12.2 APO Portfolio, Resources, and Relationships

Quick Answer: The middle of Align, Plan and Organize (APO) turns strategy into funded, staffed, and contracted work. APO05 Managed Portfolio prioritizes and balances programs and services against strategy, value, risk, and funding. APO06 Managed Budget and Costs runs I&T financials, allocation or chargeback, and benefits tracking. APO07 Managed Human Resources acquires, plans, evaluates, and develops internal and external people. APO08 Managed Relationships makes business–I&T relationships formal, transparent, and bilingual. APO09 Managed Service Agreements identifies, agrees, and monitors products, services, and service levels. APO10 Managed Vendors selects, contracts, and monitors vendors and the vendor ecosystem — COBIT 5 said supplier; COBIT 2019 says vendor. Do not confuse the portfolio with BAI01 Managed Programs or BAI11 Managed Projects.

These six objectives are still planning work. They sit after strategy and architecture, and they sit above build-and-run. If you let a project manager silently absorb all six because “the project is late,” you have collapsed the plan domain into delivery.

The six official objectives

APO05 Managed Portfolio

APO05 is the investment throttle. It executes strategic direction in line with the enterprise-architecture vision and the I&T roadmap from APO02 Managed Strategy and APO03 Managed Enterprise Architecture. It considers investment categories and resource and funding constraints. It evaluates, prioritizes, and balances programs and services, manages demand, and moves selected programs into the active services portfolio. It then monitors portfolio performance and proposes adjustments when program results or enterprise priorities change.

APO05 decides which work deserves scarce money and people. It does not run the program and it does not run the project.

Exam trap: portfolio versus programs versus projects

Memorize this three-layer stack. Foundation items love to swap the IDs.

A useful analogy is a city capital plan versus a transit-line program versus a single station construction project. The capital plan (portfolio) decides the transit line is this year’s bet and the stadium is not. The transit program coordinates stations, rolling stock, and organizational change. The station project pours concrete. If Northline Mutual’s digital-claims idea is one of twelve demanded initiatives, APO05 ranks it. Once selected, BAI01 runs the program. A mobile-app work package inside that program is BAI11. Answering “the project manager prioritizes the enterprise portfolio” fails the item.

APO06 Managed Budget and Costs

APO06 is I&T finance as a management practice, not as a once-a-year spreadsheet. It covers budget, cost, and benefit management in both the business and IT functions. It uses formal budgeting and a fair, equitable system of allocating costs — including chargeback where the enterprise uses it. Stakeholders help identify and control total costs and benefits against strategic and tactical plans, and management initiates corrective action when the numbers drift.

APO06 is how resource optimization becomes a ledger, not a slogan. It is not EDM04 Ensured Resource Optimization — the board still directs whether I&T resources are being optimized. APO06 is management building the budget, allocation model, and benefits tracking that make that direction real. A colorful roadmap with no multi-year cost model is an APO02 artifact that never made it through APO06.

APO07 Managed Human Resources

APO07 is the people objective. Provide a structured approach so human resources are structured, placed, and skilled correctly. Communicate roles and responsibilities, learning and growth plans, and performance expectations. Cover internal staff and external people — contractors, staff-augmentation, and other non-employees who do I&T work. Competency is not headcount. A bank that funds a security platform and hires nobody to run it has an APO07 failure, not merely a hiring inconvenience.

APO07 is the closest core-model neighbor of the people, skills and competencies component. The component is the slot on every objective card. APO07 is the management objective that acquires, plans, evaluates, and develops the humans who fill those slots.

APO08 Managed Relationships

APO08 manages the relationship between the business and I&T in a formalized and transparent way. The shared goal is successful enterprise outcomes inside budget and risk tolerance. The relationship runs on mutual trust, open terms, a common language, and willingness to take ownership of key decisions.

This is not “the CIO has lunch with the chief claims officer.” Informal goodwill helps, but APO08 wants named relationship structures: business–I&T partners, joint forums, a vocabulary that does not require a glossary in every meeting, and clear ownership when a digital product spans both sides. When claims says “cycle time” and IT says “story points” and nobody translates, APO08 is missing.

APO09 Managed Service Agreements

APO09 aligns I&T-enabled products and services and service levels with enterprise needs. The official verb chain is identification, specification, design, publishing, agreement, and monitoring of products, services, service levels, and performance indicators.

If Northline promises “claims in minutes,” APO09 is where that promise becomes an agreed service: what the product is, what “minutes” means, who agrees, and how performance will be watched. APO09 is not the service desk (that is DSS02 Managed Service Requests and Incidents) and not the vendor contract (that is APO10), though a vendor-delivered service will have both an internal service agreement and a vendor contract.

APO10 Managed Vendors

APO10 Managed Vendors manages I&T-related products and services provided by all types of vendors so they meet enterprise requirements. That includes search and selection, relationship management, contracts, and reviewing and monitoring vendor performance and the vendor ecosystem — including the upstream supply chain — for effectiveness and compliance.

Learn the name change. COBIT 5 used Managed Suppliers. COBIT 2019 uses Managed Vendors. If a stem offers “APO10 Managed Suppliers,” that is a COBIT 5 leftover, not the 2019 official title. The idea grew as well: 2019 is explicit about the vendor ecosystem, not only the prime contractor on the purchase order.

APO10 is how cloud platforms, claims engines, payment processors, and staff-augmentation firms stay inside requirements. “The vendor is responsible, so we are not” is the trap you already met when COBIT expanded from the IT function to enterprise I&T. The enterprise still manages the vendor.

Scenario: six objectives around one claims engine

Northline has selected a vendor claims engine. Watch the IDs, in order:

1. APO05 kept the engine in the portfolio and deferred a telematics program so funding and scarce architects were not split.
2. APO06 built a multi-year cost model: subscription, implementation, chargeback to the claims line, and the benefit hypothesis in reduced loss-adjustment expense.
3. APO07 hired two vendor-management analysts and reskilled three claims adjusters who will operate the new workflow — internal and external people, not “IT will absorb it.”
4. APO08 put a named claims–I&T product pair on the relationship, with a shared definition of “straight-through” so the vendor demo cannot redefine the outcome.
5. APO09 published the internal service: which claim types, what cycle-time target, what hours of support, what performance indicators.
6. APO10 ran selection, contracted data-protection and exit clauses, and mapped the engine vendor’s upstream hosting provider as part of the ecosystem.

If the project manager does all six of those jobs “because the project is late,” Northline has collapsed planning into BAI11. BAI can build the integration. It cannot replace this APO cluster.

Exam traps

• Portfolio = program = project. APO05 / BAI01 / BAI11 are three altitudes.
• APO10 Managed Suppliers. Wrong title in 2019.
• APO09 as the vendor contract. Service agreements are the product/service/level promise; vendor management is APO10.
• APO08 as hallway friendship. Formal, transparent, common language.
• APO06 as the board’s resource appetite. EDM04 directs; APO06 budgets and allocates.
• APO07 as headcount only. Skills, roles, internal and external people.

Prefer the answer that keeps the six official titles, keeps vendors not suppliers, and keeps the portfolio above programs and projects.