Cobit 5-Based Approach for IT Project Portfolio Management : Application to a Moroccan University

Considering the problem of the management of IT project portfolios in universities, University managers face a lot of uncertainties when prioritizing projects that make up their portfolio. The alignment with their strategy becomes a major challenge and constitutes one of the essential elements of a governance approach. To overcome this challenge, the implementation of a project prioritization approach adapted to the university’s strategy, vision and culture is essential. In this context, this paper aims to provide a multi-criteria approach based on a combination of AHP and TOPSIS methodologies for the selection and prioritization of IT projects in universities. The main feature of our approach is the use of COBIT 5, its principles and enablers as prioritization criteria. In order to validate our model, project portfolio managers of a Moroccan public university were involved to evaluate the criteria and to prioritize their projects. This research demonstrates that the combined use of Multi Criteria Decision Making (MCDM) methodologies proves to be suitable for the implementation of COBIT sub-process APO05.03. Keywords—Component; IT governance; project portfolio management; Cobit 5; AHP; TOPSIS; prioritization; university


INTRODUCTION
Information technology has become essential in supporting the growth and sustainability of all types of organizations including universities. The maximized investment in these technologies is forcing decision makers to implement effective IT governance mechanisms. This IT governance requires the definition and implementation of structures and processes to maximize the value from their IT investment, to better manage risks, to optimize resources and ultimately meet the strategy of the organization and its stakeholder's requests.
Portfolio governance, a part of IT governance, is the bridge between the corporate governance and the project that includes the decisions about managing projects, defines the responsible for every decision on the project and encompasses decision tasks and how these decisions should be made [1]. It aims to align the information system with the strategic priorities of the organization, to provide a global vision of all projects and allows not only to standardize management processes and rules, but also to be able to revise priorities if necessary. It ensures that not only high-value projects are added, funded and launched in a secure manner, but also executed according to stakeholders priorities and needs.
Several researchers have examined the effective management and success of project portfolios and their impact on the performance of organizations. Patanakul conducted a qualitative study for defining the attributes of portfolio effectiveness, he clarifies that project management literature in general discusses project portfolio management from management perspective and indicates that maximizing the value of the portfolio, balancing a portfolio, and aligning a project portfolio with a business strategy are three major goals for project portfolio management [2]. Unger et al. presented the positive impact that the abandonment of an ongoing project may have on the effectiveness and implementation of the strategy [3]. D. Jonas examined success factors and how they are related to the quality of management represented in "the quality of information, cooperation and resource allocation" [4]; Austin, C. et al. have conducted a study in University of Drexel in the United States in which they cited the lack of project management in higher education [5]. Indeed, the research carried out and the information collected from higher education institutions revealed the use of internal procedures for the management of IT projects, the use of experience feedback and available resources, without taking into consideration IT management good practices derived from international reference frameworks that could improve their image in a global market.
One of the major challenges that universities are facing is the large number of projects in their portfolio; they are led to optimize their resources and their investments. In fact, the selection and prioritization of projects cannot be done intuitively or based on inadequate evaluation criteria, but rather on the application of a well-defined portfolio management process.
Therefore, an effective project selection and prioritization approach is essential in order to properly balance the project portfolio and avoid selecting unprofitable projects that may have a negative impact on the performance of the process and the functioning of the institution. This governance approach cannot succeed without the effective use of good practices frameworks and international standards. However, it is difficult to apply a common framework to all organizations that are currently demonstrating, a great interest in the adoption of these frameworks. It is therefore necessary to establish a method that is structured and adapted to the needs, strategy and culture of these institutions.
The main objective of this study is to propose a project portfolio management approach allowing IT project managers in universities to make a decision by evaluating several options in situations where no choice is perfect. The proposed The major limitation of Cobit framework is that it does not provide indications about the implementation of the proposed practices. Thereby, this contribution is an attempt to implement the sub process "APO05-03 Evaluate and select programs to fund". This paper is organized as follows. In Section II, a theoretical background of the concepts and tools used in this study is presented. Section III describes the research methodology used and the proposed approach. A case study illustrating the implementation of the approach in universities is presented in Section IV. The results of this contribution are presented and discussed in Section V followed by a conclusion and perspectives of our research.

A. IT GOVERNANCE
IT governance is defined as the leadership and organizational structures, processes and relational mechanisms that ensure that an organization's IT sustains and extends its strategy and objectives [6]. It is a process by which the objectives of the entity that give impact on Information technology are agreed, directed, and controlled [7]. IT Governance institute defines IT governance as "the responsibility of the Board of Directors and executive management. It is an integral part of enterprise governance and consists of the leadership and organizational structures and processes that ensure that the organization's IT sustains and extends the organization's strategy and objectives" [8].
According to ISO/IEC 38500 "IT Governance is the system by which the current and future use of IT is directed and controlled. It involves evaluating and directing the use of IT to support the organization and monitoring this use to achieve plans and includes the strategy and policies for using IT within an organization" [9]. Furthermore, some recent academic studies has demonstrated that the level of IT governance maturity has a significant positive impact on IT performance as well as organization performance [10], [11].
Although the problematic of IT governance has been studied by many authors, few studies can be found in the context of universities [12]- [14].
Recently, the importance of IT governance in universities has been increasingly recognized [15]. Universities have become more and more dependent on IT. To fulfill their mission and goals, they require adequate IT infrastructure and information systems which turns IT Governance into a real challenge [16]. In order to achieve their objectives, and improve their competitiveness and their effectiveness as well, they have to establish strategic objectives and make the appropriate decisions in terms of investing on IT. Universities are then showing interest in adopting the best practices and standards for IT governance because these frameworks are considered as guidelines that provide the basic structure that is flexible to apply in a certain environment. Similarly, Educause Center for Applied Research (ECAR) claims that, despite the development of ideology and procedures in terms of IT governance for business organizations, many higher education institutions have shown huge interest in implementing these ideologies to the management of IT [17].

B. COBIT 5
Control Objectives for Information and related Technology (COBIT) version 5 is a framework developed by IT Governance Institute and published on 2012 by ISACA [18]. It assists organizations in achieving their goals related to IT governance and management by providing a framework to establish the alignment of IT with the business [19], [20].
COBIT 5 enables information and related technology to be governed and managed in a holistic manner for the entire organization, taking in the full end-to-end business and functional areas of responsibility, considering the IT-related interests of internal and external stakeholders.
COBIT 5 is generic and useful for enterprises of all sizes, whether commercial, not-for-profit or in the public sector [21]. It allows the development of policies and practices for IT control throughout organizations and includes a set of 37 governance and management processes with respective metrics categorized into four domains of management and a domain of governance. It is based on 5 principles and 7 enablers that are the building blocks of the framework. COBIT 5 is an effective tool for implementing IT governance. Its latest version consists of RACI-charts to guide which stakeholders should be responsible, accountable, consulted, and informed about some activities [22].

C. PROJECT PORTFOLIO MANAGEMENT
The recognition of the strategic importance of project management is growing rapidly. This may be due to the strong belief that alignment between project management and organizational strategy can significantly increase their chance of achieving their strategic goals [23] and is positively associated with project performance [24]. Project management www.ijacsa.thesai.org allows organizations to execute their strategic objectives in a structured manner and thus provides some element of control.
A portfolio refers to projects, programs, sub-portfolios, and operations managed as a group to achieve strategic objectives [25]. In a portfolio, projects must be quantifiable, classified and prioritized individually. According to Project Management Institute: Portfolio management refers to "The centralized management of one or more portfolios, which include identifying, prioritizing, authorizing, managing and controlling projects, program and other related work to achieve specific strategic business objectives" [26].
Blichfeldt and Eskerod define project portfolio management as the managerial activities that relate to the initial screening, selection and prioritization of project proposals, the concurrent reprioritization of projects in the portfolio, and the allocation and reallocation of resources to projects according to priority [27].
Accordingly, Project portfolio management process can be subdivided into two main phases:  Prioritizing and selecting projects for the portfolio;  Managing the projects within the portfolio.
The proposed metrics presented in the literature for calculating project priority have been criticized for not supporting the strategic alignment [28]. In this context, this paper aims to propose a multi criteria decision making approach for the selection and prioritization of IT projects, based on a combination of AHP and TOPSIS methodologies.

D. AHP
Thomas Saaty developed AHP as a decision-making method in the 1970s [29], it is a systematic decision making method which includes both qualitative and quantitative techniques. It is useful for obtaining single assessment value which is based on different indicators or criteria. It simplifies the process of decision making by subdividing a complex problem into a series of structured steps where each element in the hierarchy of criteria is supposed to be independent from others. The analytic network process is used when there is interdependence among criteria. AHP builds a hierarchy of decision items using comparisons between each pair of items expressed as a matrix. Paired comparisons produce weighting scores that measure how much importance items and criteria have with each other.
Decision maker examines two alternatives by considering one criteria and indicates a preference. The standard numeric scale used for AHP is 1-9 scale which lies between "equal importance" to "extreme importance", the value 9 indicates that one factor is extremely less important than the other, while value 1 indicates equal importance. At each level of the criteria hierarchy we obtain an n*n square matrix, where n is the number of elements of the level.
AHP allows building consensus among decision makers, each member can compare their judgments to those of the other members and it gives them better understanding of the impact of their priorities. AHP decomposes the decision into the following steps [30]: 1) Define the problem and state the goal or objective.
2) Define the criteria or factors that influence the goal. Structure these factors into levels and sublevels.
3) Use paired comparisons of each factor with respect to each other that forms a comparison matrix with calculated weights, ranked eigenvalues, and consistency measures.
4) Synthesize the ranks of alternatives until the final choice is made.

E. TOPSIS
The TOPSIS (Technique for Order of Preference by Similarity to Ideal Solution) method is a multi-criteria analysis method developed by Hwang and Yoon in 1981 [31]. In this method two artificial alternatives are hypothesized: Ideal solution (IS) that presents the solution that has the best level for all attributes considered, and negative ideal solution (NIS) for the one which has the worst attribute values.
TOPSIS method performs prioritization of alternatives based on their geometric distance from the positive-ideal and negative-ideal solution.
TOPSIS decomposes the decision into the following steps [31] : 1) Establish the decision matrix, 2) Calculate a normalized decision R with coefficients Rij obtained by vector normalization.   Where I = criterion index and j= alternative index.

6)
Measure the relative closeness of each competitive alternative to the ideal solution,

7)
Rank the preference in descending order; the optimum alternative is the one with the highest proximity index, and as such it represents the optimal decision, or preferred or optimal solution to the problem [32].

III. RESEARCH METHODOLOGY
To develop our approach and lead the project prioritization process, research at different levels has been done. In addition to the literature, the semi-directed interviews research method was used to collect information from experts managing IT project portfolios in universities. The target population was chosen because they have a holistic view about project portfolio management. The information collected were used to identify the project portfolio management process, to detect how decisions are made and to analyze the procedures used to select and prioritize IT projects.
The analysis of these data revealed the use of internal procedures that are based on academic needs and allocated resources and their feedback about past projects. Nevertheless, no entity has been defined for project portfolio management. Thus it calls for a huge need of developing a new approach for IT project portfolio management based on an internationally recognized framework is essential. In this context, this paper proposes a portfolio management approach to select and prioritize projects in a portfolio, taking into account the contribution of projects to the achievement of strategic objectives and their impact on the institution performance. This approach is based on COBIT 5 framework and in particular the sub-process APO05.03 "Evaluate and select programs to fund".
Thus, this paper proposes a set of six project selection criteria based on the five strategic axes of IT governance and the catalyst "Culture, ethics and behaviors" derived from cobit5 enablers. These criteria are intended to evaluate the quality and relevance of the projects that must be submitted to the same evaluation in order to guarantee the coherence of the portfolio. Table I describes the criteria that will serves as a basis for project evaluation. Each criterion is associated with one or more processes in the Cobit 5 model. Table II presents the  associated processes.   TABLE I. PRIORITIZATION CRITERIA

Strategic alignment
Strategic alignment is about targeting projects that are most relevant to the strategy [33] [34]. It aims to align the operation of IT with that of the organization and to ensure the value creation of IT for the organization.

Stakeholders needs
Stakeholder needs must first be identified. Then, the relationship between projects and strategy will be measured in order to select only projects that effectively meet the needs of all stakeholders.

Value delivery
This criterion consists of determining the effectiveness, material and immaterial value of each project following an individual evaluation. Only projects that generate the expected benefits will be included in the portfolio.

Resources optimization
The aim is to optimize the investment in vital IT resources (infrastructure, applications, information, and people).

Risk management
Portfolio managers must optimize risk by having a clear understanding of the institution risks and the assignment of risk management responsibilities.

Respect for the values, culture and ethics of the university
The culture, ethics and behavior of individuals and of the organization is a factor of success in governance and management activities. They must therefore be taken into consideration when selecting projects. With the aim of constructing an approach that allows IT project portfolio selection and prioritization according to COBIT 5 practices, the study followed the procedure illustrated in Fig. 2. Each of the stages will be explained in detail below. (7) (6) www.ijacsa.thesai.org

 Step 1 : Projects Identification
For the majority of authors, the strategy is the starting point for identifying projects to put in a portfolio [35]. Projects must be identified according not only to the mission, vision and strategy of the university, but also to the investment budget allocated to the projects and the implanted organization structure.

 Step 2 : Criteria Evaluation
The selection of criteria depends on many different factors according to the strategic objectives of the institution. Some criteria are more important than others, therefore, for each criterion, a weighting should be assigned. Thus, we propose the use of Saaty scale (Table III) to obtain the consensus of the project team, and then the use of pairwise comparison. This step consists of evaluating the projects in accordance with the predetermined criteria to assign them a weighting and determine their importance and priority.
A scoring technique is proposed to determine the value of projects and prioritize the most important ones. The weight of each project is measured by the percentage of its contribution to achieving the goal.

 Step 4 : Projects Prioritization
The results from the previous step are compiled and the projects are compared. The one with the highest score is considered the one that generates the most value and must be achieved first. For that aim, TOPSIS method has been proposed.

 Step 5 : Portfolio Adjustment
Once projects are selected and prioritized, a portfolio adjustment is made. This step necessitates the reorganization of the portfolio as a result of the analysis done in the previous steps and aims to provide a better aligned portfolio that supports the university's strategy. The criteria for portfolio balancing depend on the weight of each project and its contribution to achieving the objectives.

IV. IMPLEMENTATION
The proposed approach was implemented in the field of higher education and specifically in a Moroccan public university. In response to accountability requirement, university decision makers have to manage the risks associated with the allocation of limited resources.
Indeed, the objective of this study is to contribute to the optimization of these resources and to achieve the right balance of investments by means of a portfolio aligned with the strategic direction and contributing to the performance of the university. Thus, it presents the procedure followed to build the project portfolio.

 Step 1 : Projects Identification
The selection of alternatives is one of the most important decision of portfolio construction because it influences the success of all the portfolio. Five alternatives will be analyzed to build the IT project portfolio. To determine this list, we consulted key people with different responsibilities and functions in the process of portfolio management of IT projects in a Moroccan university. A list of alternatives or candidate projects has been established (Table IV).

A1 Upgrading LANs in institutions A2
Institutional messaging A3 Inter-site interconnection A4 Strengthening the security platform

A5
Upgrading the student and teaching management platform www.ijacsa.thesai.org  Step 2 : Criteria Evaluation Information system project experts have evaluated these criteria using a pairwise comparison. A weight was then calculated for each criterion. The pairwise comparison results obtained are shown in Table V.

 Step 4 : Projects Prioritization
The dataset is used as decision matrix, and then normalized decision matrix is calculated (Table VIII).  TOPSIS weighted Decision Matrix is calculated using priorities derived by AHP Method in Step 2 (Table IX).

Positive ideal
and Negative ideal solutions are defined according to the weighted decision matrix.
Then for each competitive alternative the separation distance is calculated (Table X). Finally, the relative closeness of each location to TOPSIS ideal solution is measured and projects are ranked in a descending order (Table XI).

 Step 5 : Portfolio Adjustment
After evaluating projects and approving investment programs, projects must undergo regular evaluations to adjust the portfolio and continually align with strategic factors that change over time. Hence, the portfolio is reorganized as a result of the performed analysis in the previous steps. Projects with the greatest weight will be implemented as a priority. IT project portfolio governance in universities is essential to ensure that programs and projects deliver expected benefits and make an optimal contribution to the performance of the university. Effective IT governance has been shown to have a positive impact on financial performance [36]. However, for non-profit organizations such as public universities, other www.ijacsa.thesai.org dimensions beyond the material value of projects need to be considered [37]. Their mission requires a balance between material and immaterial dimensions to achieve their educational, research and management goals.
Programs and projects are part of the university's ecosystem. They must be initiated by taking into account the needs of stakeholders. The objective of this paper is to identify how portfolio management can benefit from using Cobit 5 as an IT governance framework and how to leverage its processes, principles, and enablers in designing our approach.
Cobit 5 enablers can be applied in this practical situation and can be used to implement effective and efficient IT governance. They were used as a determining factor in the preparation of the proposed approach which is relevant and fits perfectly within the framework of project portfolio management.
Cobit 5 is an integrated framework that not only covers all of the organization's processes, but also separates them into governance and management processes, which makes it possible to distinguish between portfolio management, which is more a function of governance, and the management of program and project, which is more operational.
In fact, the process APO 05 "Manage Portfolio", member of COBIT domain "Align, Plan and Organize (APO) domain", consists of aligning investments with the organization's strategic goals, manage programs according to constraints and available resources. In addition, it aims to prioritize projects, balance the portfolio and optimize its performance by proposing any adjustments.
Although Cobit 5 covers all the areas to be piloted and proposes effective practices to detect processes to be improved, it does not provide a practical approach for the implementation of the proposed practices. Therefore, it comes back to the organization managers to analyze, according to their context, the technological and organizational choices and implement the change. The papers' contribution responds to this need by offering a practical tool to manage the portfolio of IT projects. It is based on the process APO 05 and specifically addresses the needs of sub-process APO05.03 related to project selection and prioritization.
Based on the literature on Cobit 5 and the opinion of IT project management experts in universities, a set of criteria has been identified: alignment with strategy, response to stakeholder needs, value creation for stakeholders, resource optimization, risk optimization and respect for the values, culture and ethics of the university.
The multi-criteria aspect is important when making portfolio management decisions. The proposed approach combined both AHP and TOPSIS assessment techniques to facilitate decision making. This combination made it possible to select and prioritize IT projects by the experts who participated in this study by evaluating the criteria and prioritizing each alternative. This scoring technique has helped to determine the value of projects and to focus efforts and resources on urgent and important projects.
The findings show that the proposed approach allows to measure and evaluate the benefits and risks, to select and prioritize the projects successfully. Indeed, it can eliminate projects with low values and concentrate available resources exclusively on those meeting current and immediate needs. It provides an innovative way for universities to make the best selection of projects to be executed.
It seems that the combination of Cobit practices, AHP and TOSPIS approaches can offer a better solution to align the portfolio with the strategic objectives of universities.

VI. CONCLUSION
The selection and prioritization of projects is a strategic decision for universities. This paper aims to contribute to IT governance in universities by developing a project portfolio management approach adapted to public institutions. Several alternatives were evaluated using different criteria for projects selection. The evaluation of alternatives was conducted in the case of five projects and it was based on new multi-criteria analysis using the AHP-TOPSIS method and based on COBIT 5 framework practices.
This method, based on the identified criteria has determined the order of alternatives and identified the best ranked project among these alternatives. Based on the obtained ranks, decision-makers can conclude which of the alternatives must be prioritized. This paper provides an overview of the aspects that must be taken into consideration during the process of selecting and prioritizing projects.
The implementation of such an approach will be beneficial for project managers. It will enable them to lead information technology with effective practices and a standardized management framework.
It is found that the combined use of MCDM methodologies AHP and TOPSIS proves to be suitable for the implementation of the sub-process APO05.03 "Evaluate and selects programs to fund", it can correctly guides decision makers for evaluating projects and visualizing the importance of each criterion on alternatives before reaching a final decision.
Future research will focus on the implementation of the sub-process APO05.04 "Monitor, optimize and report on investment portfolio".