping side of . The
Control Objectives for Information and related Technology (COBIT) is a set of best
practices (framework) for information technology (IT) management created by the
Information Systems Audit and Control Association (ISACA), and the IT Governance
Institute (ITGI) in 1996. COBIT provides managers, auditors, and IT users with a set of
generally accepted measures, indicators, processes and best practices to assist them in
maximizing the benefits derived through the use of information technology and developing
appropriate IT governance and control in a company.[1] Meanwhile, the ITIL has its own
metrics at the end of each process. But just using the metrics of ITIL is not enough. Because
the standard consulting approach used in ITIL is to determine the current "as-is" state
through assessment, then decide the "to-be" state, and then work on the gap. ITIL v3 still
fails to provide an as-is assessment model, though COBIT does.[2]
After having explained both ITIL v3 and COBIT v4.1 it is useful to go
over the goal of this project.
Page | 2
In this project it is aimed that to reveal the relationship between COBIT v4.1 metrics and
ITIL v3 processes. Thus knowing the relationship between them people who needs to
measure their service qualities can understand their current positions on delivering a service
and improve the quality of services they deliver. With specific COBIT metrics for each ITIL
v3 process it is easier to look at which side of the service and stage is hitching. For example;
It is discovered that for various ITIL v3 processes which are 4.2.5.6 Incident Escalation,
4.2.5.1 Incident Identification, 4.2.5.2 Incident Logging and 4.2.5.3 Incident Identification
there are a number of metrics are founded such as;
Number of escalations or unresolved issues due to lack of, or insufficient
responsibility for, assignments for 4.2.5.6 Incident Escalation,
Percent reduction in number of high severity and,
Incidents per user per month for 4.2.5.1 Incident Identification, 4.2.5.2 Incident
Logging and 4.2.5.3 Incident Identification.
Like it is touched in different parts of this paper, ITIL v3 does not contain those relationships
stated above one by one in each ITIL v3 process. It only has its own metrics that are
concerned with the general sense. And 28 metrics which are identified from the COBIT v4.1
are aligned to 3 ITIL v3 processes which are Event, Incident and Problem Management.
Detailed table of relationship between metrics-processes is provided in an attached excel file.
Recently, we have the last versions of both the COBIT and the ITIL . The COBIT version 4.1
and the ITIL version 3 are being used as the latest resources. Generally, both the COBIT and
the ITIL have some specific advantages. Initially, ITIL is the only consistent and
comprehensive documentation of best practice for IT Service Management and has the
following benefits; [3]
Reduces costs
Improves IT services through the use of proven best practice processes
Improves customer satisfaction through a more professional approach to service delivery
Standards and guidance
Improves productivity
Page | 3
Improves use of skills and experience
Improves delivery of third party services through the specification of ITIL .
Secondly, in the light of information in the COBIT v4.1 book, the COBIT has some
advantages for managers, stakeholders and businesses too. These benefits can be grouped
into different group of people such as;
Stakeholders within the enterprise who have an interest in generating value from IT
investments:
o Those who make investment decisions
o Those who decide about requirements
o Those who use IT services
Internal and external stakeholders who provide IT services:
o Those who manage the IT organization and processes
o Those who develop capabilities
o Those who operate the services
Internal and external stakeholders who have a control/risk responsibility:
o Those with security, privacy and/or risk responsibilities
o Those performing compliance functions
o Those requiring or providing assurance services.
In addition to ITIL, I will try to touch on the COBIT (The Control Objectives for
Information and related Technology) to explain the project and relationship between them in
detail. But first let’s start with the history of the ITIL.
A brief history of ITIL [4]
In the 1980s, the UK Government's CCTA developed a set of recommendations, in
response to the growing dependence on IT, and the recognition that without standard practices,
government agencies and private sector contracts were independently creating their own IT
management practices. The IT Infrastructure Library originated as a collection of books each
covering a specific practice within IT Service Management. ITIL was built around a process-
model based view of controlling and managing operations often credited to W. Edwards Deming
Page | 4
and his PDCA cycle. After the initial publication in 1989, the number of books quickly grew
within ITIL v1 to over 30 volumes.
In 2000/2001, to make ITIL more accessible (and affordable), ITIL v2 consolidated the
publications into 8 logical 'sets' that grouped related process guidelines to match different aspects
of IT management, applications, and services. However, the main focus was known as the
Service Management sets (Service Support and Service Delivery) which were by far the most
widely used, circulated, and understood of ITIL v2 publications.
In April 2001 the CCTA was merged into the Office of Government Commerce (OGC),
an office of the UK Treasury. In 2006, the ITIL v2 glossary was published.
In May 2007, this organization issued the version 3 of ITIL (also known as the ITIL
Refresh Project) consisting of 26 processes and functions, now grouped under only 5 volumes,
arranged around the concept of Service lifecycle structure. In 2009, the OGC officially
announced that ITIL v2 would be withdrawn and launched a major consultation as per how to
proceed. The eight ITIL version 2 books and their disciplines are:
1. Service Delivery which includes;
Service level management
Capacity management
Financial management
Availability management
IT service continuity management.
2. Service Support which includes;
Configuration management
Change management
Release management
Incident management
Problem management
Service desk .
3. ICT Infrastructure Management,
4. Security Management,
Page | 5
5. The Business Perspective,
6. Application Management,
7. Software Asset Management,
To assist with the implementation of ITIL practices a further book was published providing
guidance on implementation (mainly of Service Management):
8. Planning to Implement Service Management,
And this has more recently been supplemented with guidelines for smaller IT units, not
included in the original eight publications:
9. ITIL Small-Scale Implementation.
Overview of the ITIL v3 library[4]
Five key volumes comprise the ITIL v3, published in May 2007:
1. Service Strategy
2. Service Design
3. Service Transition
4. Service Operation
5. Continual Service Improvement.
ITIL v3 Core Books
Five different books form the ITIL v3.These are;
Service Strategy : It aims to provide guidance on how to design, develop and implement
Service Management. It is about ensuring that IT organizations are in position to achieve
operational effectiveness and to offer distinctive services to their customers. Its ultimate
goal is to make the IT organization think and act in a strategic manner.[5]
Service Design : Its objective is to design and develop IT services. Its scope includes the
design of new services, as well as changes and improvements to existing ones. [6]
Page | 6
Service Operation : It makes sure that IT services are delivered effectively and
efficiently. [7]
Service Transition : It aims to build and deploy IT services. It also makes sure that
changes to services and Service Management Processes are carried out in a coordinated
way[8].
Continual Service Improvement : The goal of Continual Service Improvement is to
align and realign IT Services to changing business needs by identifying and
implementing improvements to the IT services that support the Business Processes.
Figure 1. Red rectangles represents the chosen processes to align the COBIT v4.1 metrics.
Service Transition : It aims to build and deploy IT services. It also makes sure that
changes to services and Service Management Processes are carried out in a coordinated
way[8].
Continual Service Improvement : The goal of Continual Service Improvement is to
align and realign IT Services to changing business needs by identifying and
Page | 7
implementing improvements to the IT services that support the Business Processes[9].
Figure 2. shows the interrelationship between the ITIL service management processes.
Each process tries to find an answer the following questions;
Service Strategy –How to develop a business-driven strategy for IT service
management?
Service Design –How to design a system to support the chosen strategy?
Service Transition –How to transition newly designed system to the production
environment ?
Service Operation –How to support operations in an ongoing fashion?
Continual Service Improvement –How to continue improving processes and
operations?
In the following explanations, you will find why these COBIT control objectives are related
with the ITIL V3 processes as well as understanding the main framework of the COBIT.
A brief history of COBIT[10]
The Control Objectives for Information and related Technology (COBIT) is a set of best
practices (framework) for information technology (IT) management created by the Information
Systems Audit and Control Association (ISACA), and the IT Governance Institute (ITGI) in
1996. COBIT provides managers, auditors, and IT users with a set of generally accepted
Page | 8
measures, indicators, processes and best practices to assist them in maximizing the benefits
derived through the use of information technology and developing appropriate IT governance
and control in a company. COBIT has had four major releases:
In 1996, the first edition of COBIT was released.
In 1998, the second edition added "Management Guidelines".
In 2000, the third edition was released.
o In 2003, an on-line version became available.
In December 2005, the fourth edition was initially released.
o In May 2007, the current 4.1 revision was released.
A closer look-in to the COBIT v4.1[10]
For many enterprises, information and the technology that supports it represent their most
valuable, but often least understood, assets. Successful enterprises recognize the benefits of
information technology and use it to drive their stakeholders’ value. These enterprises also
understand and manage the associated risks, such as increasing regulatory compliance and
critical dependence of many business processes on information technology (IT). The need for
assurance about the value of IT, the management of IT-related risks and increased requirements
for control over information are now understood as key elements of enterprise governance.
Value, risk and control constitute the core of IT governance.
IT governance is the responsibility of executives and the board of directors, and consists
of the leadership, organizational structures and processes that ensure that the enterprise’s IT
sustains and extends the organization’s strategies and objectives.
To satisfy business objectives, information needs to conform to certain control criteria,
which COBIT refers to as business requirements for information. Based on the broader quality,
fiduciary and security requirements, seven distinct, certainly overlapping, information criteria are
defined as follows;
1-Effectiveness deals with information being relevant and pertinent to the business process as
well as being delivered in a timely, correct, consistent and usable manner.
Page | 9
2-Efficiency concerns the provision of information through the optimal (most productive and
economical) use of resources.
3-Confidentiality concerns the protection of sensitive information from unauthorized
disclosure.
4-Integrity relates to the accuracy and completeness of information as well as to its validity in
accordance with business values and expectations.
5- Availability relates to information being available when required by the business process now
and in the future. It also concerns the safeguarding of necessary resources and associated
capabilities.
6-Compliance deals with complying with the laws, regulations and contractual arrangements to
which the business process is subject, i.e., externally imposed business criteria as well as internal
policies.
7-Reliability relates to the provision of appropriate information for management to operate the
entity and exercise its fiduciary and governance responsibilities. Furthermore, IT governance
integrates and institutionalizes good practices to ensure that the enterprise’s IT supports the
business objectives. IT governance enables the enterprise to take full advantage of its
information, thereby maximizing benefits, capitalizing on opportunities and gaining competitive
advantage. These outcomes require a framework for control over IT that fits with and supports
the Committee of Sponsoring Organizations of the Treadway Commission’s (COSO’s) Internal
Control—Integrated Framework, the widely accepted control framework for enterprise
governance and risk management, and similar compliant frameworks.
Organizations should satisfy the quality, fiduciary and security requirements for their
information, as for all assets.
Management should also optimize the use of available IT resources, including
applications, information, infrastructure and people. To discharge these responsibilities, as well
as to achieve its objectives, management should understand the status of its enterprise
architecture for IT and decide what governance and control it should provide. Control Objectives
for Information and related Technology (COBIT®) provides good practices across a domain and
process framework and presents activities in a manageable and logical structure. COBIT’s good
practices represent the consensus of experts. They are strongly focused more on control, less on
Page | 10
execution. These practices will help optimize IT-enabled investments, ensure service delivery
and provide a measure against which to judge when things do go wrong.
COBIT is focused on what is required to achieve adequate management and control of
IT, and is positioned at a high level. COBIT has been aligned and harmonized with other, more
detailed, IT standards and good practices.
COBIT acts as an integrator of these different guidance materials, summarizing key
objectives under one umbrella framework that also links to governance and business
requirements. All of the COBIT components interrelate, providing support for the governance,
management, control and assurance needs of the different audiences, as shown in the figure 3:
Figure 3.Interrelationship between COBIT v4.1 components
COBIT is a framework and supporting tool set that allow managers to bridge the gap with
respect to control requirements, technical issues and business risks, and communicate that level
of control to stakeholders. COBIT enables the development of clear policies and good practice
for IT control throughout enterprises. COBIT is continuously kept up to date and harmonized
with other standards and guidance. Hence, COBIT has become the integrator for IT good
practices and the umbrella framework for IT governance that helps in understanding and
Page | 11
managing the risks and benefits associated with IT. The process structure of COBIT and its high-
level, business-oriented approach provide an end-to-end view of IT and the decisions to be made
about IT.
The benefits of implementing COBIT as a governance framework over IT include:
• Better alignment, based on a business focus
• A view, understandable to management, of what IT does
• Clear ownership and responsibilities, based on process orientation
• General acceptability with third parties and regulators
• Shared understanding amongst all stakeholders, based on a common language
• Fulfillment of the COSO requirements for the IT control environment.
COBIT mission is to research, develop, publicize and promote an authoritative, up-to-
date, internationally accepted IT governance control framework for adoption by enterprises and
day-to-day use by business managers, IT professionals and assurance professionals.
Basic COBIT Principle[10]
The COBIT framework is based on the following principle (Figure 4): To provide the
information that the enterprise requires to achieve its objectives, the enterprise needs to invest in
and manage and control IT resources using a structured set of processes to provide the services
that deliver the required enterprise information. Managing and controlling information are at the
heart of the COBIT framework and help ensure alignment to business requirements.
Figure 4.Basic COBIT principle.
Page | 12
Managing and controlling information are at the heart of the COBIT framework and help ensure
alignment to business requirements. COBIT defines IT activities in a generic process model
within four domains. These domains are Plan and Organize (PO), Acquire and Implement (AI),
Deliver and Support(DS), and Monitor and Evaluate (ME). The domains map to IT’s traditional
responsibility areas of plan, build, run and monitor.
To govern IT effectively, it is important to appreciate the activities and risks within IT
that need to be managed. They are usually ordered into the responsibility domains of plan, build,
run and monitor. Within the COBIT framework, these domains, as shown in figure 5, are called:
• Plan and Organize (PO)—Provides direction to solution delivery (AI) and service delivery
(DS)
• Acquire and Implement (AI)—Provides the solutions and passes them to be turned into
services
• Deliver and Support (DS)—Receives the solutions and makes them usable for end users
• Monitor and Evaluate (ME)—Monitors all processes to ensure that the direction provided is
followed.
Figure 5.The four interrelated domains of COBIT.
Page | 13
PLAN AND ORGANISE (PO)This domain covers strategy and tactics, and concerns the identification of the way IT can best
contribute to the achievement of the business objectives. This domain typically addresses the
following management questions:
• Are IT and the business strategy aligned?
• Is the enterprise achieving optimum use of its resources?
• Does everyone in the organization understand the IT objectives?
• Are IT risks understood and being managed?
• Is the quality of IT systems appropriate for business needs?
ACQUIRE AND IMPLEMENT (AI)To realize the IT strategy, IT solutions need to be identified, developed or acquired, as well as
implemented and integrated into the business process. In addition, changes in and maintenance
of existing systems are covered by this domain to make sure the solutions continue to meet
business objectives. This domain typically addresses the following management questions:
• Are new projects likely to deliver solutions that meet business needs?
• Are new projects likely to be delivered on time and within budget?
• Will the new systems work properly when implemented?
• Will changes be made without upsetting current business operations?
DELIVER AND SUPPORT (DS)This domain is concerned with the actual delivery of required services, which includes service
delivery, management of security and continuity, service support for users, and management of
data and operational facilities. It typically addresses the following management questions:
• Are IT services being delivered in line with business priorities?
• Are IT costs optimized?
• Is the workforce able to use the IT systems productively and safely?
• Are adequate confidentiality, integrity and availability in place for information security?
Page | 14
MONITOR AND EVALUATE (ME)All IT processes need to be regularly assessed over time for their quality and compliance with
control requirements. This domain addresses performance management, monitoring of internal
control, regulatory compliance and governance. It typically addresses the following management
questions:
• Is IT’s performance measured to detect problems before it is too late?
• Does management ensure that internal controls are effective and efficient?
• Can IT performance be linked back to business goals?
• Are adequate confidentiality, integrity and availability controls in place for information
security?
Maturity Models of COBIT[10]
Senior managers in corporate and public enterprises are increasingly asked to consider
how well IT is being managed. In response to this, business cases require development for
improvement and reaching the appropriate level of management and control over the information
infrastructure. While few would argue that this is not a good thing, they need to consider the
cost-benefit balance and these related questions:
• What are our industry peers doing, and how are we placed in relation to them?
• What is acceptable industry good practice, and how are we placed with regard to these
practices?
• Based upon these comparisons, can we be said to be doing enough?
• How do we identify what is required to be done to reach an adequate level of management and
control over our IT processes?
It can be difficult to supply meaningful answers to these questions. IT management is
constantly on the lookout for benchmarking and self-assessment tools in response to the need to
know what to do in an efficient manner. Starting from COBIT’s processes, the process owner
should be able to incrementally benchmark against that control objective. This responds to three
needs:
1. A relative measure of where the enterprise is
2. A manner to efficiently decide where to go
3. A tool for measuring progress against the goal.
Page | 15
Maturity modeling for management and control over IT processes is based on a method of
evaluating the organization, so it can be rated from a maturity level of non-existent (0) to
optimized (5). This approach is derived from the maturity model that the Software Engineering
Institute (SEI) defined for the maturity of software development capability.
Using the maturity models developed for each of COBIT’s 34 IT processes, management
can identify:
• The actual performance of the enterprise—Where the enterprise is today
• The current status of the industry—The comparison
• The enterprise’s target for improvement—Where the enterprise wants to be
• The required growth path between ‘as-is’ and ‘to-be’.
To make the results easily usable in management briefings, where they will be presented
as a means to support the business case for future plans, a graphical presentation method needs to
be provided(Figure 6);
Figure 6. Graphic Representation of Maturity Models
The advantage of a maturity model approach is that it is relatively easy for management to
place itself on the scale and appreciate what is involved if improved performance is needed.
The scale includes 0 because it is quite possible that no process exists at all. The 0-5 scale is
based on a simple maturity scale showing how a process evolves from a non-existent capability
to an optimized capability. At the end of the each process, the performance of that process is
evaluated by the maturity models which measures the enterprise’s actual performance is for its
IT processes. The figure 7 shows an example maturity model :
Page | 16
Figure 7.Generic Maturity Model
Performance Measurement in COBIT[10]
Goals and metrics are defined in COBIT at three levels:
• IT goals and metrics that define what the business expects from IT and how to measure it
• Process goals and metrics that define what the IT process must deliver to support IT’s
objectives and how to measure it
• Activity goals and metrics that establish what needs to happen inside the process to achieve the
required performance and how to measure it.
The COBIT Framework Model[10]
The COBIT framework, therefore, ties the businesses requirements for information and
governance to the objectives of the IT services function. The COBIT process model enables IT
activities and the resources that support them to be properly managed and controlled based on
COBIT’s control objectives, and aligned and monitored using COBIT’s goals and metrics, as
illustrated in the figure 8 :
Page | 17
Figure 8. COBIT Management, Control, Alignment and Monitoring.
To summarize, IT resources are managed by IT processes to achieve IT goals that respond to the
business requirements. This is the basic principle of the COBIT framework, as illustrated by the
COBIT cube in figure 9 :
Figure 9.The COBIT Cube
Page | 18
In more detail, the overall COBIT framework can be shown graphically, as depicted in figure 10,
with COBIT’s process model of four domains containing 34 generic processes, managing the IT
resources to deliver information to the business according to business and governance
requirements:
Figure 10. Overall COBIT Framework
Page | 19
ITIL helps the businesses by providing codes of practice in support of Total Quality and creating
a common vocabulary in order to help organizations for maintaining IT capabilities and
managing their service management processes. On the other hand, COBIT helps firms to see
whether if there are gaps in the service management thanks to the maturity models that COBIT
present. So ITIL takes the metrics for evaluating the service management from COBIT, in spite
of the fact that ITIL has its metrics but ITIL v3 still fails to provide an as-is assessment model,
though COBIT does. In the following figure explains what type of objectives should be done to
increase the efficiency and effectiveness of services and helps to show the weak side of ITIL v3
which is Metrics & Measurements;
Scheme 1.Red rectangle shows the weak side of ITIL v3.
Page | 20
Methodology
For aligning the metrics from COBIT v4.1 to Event, Incident and Problem Management
processes of ITIL v3,firstly the latest version of COBIT and the related processes of ITIL were
analyzed in detail. The relationships in each process was checked over to which part of the
process be used. These three processes are selected at the beginning of the project. In order to
understand where COBIT metrics were used, it is useful to define ITIL v3 processes that were
selected:
• Event Management : An event can be defined as any detectable or discernible
occurrence that has significance for the management of the IT Infrastructure or the
delivery of IT service and evaluation of the impact a deviation might cause to the
services. Event Management is the process that monitors all events that occur through the
IT infrastructure to allow for normal operation and also to detect and escalate exception
conditions. (ITIL Service Operation book)The Figure 12 represents the Event
Management process:[11]
Figure 12.Event Management process flow
Page | 21
• Incident Management : In ITIL v3, incident is an unplanned interruption to an IT
service or reduction in the quality of an IT service. Failure of a configuration item that
has not yet impacted service is also an incident, for example failure of one disk from a
mirror set. Incident Management Concentrates on restoring the service to users as quickly
as possible, in order to minimize business impact. The process flow for this process
shown in Figure 13; [11]
Figure 13.Incident management process flow.
Page | 22
• Problem Management : ITIL defines a ‘problem’ as the unknown cause of one or more
incidents. Problem Management involves root-cause analysis to determine and resolve
the cause of events and incidents, proactive activities to detect and prevent future
problems/incidents and a Known Error sub-process to allow quicker diagnosis and
resolution if further incidents do occur. [11]
Figure 14.Problem Management processMetric Alignment
Page | 23
After having understanding each ITIL process, we needed to metrics from the COBIT
because as I mentioned before, ITIL does not include enough metrics to understand what part of
the service is missing or being realizing ineffectively. In the light of this information the total of
9 COBIT v4.1 processes are identified including PO4. Define the IT Processes, Organization and
Relationships, PO9.Assess and Manage IT Risks, AI2. Acquire and Maintain Application
Software, AI7. Install and Accredit Solutions and Changes, DS8.Manage Service Desk and
Incidents, DS10. Manage Problems , DS12. Manage the Physical Environment, DS13. Manage
Operations, ME1. Monitor and Evaluate IT Performance that contain 28 metrics for 3 processes
of ITIL v3 which are Event Management, Incident Management and Problem Management.
Note : Alignment of the COBIT metrics to Event, Incident and Problem Management of the ITIL
v3 processes is explained in the attached excel file.
Explanations and Conclusions
As differences between the realized tasks and planned ones, software procedures that
required to do the project were needed effectively. However, it was mentioned that we were
included into this project in the summer term, I was able to do the necessary parts of this project.
For example aligning those metrics that gathered and found in the COBIT to Event, Incident and
Problem Management processes of the ITIL v3 that forms the name of the project.
After having discussions with Yasemine Özşen, the mentor of this project who is Process
Leader & Compliance Specialist & Project Manager, I was told to find the missing metrics in the
ITIL and let the COBIT metrics to align to the Event, Incident and Problem Management of the
ITILv3 processes. Although the software design could not be done properly, the individuals who
works in the IT sector and deal with the problems and service management can use this metrics
to see whether if the things are managed smoothly.
The total of 28 COBIT metrics that belong to 9 COBIT processes were aligned to the
Event, Incident and Problem Management processes of the ITIL v3.Revealed metrics can be
found in the attached excel file in detail.
References
Page | 24
[1] : http://en.wikipedia.org/wiki/COBIT
[2] : http://www.itsmwatch.com/itil/article.php/3799811
[3] : http://www.itil-officialsite.com/AboutITIL/WhatisITIL.asp
[4] : http://en.wikipedia.org/wiki/Information_Technology_Infrastructure_Library
[5] : http://wiki.en.it-processmaps.com/index.php/ITIL_V3_Service_Strategy
[6] : http://wiki.en.it-processmaps.com/index.php/ITIL_V3_Service_Design
[7] : http://wiki.en.it-processmaps.com/index.php/ITIL_V3_Service_Operation
[8] : http://wiki.en.it-processmaps.com/index.php/ITIL_V3_Service_Transition
[9]:http://en.wikipedia.org/wiki/
Information_Technology_Infrastructure_Library#5._Continual_Service_Improvement_.2
8CSI.29
[10] : COBIT v4.1 Book published by ISACA and ITGI in May 2007.
[11] : ITIL v3 Service Operation Book, published by the United Kingdom's Office of
Government Commerce (OGC) in May 2007.
Appendix
A. Post Project Analysis
A.1. Initial Plan
Main goal of the project was to obtain a software by choosing an ITIL process and
applying the COBIT metrics into the assigned process by the end of the summer semester. By
using this tool, individuals could see the specific measurement criteria in service management.
During this summer term, only parts of the project let us to investigate and compare both
COBITv4.1 metrics and ITIL v3 processes within a short period of time.
A.2. Updated Plan
After having understanding that specifying or developing a tool for this purpose is not possible
because of the reason that mentioned in A.1 Initial Plan, I focused to analyze COBIT and ITIL
and compare the differences between them. When doing this comparison, meanings of each
process in the COBIT and their relationship between each other and also the metrics revealed
Page | 25
and aligned to ITIL processes, Event-Incident-Problem, were tried to bring to light rather than
developing a tool because of the length of this project.
A.3. Realized Tasks
In order to understand which tasks were accomplished it is chosen to indicate the work
breakdown structure defined before starting this project. This WBS chart is as follows;
Level Hierarchical Breakdown
Document gathering (ITIL & COBIT)
Analyze of ITIL processes
Analyze of COBIT metrics
Chosen process and metric alignment
Page | 26