Topic: Risk analysis assignment
Order Description
The attached document is from a selection of teaching cases produced by ISACA, the global IT risk management association. There are two cases in this document: DentDel Inc. and Your Neighborhood Grocers (apologise for the American spelling). For this assignment, you will be analysing the second case- Your Neighborhood Grocers. The other case is for you to review in your own leisure. ****

Here are the questions for the case:

Identify the key issues that are the root cause of the new CIO’s problems.
For each of the key issues identified in phase I, how would you apply specific COBIT enabling processes from APO02, APO03 and EDM01 to address these issues? Larry needs specifics and requested that you cite the control objective and explain how it would remedy the situation.
To answer question 1, you need to read the case. To answer question 2, read the specific sections of the COBIT 5 “Enabling Processes” document (attached). The document was part of the reading for last week. You can read the first part of the document to get an idea of how it is organised, and then open the specific section, e.g. APO02 is on page 57, EDM01 is on page 31, and so on. Each Enabling Process contains a list of practices, and each practice consists of a few activities, describing what is done to achieve the goals of that process.For example:

Enabling Process APO03 Manage Enterprise Architecture, consists of 5 practices: APO03.01 to APO03.05.
Within APO03.01 Develop the enterprise architecture vision, 12 activities are listed.
Your answer for Question 2 consists of explaining to Larry which particular mix of processes, practices, & activities will help sort out the mess his grocery business is in. Not all of them are relevant and required. COBIT is designed to cover every eventuality, so when it is applied in an organisation, IS auditors choose the ones which fit the problems/shortcomings of that particular context.

This is a tough assignment, and you have to be careful, methodical, and thorough. It’s a realistic example of what an IT risk analyst or auditor would do- investigate, analyse, and advise. In terms of word length, I’ll put the upper limit at 1,000 words, which is about 2 single-spaced pages or 4 double-spaced pages.

This is the Assessment 4 on the study guide I uploaded.