Study notes on Cobit: Overview and strategic IT planning

What is strategic IT planning?

Simply put, strategic IT planning is to suggest various IT solutions to support business objectives or strategies. For example, suppose that you are the CIO of a school and that the school has an objective of improving education quality. It may have defined business strategies to achieve that objective like:

• Making learning fun


• Engaging parents


• ...

As the CIO of the school, you could suggest various IT solutions to support one of those strategies. For example, for the first strategy ("Making learning fun"), you may suggest:

• Provide educational games to the teachers.


• Provide training to enable teachers to develop interactive courseware.


• Locate and provide the best student-engaging lecture videos to the teachers.


• ...

Note that each IT strategy must have a clear linkage to the business strategy so that it creates business value ("Value" is one of the three major concerns of Cobit). For example, it is assumed that educational games will make learning fun because students like playing games.

Cost and risk

After coming up with these IT strategies, you will explain them to the CEO (the principal) and business executives (the vice principals) to let them choose which ones to proceed. However, without the information regarding the cost ("Cost" is the second major concern of Cobit) and other needed resources for each IT strategy, it is just impossible to choose. So, you have to provide such information. For example, for the IT strategy of providing educational games, you may need:

• MOP1,000 (cost) for a site license for each game (software).


• Teachers (people) to attend a training session.


• A server (hardware) to host the games.


• A certain internal network bandwidth (network).


• ...

These needed resources (people, software, hardware, network) are called "Enterprise architecture for IT" in Cobit.
In addition, what if some students become addicted to the games? What if some parents don't want their kids to play games? These risks must be communicated to the CEO and business executives to help them choose which IT strategies to pursue ("Risk" is the third major concern of Cobit).

Control objective

So, you can perform strategic IT planning as described above. But how to ensure the desired output (IT strategies as selected by the CEO will have good value, low cost and low risk) will be produced? For example, there are some success factors:

• You (the CIO) knows the business objectives and strategies well.


• The CEO is willing to make clear decisions.


• You, the CEO and business executives can discuss and negotiate well.


• You can plan (estimate) the costs, risks and other needed resources well.

Each process has its own such success factors and they're key to ensure that the process is effective (producing the desired output) and performance (producing the output efficiently). Such success factors are called "control objectives" in Cobit and is a key concept in Cobit (the term "Cobit" simply stands for control objectives for IT).

Maturity level

However, even if you're doing the strategic IT planning process very well, it doesn't mean that the process is embedded in the DNA of the organization. For example, if you leave the organization and your successor doesn't do it or does it poorly, then it is not in the DNA of the organization. This is reflected in the "maturity level" of the process:

• Level 0 (No process): The organization has no process at all.


• Level 1 (Ad-hoc): Different people in the organization have different processes to do the same thing.


• Level 2 (Repeatable): Different people in the organization follow the same process, but the process is informal (not written down), so it is not formally reviewed, approved and used for training.


• Level 3 (Defined): The process is formally defined.


• Level 4 (Managed): The process is continuously improved.


• Level 5 (Optimized): The process is considered among the best in that  industry.