Booyaaa!! COBIT User Guide for Service Managers now available

read the books

Mitch

never mind what anyone says, instead of repeating received wisdom I suggest you sign up for ISACA and read the books.

The Control Practices detail for each of the 34 COBIT processes, for each Control Objective within that process: what are the goals, objectives, value drivers, risik drivers, and practices required to achieve it.

let's take an example that everyone here can relate to:
DS8 Manage Service Desk and Incidents
DS8.1 Service Desk

Establish a service desk function, which is the user interface with IT, to register, communicate, dispatch and analyse all calls, reported incidents, service requests and information demands. There should be monitoring and escalation procedures based on agreed-upon service levels relative to the appropriate SLA that allow classification and prioritisation of any reported issue as an incident, service request or information request. Measure end users’ satisfaction with the quality of the service desk and IT services.

Control Practices
1. Establish a service desk as a single, initial point of contact for the reporting, monitoring, escalation and resolution of customer requests and incidents. Develop business
requirements for the service desk, based on service definitions and SLAs, including hours of operation and expected response time to a call. Ensure that service desk
requirements include identifying staffing, tools and integration with other processes, such as change management and problem management.
2. Ensure that there are clear instructions for service desk staff when a request cannot be immediately resolved by service desk personnel. Establish time thresholds to
determine when escalation should occur based on the categorisation/prioritisation of the request or incident.
3. Implement the necessary support software and tools (e.g., incident management, knowledge management, incident escalation systems, automated call monitoring)
required for operation of the service desk and configured in accordance with SLA requirements, to facilitate automated prioritisation of incidents and rapid resolution.
4. Advise customers of the existence of the service desk and the standards of service they can expect. Obtain user feedback on a regular basis to ensure customer
satisfaction and confirm the effectiveness of the service desk operation.
5. Using the service desk software, create service desk performance reports to enable performance monitoring and continuous improvement of the service desk.

Can't say fairer than that.

The Assurance Guide does, yes, have a few pages on auditing. Then once again for each objective of each of the processes, it details each of the tests of that objective that an auditor would make, which equally serve as a checklist that you are covering off that objective. Same example:

Enquire whether and confirm that an IT service desk exists.
• Enquire whether and confirm that analysis has been performed to determine the service desk model, staffing, tools and integration with other processes.
• Confirm that the hours of operation and expected response time to a call meet business requirements.
• Enquire whether and confirm that instructions exist for the handling of a query that cannot be immediately resolved by service desk staff. Queries should have priority
levels that determine the desired resolution time and escalation procedures.
• Ask relevant personnel about whether tools for the service desk are implemented in accordance with service definitions and SLA requirements.
• Enquire about the existence of standards of service and communication of the standards with customers.

And I haven't quoted the value and risk drivers, which are the value statement for each objective. It is concise, bullet pointed. it lacks detail of the implementation but it has the high level of the implementation alright. It also lacks role descriptions. So the rank beginner needs more. But the rank beginner shouldn't be going it alone anyway - they should be hiring in expertise.