COBIT 2019: Governance and Management of Information and Technology
COBIT 2019 helps design and tailor an enterprise governance and management system for information and technology to objectives and design factors.
Key Takeaways
- ✓Separates governance objectives from management activities.
- ✓Tailor the system to strategy, objectives, risk, size and environment.
- ✓Connects processes, structures, information, culture and technology services.
- ✓Use prioritized objectives with accountable owners and observable outcomes.
- ✓COBIT does not replace legal requirements, technical standards or business decisions.
Purpose
COBIT 2019 helps design and assess an enterprise governance and management system for information and technology. It distinguishes governance responsibilities—to evaluate, direct and monitor—from management activities that plan, build, run and monitor.
GRC use
Governance and management objectives, system components and design factors help tailor priorities to organizational strategy, risk profile, size and regulatory environment. They can help structure accountability, processes, information, organizational structures and technology services.
Boundaries
COBIT is not a one-size-fits-all recipe and does not replace technical standards, regulatory requirements or detailed controls. Objective selection should be justified and maintained.
Tailor to enterprise context
Identify stakeholder needs and translate them into enterprise and alignment goals before selecting governance or management objectives. Consider design factors such as strategy, goals, risk profile, IT issues, threats, compliance and sourcing model. Define accountable owners, expected outcomes and evidence; assess gaps and prioritize realistic improvements. Avoid turning the framework into a uniform checklist.
Illustrative example
An organization relying on cloud suppliers may prioritize supplier governance, security, continuity and service oversight. Priorities should follow its own objectives and risks rather than a generic score.
Tailoring and implementation
Start from stakeholder needs and the outcomes the enterprise expects. Document how strategy, risk, the IT environment, sourcing and obligations shape governance and management priorities. Define which decisions belong to the governing body and which to management; translate selected priorities into appropriate owners, practices, information and capabilities. Implement changes in stages and review dependencies before scaling.
Frequently asked questions
Is COBIT 2019 a certification?
COBIT is an ISACA framework and resource set; do not confuse it with an organizational certification.
Should every COBIT objective be implemented?
Tailoring depends on needs and design factors; objectives will not all have the same priority.
Is COBIT only for the IT department?
It focuses on enterprise governance of information and technology and requires business and governance involvement.
From strategy to evidence
Set up your connected operating model. No sales delays or complex rollouts.
Related Content
Global Internal Audit Standards: A Practical GRC Guide
How the IIA standards structure internal auditing through purpose, ethics, governance, management and service delivery.
ISO/IEC 27001: Information Security Management System
ISO/IEC 27001 specifies requirements for establishing, maintaining and improving an ISMS whose scope and risk treatments are defined in organizational context.