1. Identify stakeholders (e.g., management, process owners and users).
2. Engage with stakeholders and communicate the enterprise requirements and objectives for monitoring, aggregating and reporting, using common
definitions (e.g., enterprise glossary, metadata and taxonomy), baselining and benchmarking.
3. Align and continually maintain the monitoring and evaluation approach with the enterprise approach and the tools to be used for data gathering and
enterprise reporting (e.g., business intelligence applications).
4. Agree on the goals and metrics (e.g., conformance, performance, value, risk), taxonomy (classification and relationships between goals and metrics)
and data (evidence) retention.
5. Agree on a life cycle management and change control process for monitoring and reporting. Include improvement opportunities for reporting, metrics,
approach, baselining and benchmarking.
6. Request, prioritise and allocate resources for monitoring (consider appropriateness, efficiency, effectiveness and confidentiality).
7. Periodically validate the approach used and identify new or changed stakeholders, requirements and resources.
1. Define and periodically review with stakeholders the goals and metrics to identify any significant missing items and define reasonableness of targets
and tolerances.
2. Communicate proposed changes to performance and conformance targets and tolerances (relating to metrics) with key due diligence stakeholders
(e.g., legal, audit, HR, ethics, compliance, finance).
3. Publish changed targets and tolerances to users of this information.
4. Evaluate whether the goals and metrics are adequate, i.e., specific, measurable, achievable, relevant and time-bound (SMART).
1. Collect data from defined processes—automated, where possible.
2. Assess efficiency (effort in relation to insight provided) and appropriateness (usefulness and meaning) and validate integrity (accuracy and
completeness) of collected data.
3. Aggregate data to support measurement of agreed-on metrics.
4. Align aggregated data to the enterprise reporting approach and objectives.
5. Use suitable tools and systems for the processing and format of data for analysis.
1. Design process performance reports that are concise, easy to understand, and tailored to various management needs and audiences. Facilitate
effective, timely decision making (e.g., scorecards, traffic light reports) and ensure that the cause and effect between goals and metrics are
communicated in an understandable manner.
2. Compare the performance values to internal targets and benchmarks and, where possible, to external benchmarks (industry and key competitors).
3. Recommend changes to the goals and metrics, where appropriate.
4. Distribute reports to the relevant stakeholders.
5. Analyse the cause of deviations against targets, initiate remedial actions, assign responsibilities for remediation, and follow up. At appropriate times,
review all deviations and search for root causes, where necessary. Document the issues for further guidance if the problem recurs. Document results.
6. Where feasible, link achievement of performance targets to the organisational reward compensation system.
1. Review management responses, options and recommendations to address issues and major deviations.
2. Ensure that the assignment of responsibility for corrective action is maintained.
3. Track the results of actions committed.
4. Report the results to the stakeholders.
Reference: ISACA. (2012). COBIT 5 Enabling Processes. USA: ISACA.