We are preparing for an internal audit and need to assess our process capability levels using the ISO/IEC 15504 approach integrated into COBIT 5. Does anyone have a template or a specific set of metrics that work best for reaching Level 3 (Established)? We keep getting stuck at Level 2 because our documentation is inconsistent across different departments.
3 answers
Reaching Level 3 requires that your processes are not only managed but also "Established," meaning they are defined and used throughout the organization. The key metric here is the "percentage of processes following standard enterprise-wide definitions." You need to move beyond departmental silos. Start by creating a centralized process asset library. Ensure that your metrics track "process adherence" through periodic spot checks. At this level, your performance metrics should show consistency in outcomes across different teams using the same standard process, which proves the process is truly established.
Are you finding that the resistance to moving to Level 3 is more about the lack of technical tools or is it a cultural issue where teams prefer their own localized ways of working?
Use the Process Assessment Model (PAM). It provides the necessary indicators for process performance and capability that are essential for moving from Level 2 to Level 3 effectively.
Barbara is spot on. The PAM is the gold standard for this. It helps you identify the specific gaps in "Process Definition" and "Process Deployment" attributes needed for Level 3.
In my experience, it is almost always cultural. Teams feel that standardized processes add "red tape." To counter this, your metrics should highlight the efficiency gains—like "reduction in rework time"—to prove that the standard process actually makes their lives easier. Once the teams see the data-driven benefits of standardization, the documentation compliance usually follows much faster than through mandates alone.