The Process Advanced Review (PAR) is the real work horse of our Technology Improvement Program. Designed to dig in, discover the details and plot an optimal path to process improvement, this is where the rubber meets the road. The PAR is based on the full COBIT 4.1 framework, but unlike the CMM based assessments, the PAR provides detailed analysis of all 34 IT processes by examining all 210 COBIT 4.1 objectives.

While it is possible to execute a detailed technology audit that investigates the complete set of COBIT objectives, the PAR is better utilized as a targeted device. This level of detailed assessment and analysis is most effective when aimed toward improvement of specific processes and controls that have been identified for improvement through the CMM baseline and gap analysis. The complete PAR system includes over one thousand individual attributes that form the body of the assessment.

The PAR is administered onsite by K12TW staff. Onsite time is composed of a mixture of inquiry, observation and confirmation. Each COBIT process targeted for the PAR is examined in detail, with most processes requiring collection of supporting detail and documentation. Organizational practice is explored through both interviews and documentation review, the entire process being scripted and following a rigorous system of analysis. The goal of the PAR is to fully discover all pertinent aspects of each targeted process and to subsequently develop a detailed process improvement plan.

In order to achieve this worthy goal, K12TW employs a rigorous process of examination and evaluation that concentrates on all aspects of each objective associated with the targeted processes. Using the first process of the first COBIT domain, "PO1 - Define a Strategic IT Plan," as an example, you'll see that it is comprised of 6 different but interrelated objectives:

PO1.1 - IT Value Management
PO1.2 - Business-IT Alignment
PO1.3 - Assessment of Current Capability and Performance
PO1.4 - IT Strategic Plan
PO1.5 - IT Tactical Plans
PO1.6 - IT Portfolio Management

If the CMM gap analysis had identified PO1 as a targeted process, our PAR would be applied against these 6 objectives. The process would then start with conveyance of the value and risk associated with establishment of each control. This step in the review is extremely important, as it is the vehicle used to adequately communicate and define the relevance of the control objectives to the organization.

Using PO1.3 as an example, the value and risk drivers would include:

Once an understanding of the control objectives and their associated value and risk is established, the inspection and review can commence. This phase of the PAR consists of extensive interviews, observations, polling and analysis, with each objective having a series of associated attributes to be tested. Again looking at PO1.3 as an example, the generic form of the evaluation criteria is as follows:

• Confirm that appropriate criteria, standards and performance indicators have been established and used to assess and report performance to management and key stakeholders. An action plan for variations and a deviation process should exist
• Review the performance indicators established for key systems and processes (e.g. strengths and weaknesses, functionality, degree of business automation, stability, complexity, development requirements, technology alignment and direction, support and maintenance requirements, costs, external parties’ input)
• Confirm that reviews exist with regard to the achievement of agreed-upon targets defined within the previous tactical IT plan
• Confirm that a comparison against well-understood and reliable industry, technology or other relevant benchmarks is performed to help assess existing systems and capabilities

Our PAR process addresses each of these criterion in a systematic manner, gaining onsite information through interview and observation, and most importantly, collecting a body of supporting materials. Once the onsite component is completed, these materials are then analyzed offsite in great detail. A sample of our data collection instrument for PO1 is available at the link below:

Process Advanced Review - PO1: Define a Strategic IT Plan, v1.1a

The PAR is at the top level of our Technology Improvement Program (TIP). By taking an in-depth look at present practices and comparing them to established and accepted best practice, the PAR is directed toward the establishment of effective controls. The output of the PAR is based on detailed analysis that results in a comprehensive process improvement plan that includes specific direction covering where resources need to be focused, what documentation is needed and what content should be included, the metrics, communication protocols, practices -- essentially a package that needs only the commitment of resources to implement.