The reality is that probably no two COBIT maturity assessments are performed in exactly the same manner. COBIT PROVIDES some tools and techniques, and the COBIT user will follow an approach based on specific enterprise needs. The assessments can be high-level, often in a workshop discussion, or detailed with careful gap analysis.

Generically, the following common principles usually apply:

• The maturity requirements should be DRIVEN by business requirements IDEALLY expressed as business and IT goals.
• The requirements depend on the scope being considered and can be very specific for a particular scope or high-level if the scope is for the enterprise as a whole.
• The maturity models help assess capability (defined in COBIT to mean how well the process is being MANAGED in comparison to the COBIT maturity models and attributes).
• The maturity attributes can be used to analyze current maturity levels in detail and are required to do a proper gap analysis.
• COBIT's control objectives provide a way to measure how well the process addresses key controls needed to minimize risk and deliver value.
• COBIT's control practices can be used to help DESIGN improved processes and to increase process maturity, together with other industry standards and best practices.
• It is recommended that that the maturity attributes be used to assess at a detailed level and to carry out a gap analysis, so that the root causes of immaturity can be identified and business decisions can be taken on where to invest to improve maturity for least cost and maximum benefit. IT Governance Implementation Guide: Using COBIT and Val IT, 2nd Edition, provides a road map that includes guidance on the above steps.

The reality is that probably no two COBIT maturity assessments are performed in exactly the same manner. COBIT provides some tools and techniques, and the COBIT user will follow an approach based on specific enterprise needs. The assessments can be high-level, often in a workshop discussion, or detailed with careful gap analysis.

Generically, the following common principles usually apply: