Topics in this domain
- IT Governance vs. IT Management
- Board and Senior Management Roles
- IT Steering Committee
- IT Strategy and Business Alignment
- Balanced Scorecard
- COBIT
- ITIL
- ISO 27001/27002
- COSO: ERM and Internal Control
- Policies, Standards, Procedures, Guidelines
- IT Organizational Structure and Key Roles
- Segregation of Duties in IT
- Enterprise Architecture (Zachman, TOGAF)
- Risk Management Process
- Qualitative vs. Quantitative Risk Assessment
- Risk Responses: Mitigate, Transfer, Avoid, Accept
- Risk Appetite and Residual Risk
- Maturity Models (CMMI)
- KPIs and KGIs
- Outsourcing: Benefits and Risks
- Vendor Selection, Contracts, SLAs, Right to Audit
- Cloud and Offshore Governance
- Portfolio and Resource Management
- HR: Hiring, Training, Termination
- Legal and Regulatory Compliance
- Quality Management
Maturity Models (CMMI)
How grown-up is this process?
Two kitchens can both serve good food. In one, it depends on the head chef’s mood that day. In the other, there are standard recipes, everyone follows them, results are measured, and the recipes keep improving. The second kitchen is more mature: its quality doesn’t depend on luck or heroes.
A maturity model describes stages of process discipline, from chaotic to continuously improving. It’s used to measure where a process is today, set a target, and plan how to get there. CMMI (Capability Maturity Model Integration) is the best known, originally designed for software development.
The five levels
| Level | Name | What it looks like |
|---|---|---|
| 1 | Initial | Unpredictable and reactive. Success depends on individual heroics. |
| 2 | Managed | Planned, tracked and controlled at the project level. Past successes can be repeated. |
| 3 | Defined | Standard processes across the whole organisation, tailored for each project. |
| 4 | Quantitatively managed | Processes measured and controlled using data and statistics. |
| 5 | Optimising | Continuous improvement driven by measurement and new ideas. |
The jump the exam tests most is level 2 to level 3: good practice that exists in some projects becomes a standard across the organisation.
Capability vs maturity
- Capability applies to one process: how well is change management done?
- Maturity applies to a group of processes, or the organisation as a whole.
COBIT 2019 uses a CMMI-based capability scale from 0 to 5, where 0 means incomplete.
Setting targets
The right level depends on business need and risk. A small company doesn’t need level 5 change management. A critical regulated process might need level 3 or 4. The auditor compares the current level with the target the organisation set, not with the maximum.
Example. An assessment rates incident management at level 2: every team handles incidents well, but in different ways with different tools. The target is level 3. The gap: an organisation-wide incident process, common categories and priorities, and one tool.
The auditor’s view
Maturity assessments help prioritise audit work and track improvement. But maturity describes process discipline. It doesn’t prove a particular control worked, so it never replaces control testing.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Level where processes are standardised organisation-wide | Level 3, Defined |
| Level focused on continuous improvement | Level 5, Optimising |
| Level using quantitative measurement | Level 4, Quantitatively managed |
| Main use of a maturity model | Identify the gap between current and target maturity |
| The right target level | Based on business need and risk, not automatically the highest |
In short
- Maturity models describe how well-defined, managed and improved processes are, on a staged scale.
- CMMI levels: 1 Initial, 2 Managed, 3 Defined, 4 Quantitatively managed, 5 Optimising.
- Level 2 is project-level discipline; level 3 is one standard process across the organisation; level 4 uses measurement; level 5 focuses on continuous improvement.
- COBIT 2019 rates process capability 0 to 5 on a CMMI-based scale.
- Organisations should set a target level based on business need; not every process needs level 5.
- A maturity assessment shows the gap between current and target, which guides improvement.
Exam traps
- The difference between levels 2 and 3 is whether processes are standardised across the whole organisation.
- Level 4 is about measurement; level 5 is about continuous improvement.
- Higher maturity isn't automatically the right recommendation; it depends on need and cost.
- Maturity doesn't prove a specific control works; it describes process discipline.
Slides
Click the slide and use the arrow keys. F toggles full screen.
The five CMMI levels