Topics in this domain
- IT Governance vs. IT Management
- Board and Senior Management Roles
- IT Steering Committee
- IT Strategy and Business Alignment
- Balanced Scorecard
- COBIT
- ITIL
- ISO 27001/27002
- COSO: ERM and Internal Control
- Policies, Standards, Procedures, Guidelines
- IT Organizational Structure and Key Roles
- Segregation of Duties in IT
- Enterprise Architecture (Zachman, TOGAF)
- Risk Management Process
- Qualitative vs. Quantitative Risk Assessment
- Risk Responses: Mitigate, Transfer, Avoid, Accept
- Risk Appetite and Residual Risk
- Maturity Models (CMMI)
- KPIs and KGIs
- Outsourcing: Benefits and Risks
- Vendor Selection, Contracts, SLAs, Right to Audit
- Cloud and Offshore Governance
- Portfolio and Resource Management
- HR: Hiring, Training, Termination
- Legal and Regulatory Compliance
- Quality Management
COBIT
What COBIT is
COBIT is ISACA’s framework for the governance and management of enterprise information and technology. Think of it as a very complete map of everything an organisation should have in place to run IT well. It maps to other standards (ITIL, ISO 27001, TOGAF, NIST), so organisations often use it as the umbrella that ties them together.
For auditors, COBIT is a ready-made source of criteria: a description of what good looks like.
Five domains
COBIT 2019 has 40 objectives grouped into five domains. One domain is governance; four are management.
| Domain | Type | What lives there |
|---|---|---|
| EDM: Evaluate, Direct and Monitor | Governance | Board-level: the governance framework, benefits delivery, risk optimisation, resource optimisation, stakeholder engagement |
| APO: Align, Plan and Organise | Management | Strategy, architecture, innovation, portfolio, budget, people, suppliers, service agreements, quality, risk, security, data |
| BAI: Build, Acquire and Implement | Management | Programs and projects, requirements, solutions, capacity, organisational change, IT change, knowledge, assets, configuration |
| DSS: Deliver, Service and Support | Management | Operations, service requests and incidents, problems, continuity, security services, business process controls |
| MEA: Monitor, Evaluate and Assess | Management | Performance monitoring, internal control system, compliance with external requirements, assurance |
You don’t need to memorise all 40. Know which domain covers what: change management is in BAI; incidents and continuity are in DSS; monitoring the internal control system is in MEA.
More than processes
COBIT says a governance system is built from components that must work together:
The exam point: governance isn’t only about processes. A perfectly written change process fails if the culture ignores it, or nobody has the skills to follow it.
Principles
For a governance system: provide stakeholder value; take a holistic approach; be dynamic; keep governance distinct from management; tailor it to the organisation; cover IT end to end. For a governance framework: be based on a conceptual model, be open and flexible, and align with major standards.
Tailoring it
Design factors shape each organisation’s governance system: enterprise strategy and goals, risk profile, IT-related issues, threat landscape, compliance requirements, the role of IT, sourcing model, implementation methods, technology adoption and size.
The goals cascade links it all together: stakeholder needs → enterprise goals → alignment goals → governance and management objectives.
Capability levels
COBIT 2019 rates process capability from 0 (incomplete) to 5 (optimising) on a CMMI-based scale. Organisations set a target level for each objective; not everything needs level 5.
Example. An auditor uses BAI06 (Managed IT Changes) as criteria, rates the organisation’s change management at capability level 2 against a target of 3, and lists the missing practices: no impact assessment and no post-implementation review.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Which COBIT domain is governance? | EDM |
| Where does change management sit? | BAI |
| Where do incident management and continuity sit? | DSS |
| Where does monitoring of internal control sit? | MEA |
| Main use of COBIT for an IS auditor | A source of criteria for evaluating governance and management |
| Why governance is kept distinct from management | Different activities, structures and purposes |
In short
- COBIT is ISACA's framework for the governance and management of enterprise information and technology.
- It separates governance (the EDM domain) from management (APO, BAI, DSS and MEA).
- COBIT 2019 has 40 governance and management objectives in those five domains.
- A governance system is built from components: processes, structures, policies, information, culture, people and technology.
- Design factors (strategy, risk profile, size, threat landscape and so on) tailor COBIT to each organisation.
- Process capability is rated 0 to 5 on a CMMI-based scale; organisations set a target level for each process.
- Auditors use COBIT objectives as criteria for judging governance and management practices.
Exam traps
- EDM is governance. APO, BAI, DSS and MEA are management.
- COBIT is a governance framework, not a security standard or a service management manual; it maps to those.
- MEA is management's monitoring; EDM includes the board's monitoring. Don't mix them.
- Don't memorise all 40 objectives. Know the five domains and what sits in each.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Five domains, and what lives where
More than processes
COBIT says a governance system is built from seven kinds of components. Processes alone aren't enough: without the right culture, skills and structures, the best-written process gets ignored.