CMMI, COBIT 2019, AI Governance, or BPR/VSM — Where Do You Actually Start?

Sooner or later, almost every client asks us some version of the same question: "Okay, but which one do we actually do first?" They've usually read enough to know CMMI, COBIT 2019, AI governance, and business process work are all things they probably need eventually. What they don't have is a good way to decide where the budget goes this year. So here's the honest answer — the one we actually give people over coffee, not the one in a proposal. If the real problem is that delivery is a coin flip — one team ships clean and on time, another team doing basically the same work is always late and always buggy — that's a maturity problem, not a tooling problem, and CMMI is where you start. A CMMI-DEV appraisal gives you an outside, benchmarked view of where you actually stand, and more usefully, a real path forward instead of a vague sense that "we should get better at this." If the problem sits above delivery — IT spending nobody can tie back to the business strategy, risk owners who turn out not to exist when you go looking for them, audit findings that repeat every year like clockwork — that's governance, and it's a COBIT 2019 problem. What we've learned running these assessments is that the value isn't really the framework itself, it's forcing an honest conversation about your actual risk profile and who's really accountable for what. Skip that conversation and you get a binder nobody reads. AI governance is the newer one, and it's also the one where "we'll get to it later" is the most expensive answer. If AI has already moved from a pilot into something a customer or a regulator might ask questions about, and you can't yet explain how a model was validated or how it's being monitored, that's not a someday problem. Bolting governance onto a system that's already live is a much bigger job than designing it in from day one. And then there's business process reengineering and value stream mapping, which we'd honestly recommend doing first more often than clients ask for it first. There's not much point maturing or governing a process that's fundamentally broken — you're just making the broken thing more official. BPR redesigns how the work should flow; VSM shows you, in plain sight, where time and value are actually disappearing along the way. Do that before you spend real money maturing or governing what's underneath it. In practice almost nobody stays at just one of these for long. A COBIT review turns up a process that needs BPR before the new controls will hold. A CMMI appraisal turns up a hand-off that a week of value stream mapping would have caught immediately. That's really the argument for thinking about all four together, even if this year's budget only covers one — each one you do makes the next a little cheaper and a little more obvious. If you're stuck on this decision right now, talk to us — a short, no-strings conversation is usually enough to work out which of the four, or which order, actually fits where you are today.