Journal Online

Using CobiT 4.1 to Achieve Business-IT Alignment: A Practical Approach

Juan Ignacio Rouyet is an engineer in telecommunication and a consultant at Quint Wellington Redwood. Since 2005, he has delivered strategic consultancy services in IT governance and IT service management. He speaks on outsourcing, IT governance and IT service management and has published various articles regarding these topics. Currently, he is working on his doctorate in the field of IT governance and knowledge management. Willem Joep Spauwen is a consultant at Quint Wellington Redwood. With more than 10 years of experience specializing in the fields of IT management and IT governance, he has participated as an advisor on many projects in The Netherlands, Mexico, Spain and the US. Since working for Quint, he has also been a conference speaker in Europe and the Americas. Luis Joyanes Aguilar is the head of the Department of Languages and Computing Systems and Software Engineering at Pontifical Salamanca University in Madrid, Spain. He is a regular speaker at events and panels on technology and knowledge management topics. He is also a best-selling author of technical books.

The pressure on the IT organization to cut costs is now more apparent than ever. At the same time, organizations need to deliver new IT services quickly with high reliability, performance and availability requirements. This necessity to, on the one hand, work as efficiently as possible but, on the other, be as customer-focused as possible, means that the IT strategy needs to be continuously tuned to the business strategy. This also means that IT needs to be able to quickly and transparently translate the IT strategy to IT operational processes to ensure effective business-IT alignment. This makes the question of how to achieve real business-IT alignment one of the most relevant challenges of todays IT organizations. The idea behind that kind of alignment is comprehensive. This article will present a practical approach about how IT organizations can succeed in reaching this valuable goal. According to ISACA, the ultimate goal of IT governance is to sustain and extend the strategies and objectives of the business organization. Hence, IT governance provides useful guidelines to deploy a business-IT alignment in the enterprise. The CobiT framework and IT balanced scorecard (IT BSC) are two relevant tools in the field of IT governance that can be used to realize the desired business-IT alignment. CobiT presents a complete set of IT processes to ensure that the IT organization is linked to the strategic plan of the business. Furthermore, the IT BSC represents an extended version of Robert Kaplan and David Nortons BSC1 adapted to the IT organization as an internal service provider. These tools can be used to accomplish an effective business-IT alignment approach CobiT 4.1 as a framework to link business goals to IT goals focusing on selected processes and the IT BSC as a performance management tool to translate the IT goals to an effective measurement system. However, business-IT alignment is a game of two players. The business

itself has to show a clear strategy and direction that the enterprises supporting functions can follow. Michael Treacy and Fred Wiersema2 propose three different types of value disciplines that companies can adopt to pursue market leadership. To ensure effective business-IT alignment, IT has to adapt to the dominant value discipline present in the business. The IT BALAnced ScoRecARd Kaplan and Norton introduced the concept of the balanced scorecard as a framework to translate strategy into operational terms. They developed a scorecard that consists of a balanced set of tangible objectives and measures that complements financial measures of past performance (achievement of financial objectives), with measures of the value drivers of future financial performance. These objectives and measures are derived from a top-down process driven by the mission and strategy of the organization, and view organizational performance from four perspectives that are kept in balance: Financial perspectiveDefines the financial performance expected from the strategy and serves as the ultimate target for the objectives and measures of all the other scorecard perspectives Customer perspectiveIdentifies the customer and market segments in which the organization has chosen to compete Internal business process perspective Identifies the processes that are most critical for achieving customer and shareholder objectives. These processes are not just existing operating processes, but should be identified for the complete organizational value chain. Learning and growth perspectiveDefines the organizational capabilities required to be able to achieve the objectives in the other perspectives Where the balanced scorecard of Kaplan and Norton is positioned at an enterprise level,
ISACA JOURNAL VOLUME 1, 2010

Wim Van Grembergen, Ron Saull and Stephen De Haes3 cascaded the scorecard down to IT. Recognizing that IT is an internal service provider, they changed the four perspectives of the balanced scorecard to corporate contribution, customer (user) orientation, operational excellence and future orientation. The user orientation perspective represents the user evaluation of IT. The operational excellence perspective represents the IT processes employed to develop and deliver IT services. The future orientation perspective represents the human and technology resources needed by IT to deliver its services. The business contribution perspective captures the business value of the IT investments. The dIScIpLIne of MARkeT LeAdeRS Based on empirical research, Treacy and Wiersema conclude that successful organizations always choose one dominant strategy from three possible strategies: operational excellence, product leadership and customer intimacy.4 Organizations have to decide which strategy is best suited for them and choose to excel in that specific strategy without neglecting the other strategies. Organizations need to be competent in all disciplines, but exceptionally competent in the chosen dominant strategy. The operational excellence strategy focuses on the best price with the most convenience. This strategy will lead to cost control, standardization and a predictable quality. These organizations have a very low process failure rate (rework, fixes), remove as much waste as possible from their processes and demand the same from their suppliers. McDonalds and IKEA are examples of companies that successfully apply this strategy. The second strategy is product leadership, which is dedicated to providing the best possible product for the market. This strategy puts much emphasis on research and development (R&D) and tries to gain competitive advantage based on unique characteristics of the product. Apple is a company with such a strategy, and Intel, for example, is known to increase its R&D budget in times of economic recession. Companies with a customer intimacy strategy select one or a few high-value customer niches and provide tailor-made products and services to their customers. They even can define themselves as partners instead of just being suppliers by helping their clients to be successful and share risks. Many management consultancy firms can be seen as customer-intimate companies. 2
ISACA JOURNAL VOLUME 1, 2010

BuSIneSS-IT ALIgnMenT AppRoAch The approach to accomplish business-IT alignment is the following: Propose generic business goals, taking into account Treacy and Wiersemas value discipline. Link business goals to IT goals and select the relevant processes to address that relationship, using CobiT 4.1 guidelines (in the figures accompanying this article, the IT processes are indicated by the process codes as used in CobiT). Implement an IT BSC to measure the achievement of the IT goals, choosing satisfactory metrics from the selected processes. This article shows some specific solutions of this approach that are to be considered as a starting points. The final IT goals, processes and IT BSC depend on the strategy of each individual enterprise. opeRATIonAL exceLLence An IT function supporting the operational excellence value discipline focuses on its cost-efficiency in delivering a limited number of standardized IT services. Customer satisfaction is achieved by delivering cost-competitive products and services. This cost control relies on an accurate measurement system to detect and remove any inefficiency. Figure 1 shows how the operational excellence business goals link to the IT goals. Figure 2 proposes a set of metrics to manage the selected processes. pRoducT LeAdeRShIp The product leadership enterprise depends highly on technology to lead the innovation in its market. Thereby, it has to be intensively knowledge-based, and the IT function plays an important role to protect and secure critical company knowledge. Moreover, the IT function has to prove its readiness to support the innovative and changing business and even to propose leading IT solutions proactively. Figure 3 links product leadership business goals to the IT goals, and figure 4 is the corresponding proposed IT BSC. cuSToMeR InTIMAcy The foremost explanatory principle of the customer intimacy value discipline is that the customer defines the service. Accordingly, the IT function has to deal with an extended IT service portfolio while maintaining justifiable cost levels.

figure 1Linking Business and IT goals for operational excellence

perspective Corporate contribution Customer orientation Business goals Provide a good return on investment of IT-enabled business investments. Offer competitive products and services. Achieve cost optimization of service delivery. IT goals Improve IT cost efficiency and its contribution to business profitability. Acquire and maintain integrated and standardized applications systems. Acquire and maintain integrated and standardized IT infrastructure. Ensure mutual satisfaction of third-party relationships. Ensure seamless integration of applications into business processes. Ensure proper use and performance of the applications and technology solutions. Optimize the IT infrastructure, resources and capabilities. cobiT processes PO5 ME1 PO5 AI2 AI3 AI5 DS2 PO2 AI2 AI3 AI4 DS3 DS8 DS9 ME1 PO7 AI5

Operational excellence

Lower process costs. Improve and maintain operational and staff productivity.

Future orientation

Acquire and maintain skilled people.

Acquire and maintain IT skills that respond to the IT strategy.

figure 2generic Strategic IT BSc for operational excellence

customer orientation Mission To offer hassle-free IT services at low costs objectives Customer satisfaction Competitive costs Metrics Percent reduction of the delivered IT services unit cost Percent of users satisfied with IT services availability Amount of reduction of the purchasing costs Number of user complaints due to contracted services corporate contribution Mission To ensure that IT demonstrates cost-efficient services and improve the business profitability objectives Business value of existing IT services Compliance with profitability strategy Metrics Percent of investments meeting the predefined profitability Percent of IT spend expressed in business value drivers (e.g., customer retention due to increased availability) Amount of satisfaction of management and the governance entity with the performance reporting future orientation Mission To acquire and maintain the most efficient IT-skilled staff objectives Efficient IT staff Effective IT staff Reduce IT procurement cost Metrics Percent of lost working days Percent of IT staff members who meet the competency profile Percent of IT roles with qualified backup personnel Reduced unit cost of procured goods or services

operational excellence Mission To ensure the most efficient IT service architecture objectives Process compliance Efficient IT infrastructure Optimize utilization of IT resources Metrics Percent of development efforts spent maintaining existing IT systems Number of errors causing loss of production Percent of platforms not in line with defined IT architecture standards Reduced cost to produce/maintain user documentation, operation procedures and training materials

ISACA JOURNAL VOLUME 1, 2010

figure 3Linking Business and IT goals for product Leadership

perspective Corporate contribution Business goals Provide a good return on investment of IT-enabled business investments. Manage IT-related business risk. Create agility in responding to changing business requirements. Obtain reliable and useful information for strategic decision making. Manage business change. Provide compliance with internal policies. IT goals Improve IT cost efficiency and its contribution to business profitability. Establish clarity of business impact of risks to IT objectives and resources. Create IT agility. Deliver projects on time and on budget, meeting quality standards. Optimize the use of information. Ensure proper use and performance of the applications and technology solutions. Ensure that critical and confidential information is withheld from those who do not need access to it. Ensure minimum business impact in the event of an IT service disruption or change. cobiT processes PO5 PO9 PO10 PO2 PO7 PO10 AI2 DS11 PO6 PO9 AI4 AI6 DS4 DS5 DS7 DS11 DS12 ME2 PO7 ME1

Customer orientation

Operational excellence

Future orientation

Manage product and business innovation.

Ensure that IT demonstrates continuous improvement and readiness for future change.

figure 4generic Strategic IT BSc for product Leadership

customer orientation Mission To offer cutting-edge IT products and services objectives Customer satisfaction Leading technology Metrics Percent of user satisfaction with the information model Level of stakeholders satisfaction with IT personnels expertise and skills Percent of projects exceeding stakeholders requirements Percent of user satisfaction with availability of data operational excellence Mission To ensure the proper use of the IT service architecture to deliver timely and secure IT services objectives Availability of IT services Security and safety User education Metrics Number of significant incidents caused by risks not identified Number of incidents caused by deficient user and operational documentation training Percent of unsuccessful changes to the infrastructure caused by incomplete impact assessment Number of logical or physical access violations 4
ISACA JOURNAL VOLUME 1, 2010

corporate contribution Mission To increase the enterprise value through effective delivery of IT services objectives Business value of IT projects Risk management Metrics Percent of projects delivering business change Percent of IT investment expressed in business value drivers (e.g., sales increased due to value-added technology) Percent of critical IT objectives covered by business risk assessment future orientation Mission To develop and improve the required IT skills and technology to sustain the business strategy objectives Expertise of IT staff Knowledge management Research into emerging technologies Metrics Percent of IT staff members who meet the competency profile for required roles as defined in the strategy IT personnel turnover Percent of IT staff members who complete annual IT training plan Number of improvement actions driven by monitoring activities

figure 5Linking Business and IT goals for customer Intimacy

perspective Corporate contribution Customer orientation Business goals Provide a good return on investment for IT-enabled business investments. Improve customer orientation and service. Establish service continuity and availability. IT goals Improve IT cost-efficiency and its contribution to business profitability. Ensure satisfaction of end user with service offering and service levels. Ensure mutual satisfaction of third-party relationships. Make sure that IT services are available as required. Deliver projects on time and on budget, meeting quality standards. cobiT processes PO5 DS6 PO8 PO10 AI6 DS1 DS2 DS3 DS4 DS8 DS10 DS13 PO4 AI1 AI2 AI3 AI4 AI6 AI7 PO3 PO7

Operational excellence

Improve and maintain business process functionality. Manage business change.

Create IT agility. Define how business functional and control requirements are translated into effective and efficient automated solutions. Ensure seamless integration of application into business processes

Future orientation

Acquire and maintain skilled and motivated people. Acquire and maintain IT skills that respond to the IT strategy.

figure 6generic Strategic IT BSc for customer Intimacy

customer orientation Mission To deliver IT services at the customers specific requirements objectives Competitive services Customer satisfaction Metrics Percent of stakeholders satisfied with IT quality Percent of users satisfied with the functionality delivered Percent of users satisfied that service delivery meets agreed-upon levels Number of user complaints due to contracted services operational excellence Mission To adapt the IT architecture to deliver timely and effective IT services at targeted service levels objectives Availability of IT services Functional requirements Adaptive continuous improvement Metrics Number of business processes not supported by the IT organization but should be Percent of feasibility studies delivered on time and on budget Percent of development projects on time and on budget Number of production problems per application causing visible downtime Number of disruptions or date errors caused by inaccurate specifications corporate contribution Mission To increase the enterprise value through the delivery of customeroriented IT services objectives Customer turnover Compliance with profitability strategy Metrics Percent of IT investment expressed in business value drivers (e.g., customer turnover due to value-added functionality) Unit cost per service over time future orientation Mission To acquire and maintain both technical and customer-oriented IT staff objectives Expertise of IT staff Business knowledge Updated infrastructure Metrics Percent of IT staff members who meet the competency profile for required roles as defined in the strategy Level of stakeholders satisfaction with IT personnel expertise and business skills Frequency of the technology infrastructure plan review/update

ISACA JOURNAL VOLUME 1, 2010

Customers demand specific IT service levels with particular IT application requirements. Thereby, the IT function delivers a complex set of IT services to support the business processes in a continuous changing environment. Figure 5 links the customer intimacy business goals to the IT goals, and figure 6 shows its generic IT BSC. concLuSIonS CobiT 4.1 and the IT BSC are useful tools for achieving business-IT alignment. However, one single silver bullet solution that is valid for every organization does not exist. Therefore, the examples given are not to be interpreted as such. Each organization applying these concepts should adapt them to its own organizational context. When doing this, it is important to take the business context as a starting point in translating the business strategy to IT strategy and a measurement system. The concept of value disciplines of Treacy and Wiersema is an appropriate tool for defining the business context. The proposed tables in this article are practical examples of this exercise using the value disciplines, and they show that a difference in business context has a significant influence on the definition of a measurement system. Therefore, it is important to focus a lot of attention on this exercise to ensure its effectiveness in reaching business-IT alignment.

RefeRenceS Van Grembergen, W.; R. Van Bruggen; Measuring and Improving Corporate Information Technology Through the Balanced Scorecard Technique, Proceedings of the European Conference on the Evaluation of Information Technology, The Netherlands, 1997 endnoTeS Kaplan, Robert; David Norton; The Balanced Scorecard Measures That Drive Performance, Harvard Business Review, January-February 1992, p. 71-79 2 Treacy, Michael; Fred Wiersema; The Discipline of Market Leaders, 1995 3 Van Grembergen, Wim; Ron Saull; Stephen De Haes; Linking the IT Balanced Scorecard to the Business Objectives at a Major Canadian Financial Group, in W. Van Grembergen (Ed.), Strategies for Information Technology Governance, USA, Idea Group Publishing, 2003 4 Op cit., Treacy and Wiersema
1

The ISACA Journal is published by ISACA. Membership in the association, a voluntary organization serving IT governance professionals, entitles one to receive an annual subscription to the ISACA Journal. Opinions expressed in the ISACA Journal represent the views of the authors and advertisers. They may differ from policies and official statements of ISACA and/or the IT Governance Institute and their committees, and from opinions endorsed by authors employers, or the editors of this Journal. ISACA Journal does not attest to the originality of authors content. 2010 ISACA. All rights reserved. Instructors are permitted to photocopy isolated articles for noncommercial classroom use without fee. For other copying, reprint or republication, permission must be obtained in writing from the association. Where necessary, permission is granted by the copyright owners for those registered with the Copyright Clearance Center (CCC), 27 Congress St., Salem, MA 01970, to photocopy articles owned by ISACA, for a flat fee of US $2.50 per article plus 25 per page. Send payment to the CCC stating the ISSN (1526-7407), date, volume, and first and last page number of each article. Copying for other than personal use or internal reference, or of articles or columns not owned by the association without express permission of the association or the copyright owner is expressly prohibited. www.isaca.org

ISACA JOURNAL VOLUME 1, 2010