Why COBIT wins in a showdown with ITIL

I like ITIL. I use it quite a bit. But it puzzles me why ITIL is the default source of bestgood, generally accepted practice for IT processespractices. Often people talk as if it is the only source.

My default source of IT good practice is COBIT. It wins over ITIL, hands down.As a consultant, COBIT is my first-choice body of knowledge for my engagements. I go to it first to assess, to frame, to define, to justify, to audit. I turn to ITIL second, when I need more detail, or when I need the authority of the holy of holies to justify what I suggest. I presented this at the Pink Elephant 2012 conference, in a session called Showdown of the Methodologies.

No-brainer

For me it is a no-brainer to reach for COBIT first and most often:

1. Purpose. ITIL is an ITSM framework. COBIT is an IT practice (and now governance) framework. ITSM has grown to mean "all of IT management seen from a service perspective" but that service slant or bias remains. COBIT is intended to be a comprehensive description of all IT practices. It may not do that perfectly but it comes much closer than ITIL because it doesn't constrain itself to ITSM. Which leads us to...
2. Coverage. According to “Aligning CobiT® 4.1, ITIL® V3 and ISO/IEC 27002 for Business Benefit” which was issued jointly by ISACA and OGC (co-written by the ITIL Refresh Chief Editor and reviewed by the ITIL Chief Architect), ITIL covers less than half of COBIT's range and only completely covers about a quarter of the practices (8 of the 34 COBIT processes) ...and that's COBIT 4.1. I bet COBIT 5 opens the gap even further.
3. Rigour. ITIL is the Hitchhikers' Guide, COBIT is the Encyclopaedia . ITIL's narrative style (no really, compared to other frameworks it is downright chatty) may appeal, but as a foundation for my consulting activities the rigour and structure of COBIT is more dependable and useful. COBIT is systematically numbered; and every entity has a consistent structure. I actually find the formal COBIT structure much easier to use than the ITIL rambling: I find answers quicker, I get clearer concepts with less confusion, and I frame things readily.
4. Benchmark. You can assess against COBIT; it has clearly defined requirements. That was one of COBIT's early drivers for adoption: auditing IT for SOx compliance. COBIT auditors/assessors are certified (CISA). To assess against ITIL you need to go to proprietary benchmarks (including TIPA, not to be confused with my Tipu). ISO20000 compliance is not the same thing as ITIL "compliance".
5. Credibility. COBIT is written by a team, not a couple of authors per book. The same team for all the books. And then the list of all COBIT contributors and reviewers runs to pages. It is owned and published by a not-for-profit membership body set up and run by auditors, process geeks and security wonks. Its governance (and discretion) rocks. Unfortunately ISACA is American-centred but you can't have everything.

   

6. Accessibility. COBIT is low cost (see below) compared to ITIL. There is a copyright and trademark waiver for use by consultants and vendors. You can subscribe to an interactive personalised online version (only COBIT 4.1 for now).
7. Novelty. COBIT is of course not "new" any more than ITIL was when the world "discovered" it a decade ago. But COBIT has yet to be a fad, and the world is ready for a new fad as the realities of ITIL sink in. COBIT has none of the negative baggage accruing on ITIL. I think COBIT is IT's next silver bullet.
8. Governance. COBIT will be embraced because the realisation is dawning that Cloud and SaaS and BYOD are business decisions not IT decisions, and that therefore it is high time the organisation as a whole stepped up to its responsibilities for IT instead of abdicating and blaming IT. Organisations have failed their IT like a bad parent, and the road to redemption is via better enterprise-level governance of IT, and that's what COBIT 5 is all about. ITIL V3 Service Strategy actually talks about governance quite a lot but nobody has read it. COBIT has the governance high ground.

Everyone in IT should have COBIT

I would encourage everyone in IT to have a copy of COBIT 5 at hand. I use COBIT:

• to frame: a structure for framing any IT management thinking
• to assess or audit: a checklist for any form of review: process capability assessment, current state review, document audit, process audit...
• to define:
  • descriptions of practices and their deliverables
  • an input to role descriptions, especially the RACI responsibility matrices
  • management and governance mechanisms

  (fleshed out when necessary with other sources such as ITIL)

• to justify: an authorative reference for IT "best practice"