Hi Stuart,
Thank you for your feedback. And a good question, this is an important, yet somewhat difficult distinction.
- The business capabilities are strictly outcome oriented. They care about what you are able to achieve, not how or by whom. That's why they work well when you need to summarize all people, tools, processes and responsibilities that are involved in achieving them.
- The business processes are all about how you step by step do things. They are normative, which means that you often have to follow internal and/or regulatory requirements on how you do certain activities within these. That’s why they’re very usefull for measuring compliance.
Since what you want to achieve, your business capabilities, often are regardless of the geography you want your achievements in, you would usually not need to add a geographical context to them. Of course, some companies don’t provide all outcomes everywhere, but this can be described in you service offerings. So you can have one single, overarching list of business capabilities.
With business processes it’s often different. You may have one set of regulations in one country/region, and different or additional set in another. These are usually industry specific. That’s why you would sometimes need to have a set of business process records that answer to these regulations. An good example is the IT Change process. Though it’s a best practise standard that all companies should have in place, it’s mandatory according to many industry regulations, such as ICT and DORA for social critical banking services. The good thing about our platform is that it’s easy to set up control objectives and controls to measure compliance to these, and have them measure on records that are related to each process. By relating the business processes to service offerings (or business services) you can measure and report on compliance within a set of activities (normally tasks, but can also be statuses and other indicators) for each region your offerings are within.
The interesting thing about DORA is that it demands that you have a list of critical and important "business functions", which by some have been interpreted as a) business services, others as b) business processes and others again as c) business capabilities. This depends on what you are have decided to “encapsulate” within those terms I guess, hence what you are able to report back on. The business functions are described in such a way that in my opinion, they are an aggregation of services (in plural), organisations, processes, facilities and tools. Which is eaxctly what the business capabilities in CSDM are as well. For those who have already interpreted them as either a) or b), we allow reporting on this in the DORA Digital resilience third-party registers plugin. For those in favour of c), you can ensure you have activated to Digital Portfolio plugin and done dependency mapping to show back all related records in your Business Continuity Management workspace to really be able to act on the statuses you see on your business capabilities there. It’s an amazingly powerful tool to work with, and great fun to harvest the fruits of you mapping efforts.
I hope this clarifies it, but please let me know if it doesn’t, as I will add a part on this in the next version of the guide.
Have a great day!
Kristine
