Establish procedures in line with the organisational change management standards to require a post-implementation review as set out in the implementation plan.

This is a subset of 40 control objectives drawn from the Acquire and Implement CobiT domain. By choosing to implement these control objectives, the organization is able to provide a reasonable assurance that the business objectives linked to software development projects will be met.

Applications are made available in line with business requirements. This process covers the design of the applications, the proper inclusion of application controls and security requirements, and the development and configuration in line with standards. This allows organisations to properly support business operations with the correct automated applications.

Management of the process of Acquire and maintain application software that satisfies the business requirement for IT of aligning available applications with business requirements, and doing so in a timely manner and at a reasonable cost is:

0 Non-existent when
There is no process for designing and specifying applications. Typically, applications are obtained based on vendor-driven offerings,brand recognition or IT staff familiarity with specific products, with little or no consideration of actual requirements.

1 Initial/Ad Hoc when
There is an awareness that a process for acquiring and maintaining applications is required. Approaches to acquiring and maintaining application software vary from project to project. Some individual solutions to particular business requirements are likely to have been acquired independently, resulting in inefficiencies with maintenance and support.

2 Repeatable but Intuitive when
There are different, but similar, processes for acquiring and maintaining applications based on the expertise within the IT function. The success rate with applications depends greatly on the in-house skills and experience levels within IT. Maintenance is usually problematic and suffers when internal knowledge is lost from the organisation. There is little consideration of application security and availability in the design or acquisition of application software.

3 Defined when
A clear, defined and generally understood process exists for the acquisition and maintenance of application software. This process is aligned with IT and business strategy. An attempt is made to apply the documented processes consistently across different applications and projects. The methodologies are generally inflexible and difficult to apply in all cases, so steps are likely to be bypassed. Maintenance activities are planned, scheduled and co-ordinated.

4 Managed and Measurable when
There is a formal and well-understood methodology that includes a design and specification process, criteria for acquisition, a process for testing and requirements for documentation. Documented and agreed-upon approval mechanisms exist to ensure that all steps are followed and exceptions are authorised. Practices and procedures evolve and are well suited to the organisation, used by all staff and applicable to most application requirements.

5 Optimised when
Application software acquisition and maintenance practices are aligned with the defined process. The approach is componentbased, with predefined, standardised applications matched to business needs. The approach is enterprisewide. The acquisition and maintenance methodology is well advanced and enables rapid deployment, allowing for high responsiveness and flexibility in responding to changing business requirements. The application software acquisition and implementation methodology is subjected to continuous improvement and is supported by internal and external knowledge databases containing reference materials and good practices. The methodology creates documentation in a predefined structure that makes production and maintenance efficient.

Knowledge about new systems is made available. This process requires the production of documentation and manuals for users and IT, and provides training to ensure the proper use and operation of applications and infrastructure.

Maturity Model

Management of the process of Enable operation and use that satisfies the business requirement for IT of ensuring
satisfaction of end users with service offerings and service levels and seamlessly integrating applications and technology solutions into business processes is:

0 Non-existent when
There is no process in place with regard to the production of user documentation, operations manuals and training material. The only materials that exist are those supplied with purchased products.

1 Initial/Ad Hoc when
There is awareness that process documentation is needed. Documentation is occasionally produced and is inconsistently distributed to limited groups. Much of the documentation and many of the procedures are out of date. Training materials tend to be one-off schemes with variable quality. There is virtually no integration of procedures across different systems and business units. There is no input from business units in the design of training programmes.

2 Repeatable but Intuitive when
Similar approaches are used to produce procedures and documentation, but they are not based on a structured approach or framework. There is no uniform approach to the development of user and operating procedures. Training materials are produced by individuals or project teams, and quality depends on the individuals involved. Procedures and quality of user support vary from poor to very good, with very little consistency and integration across the organisation. Training programmes for the business and users are provided or facilitated, but there is no overall plan for training rollout or delivery.

3 Defined when
There is a clearly defined, accepted and understood framework for user documentation, operations manuals and training materials. Procedures are stored and maintained in a formal library and can be accessed by anyone who needs to know them. Corrections to documentation and procedures are made on a reactive basis. Procedures are available offline and can be accessed and maintained in case of disaster. A process exists that specifies procedure updates and training materials to be an explicit deliverable of a change project. Despite the existence of defined approaches, the actual content varies because there is no control to enforce compliance with standards. Users are informally involved in the process. Automated tools are increasingly used in the generation and distribution of procedures. Business and user training is planned and scheduled.

4 Managed and Measurable when
There is a defined framework for maintaining procedures and training materials that has IT management support. The approach taken for maintaining procedures and training manuals covers all systems and business units, so that processes can be viewed from a business perspective. Procedures and training materials are integrated to include interdependencies and interfaces. Controls exist to ensure adherence to standards, and procedures are developed and maintained for all processes. Business and user feedback on documentation and training is collected and assessed as part of a continuous improvement process. Documentation and training materials are usually at a predictable and good level of reliability and availability. An emerging process for using automated procedure documentation and management is implemented. Automated procedure development is increasingly integrated with application system development facilitating consistency and user access. Business and user training is responsive to the needs of the
business. IT management is developing metrics for the development and delivery of documentation, training materials and training programmes.

5 Optimised when
The process for user and operational documentation is constantly improved through the adoption of new tools or methods. The procedure materials and training materials are treated as a constantly evolving knowledge base that is maintained electronically using up-to-date knowledge management, workflow and distribution technologies, making it accessible and easy to maintain. Documentation and training material is updated to reflect organisational, operational and software changes. The development of documentation and training materials and the delivery of training programmes are fully integrated with the business and business process definitions, thus supporting organisationwide requirements, rather than only IT-oriented procedures.

Management of the process of Identify automated solutions that satisfies the business requirement for IT of translating business functional and control requirements into an effective and efficient design of automated solutions is:

0 Non-existent when
The organisation does not require the identification of functional and operational requirements for development, implementation or modification of solutions, such as system, service, infrastructure, software and data. The organisation does not maintain an awareness of available technology solutions potentially relevant to its business.

1 Initial/Ad Hoc when
There is an awareness of the need to define requirements and identify technology solutions. Individual groups meet to discuss needs informally, and requirements are sometimes documented. Solutions are identified by individuals based on limited market awareness or in response to vendor offerings. There is minimal structured research or analysis of available technology.

2 Repeatable but Intuitive when
Some intuitive approaches to identify IT solutions exist and vary across the business. Solutions are identified informally based on the internal experience and knowledge of the IT function. The success of each project depends on the expertise of a few key individuals. The quality of documentation and decision making varies considerably. Unstructured approaches are used to define requirements and identify technology solutions.

3 Defined when
Clear and structured approaches in determining IT solutions exist. The approach to the determination of IT solutions requires the consideration of alternatives evaluated against business or user requirements, technological opportunities, economic feasibility, risk assessments, and other factors. The process for determining IT solutions is applied for some projects based on factors such as the decisions made by the individual staff members involved, the amount of management time committed, and the size and priority of the original business requirement. Structured approaches are used to define requirements and identify IT solutions.

4 Managed and Measurable when
An established methodology for identification and assessment of IT solutions exists and is used for most projects. Project documentation is of good quality, and each stage is properly approved. Requirements are well articulated and in accordance with predefined structures. Solution alternatives are considered, including the analysis of costs and benefits. The methodology is clear,defined, generally understood and measurable. There is a clearly defined interface between IT management and business in the identification and assessment of IT solutions.

5 Optimised when
The methodology for identification and assessment of IT solutions is subjected to continuous improvement. The acquisition and implementation methodology has the flexibility for large- and small-scale projects. The methodology is supported by internal and external knowledge databases containing reference materials on technology solutions. The methodology itself produces documentation in a predefined structure that makes production and maintenance efficient. New opportunities are often identified to utilise technology to gain competitive advantage, influence business process re-engineering and improve overall efficiency. Management detects and acts if IT solutions are approved without consideration of alternative technologies or business functional requirements.

New systems need to be made operational once development is complete. This requires proper testing in a dedicated environment with relevant test data, definition of rollout and migration instructions, release planning and actual promotion to production, and a post-implementation review. This assures that operational systems are in line with the agreed-upon expectations and outcomes.

Maturity Model

Management of the process of Install and accredit solutions and changes that satisfies the business requirement for IT of implementing new or changed systems that work without major problems after installation is:

0 Non-existent when
There is a complete lack of formal installation or accreditation processes, and neither senior management nor IT staff members recognise the need to verify that solutions are fit for the intended purpose.

1 Initial/Ad Hoc when
There is an awareness of the need to verify and confirm that implemented solutions serve the intended purpose. Testing is performed for some projects, but the initiative for testing is left to the individual project teams, and the approaches taken vary.Formal accreditation and sign-off are rare or non-existent.

2 Repeatable but Intuitive when
There is some consistency amongst the testing and accreditation approaches, but typically they are not based on any methodology.The individual development teams normally decide the testing approach, and there is usually an absence of integration testing. Thereis an informal approval process.

3 Defined when
A formal methodology relating to installation, migration, conversion and acceptance is in place. IT installation and accreditation processes are integrated into the system life cycle and automated to some extent. Training, testing and transition to production status and accreditation are likely to vary from the defined process, based on individual decisions. The quality of systems entering production is inconsistent, with new systems often generating a significant level of post-implementation problems.

4 Managed and Measurable when
The procedures are formalised and developed to be well organised and practical with defined test environments and accreditation procedures. In practice, all major changes to systems follow this formalised approach. Evaluation of meeting user requirements is standardised and measurable, producing metrics that can be effectively reviewed and analysed by management. The quality of systems entering production is satisfactory to management even with reasonable levels of post-implementation problems. Automation of the process is ad hoc and project-dependent. Management may be satisfied with the current level of efficiency despite the lack of post-implementaiton evaluation. The test system adequately reflects the live environment. Stress testing for new systems and regression testing for existing systems are applied for major projects.

5 Optimised when
The installation and accreditation processes have been refined to a level of good practice, based on the results of continuous improvement and refinement. IT installation and accreditation processes are fully integrated into the system life cycle and automated when appropriate, facilitating the most efficient training, testing and transition to production status of new systems.Well-developed test environments, problem registers and fault resolution processes ensure efficient and effective transition to the production environment. Accreditation usually takes place with no rework, and post-implementation problems are normally limited to minor corrections. Post-implementation reviews are standardised, with lessons learned channelled back into the process to ensure
continuous quality improvement. Stress testing for new systems and regression testing for modified systems are consistently applied.

All changes, including emergency maintenance and patches, relating to infrastructure and applications within the production environment are formally managed in a controlled manner. Changes (including those to procedures, processes, system and service parameters) are logged, assessed and authorised prior to implementation and reviewed against planned outcomes following implementation. This assures mitigation of the risks of negatively impacting the stability or integrity of the production environment.

Maturity Model

Management of the process of Manage changes that satisfies the business requirement for IT of responding to business requirements in alignment with the business strategy, whilst reducing solution and service delivery defects and rework is:

0 Non-existent when
There is no defined change management process, and changes can be made with virtually no control. There is no awareness that change can be disruptive for IT and business operations, and no awareness of the benefits of good change management.

1 Initial/Ad Hoc when
It is recognised that changes should be managed and controlled. Practices vary, and it is likely that unauthorised changes take place.There is poor or non-existent documentation of change, and configuration documentation is incomplete and unreliable. Errors are likely to occur together with interruptions to the production environment caused by poor change management.

2 Repeatable but Intuitive when
There is an informal change management process in place and most changes follow this approach; however, it is unstructured, rudimentary and prone to error. Configuration documentation accuracy is inconsistent, and only limited planning and impact assessment take place prior to a change.

3 Defined when
There is a defined formal change management process in place, including categorisation, prioritisation, emergency procedures, change authorisation and release management, and compliance is emerging. Workarounds take place, and processes are often bypassed. Errors may occur and unauthorised changes occasionally occur. The analysis of the impact of IT changes on business operations is becoming formalised, to support planned rollouts of new applications and technologies.

4 Managed and Measurable when
The change management process is well developed and consistently followed for all changes, and management is confident that there are minimal exceptions. The process is efficient and effective, but relies on considerable manual procedures and controls to ensure that quality is achieved. All changes are subject to thorough planning and impact assessment to minimise the likelihood of post-production problems. An approval process for changes is in place. Change management documentation is current and correct,with changes formally tracked. Configuration documentation is generally accurate. IT change management planning and implementation are becoming more integrated with changes in the business processes, to ensure that training, organisational changes and business continuity issues are addressed. There is increased co-ordination between IT change management and business process
redesign. There is a consistent process for monitoring the quality and performance of the change management process.

5 Optimised when
The change management process is regularly reviewed and updated to stay in line with good practices. The review process reflects the outcome of monitoring. Configuration information is computer-based and provides version control. Tracking of changes is sophisticated and includes tools to detect unauthorised and unlicensed software. IT change management is integrated with business change management to ensure that IT is an enabler in increasing productivity and creating new business opportunities for the organisation.

Set up formal change management procedures to handle in a standardised manner all requests (including maintenance and patches) for changes to applications, procedures, processes, system and service parameters, and the underlying platforms.