BAI02
(Manage Requirements Definition )

Process Description

Identify solutions and analyze requirements before acquisition or creation to ensure that they are in line with enterprise strategic requirements covering business processes, applications, information/data, infrastructure and services. Co-ordinate with affected stakeholders the review of feasible options including relative costs and benefits, risk analysis, and approval of requirements and proposed solutions.

Process Purpose Statement

Create feasible optimal solutions that meet enterprise needs while minimizing risk.

IT RELATED GOALS

01 Alignment of IT and business strategy

Percent of enterprise strategic goals and requirements supported by IT strategic goals
Level of stakeholder satisfaction with scope of the planned portfolio of programmes and services
Percent of IT value drivers mapped to business value drivers

07 Delivery of IT services in line with business requirements

Number of business disruptions due to IT service incidents
Percent of business stakeholders satisfied that IT service delivery meets agreed-on service levels
Percent of users satisfied with the quality of IT service delivery

12 Enablement and support of business processes by integrating applications and technology into business processes

Number of business processing incidents caused by technology integration errors
Number of business process changes that need to be delayed or reworked because of technology integration issues
Number of IT-enabled business programmes delayed or incurring additional cost due to technology integration issues
Number of applications or critical infrastructures operating in silos and not integrated

PROCESS GOALS

1. Business functional and technical requirements reflect enterprise needs and expectations.

Percent of requirements reworked due to misalignment with enterprise needs and expectations
Level of stakeholder satisfaction with requirements

2. The proposed solution satisfies business functional, technical and compliance requirements.

Percent of requirements satisfied by proposed solution

3. Risk associated with the requirements has been addressed in the proposed solution.

Number of incidents not identified as risk
Percent of risk unsuccessfully mitigated

4. Requirements and proposed solutions meet business case objectives (value expected and likely costs).

Percent of business case objectives met by proposed solution
Percent of stakeholders not approving solution in relation to business case

RACI CHART

BAI02.01 Define and maintain business functional and technical requirements.

Based on the business case, identify, prioritize, specify and agree on business information, functional, technical and control requirements covering the scope/understanding of all initiatives required to achieve the expected outcomes of the proposed IT-enabled business solution.

Define and implement a requirements definition and maintenance procedure and a requirements repository that are appropriate for the size, complexity, objectives and risk of the initiative that the enterprise is considering undertaking.
Express business requirements in terms of how the gap between current and desired business capabilities needs to be addressed and how a role will interact with and use the solution.
Throughout the project, elicit, analyze and confirm that all stakeholder requirements, including relevant acceptance criteria, are considered, captured, prioritized and recorded in a way that is understandable to the stakeholders, business sponsors and technical implementation personnel, recognizing that the requirements may change and will become more detailed as they are implemented.
Specify and prioritize the information, functional and technical requirements based on the confirmed stakeholder requirements. Include information control requirements in the business processes, automated processes and IT environments to address information risk and to comply with laws, regulations and commercial contracts.
Validate all requirements through approaches such as peer review, model validation or operational prototyping.
Confirm acceptance of key aspects of the requirements, including enterprise rules, information controls, business continuity, legal and regulatory compliance, auditability, ergonomics, operability and usability, safety, and supporting documentation.
Track and control scope, requirements and changes through the life cycle of the solution throughout the project as understanding of the solution evolves.
Consider requirements relating to enterprise policies and standards, enterprise architecture, strategic and tactical IT plans, in-house and outsourced business and IT processes, security requirements, regulatory requirements, people competencies, organizational structure, business case, and enabling technology.

BAI02.02 Perform a feasibility study and formulate alternative solutions.

Perform a feasibility study of potential alternative solutions, assess their viability and select the preferred option. If appropriate, implement the selected option as a pilot to determine possible improvements.

Define and execute a feasibility study, pilot or basic working solution that clearly and concisely describes the alternative solutions that will satisfy the business and functional requirements. Include an evaluation of their technological and economic feasibility.
Identify required actions for solution acquisition or development based on the enterprise architecture, and take into account scope and/or time and/or budget limitations.
Review the alternative solutions with all stakeholders and select the most appropriate one based on feasibility criteria, including risk and cost.
Translate the preferred course of action into a high-level acquisition/development plan identifying resources to be used and stages requiring a go/no-go decision.

BAI02.03 Manage requirements risk.

Identify, document, prioritize and mitigate functional, technical and information processing-related risk associated with the enterprise requirements and proposed solution.

Involve the stakeholders to create a list of potential quality, functional, and technical requirements and risk related to information processing (due to, e.g., lack of user involvement, unrealistic expectations, developers adding unnecessary functionality).
Analyze and prioritize the requirements risk according to probability and impact. If applicable, determine budget and schedule impacts.
Identify ways to control, avoid or mitigate the requirements risk in order of priority

BAI02.04 Obtain approval of requirements and solutions.

Co-ordinate feedback from affected stakeholders and, at predetermined key stages, obtain business sponsor or product owner approval and sign-off on functional and technical requirements, feasibility studies, risk analyses and recommended solutions.

Ensure that the business sponsor or product owner makes the final decision with respect to the choice of solution, acquisition approach and high-level design, according to the business case. Co-ordinate feedback from affected stakeholders and obtain sign-off from appropriate business and technical authorities (e.g., business process owner, enterprise architect, operations manager, security) for the proposed approach.
Obtain quality reviews throughout, and at the end of, each key project stage, iteration or release to assess the results against the original acceptance criteria. Have business sponsors and other stakeholders sign off on each successful quality review.

References :

ISACA. (2012). COBIT 5 Enabling Processes. USA: ISACA.

Page updated

Google Sites

Report abuse

BAI02(Manage Requirements Definition )