M5 S1 ISC CPA

Control Objectives for Information and Related Technology (COBIT) Framework

Provides a road map that organizations can use to implement best practices for IT governance and management

• Distinguishes between governance and management (objectives)

• Model can be customized through Design Factors and Focus Areas to arrive at a tailored enterprise governance system for any organization

Developed using:

1. COBIT 5

2. 6 principles for a governance system

   1. Stakeholder Value

   2. Holistic Approach

   3. Dynamic Governance System

   4. Government Distinct from Management

   5. Tailored to Enterprise Needs

   6. End-to-End Governance System

3. 3 principles for governance framework

   1. Based on Conceptual Model

   2. Open and Flexible

   3. Aligned to Major Standards

4. Other standards and regulations

5. Community contribution

Governance

Responsible for the direction of a company (success) that is the responsibility of the BOD, consisting of a chairperson and committees

Management

Responsible for the daily planning and administration of a company’s operations

• Selected by BOD

• Consists of CEO, CFO, COO, other executives

Governance System

6 Principles for a Governance System ←- “Very Healthy Dieters Do Try Everything”

1. Provide Stakeholder Value

2. Holistic Approach

3. Dynamic Governance System

4. Governance Distinct From Management

5. Tailored to Enterprise Needs

6. End-to-End Governance System

Provide Stakeholder Value

Principle of Governance System where value is created for stakeholders by balancing benefits, risks, and resources

• Well-designed system with actionable strategy

• Risk vs. Return to build value

Holistic Approach

Principle of Governance System where governance system for IT can comprise diverse components, collectively providing a holistic approach

• Encompasses all IT components

Dynamic Governance System

Principle of Governance System where a change in one government system occurs, and the impact on all others is considered so system continues to meet the demands of the organization

• System must be relevant while adjusting as new challenges arise; flexible

Governance Distinct From Management

Principle of Governance System where management activities and governance system are distinguished from each other because they have different functions

Tailored to Enterprise Needs

Principle of Governance System where the governance model is customized to each company, using Design Factors to prioritize and tailor the system

End-to-End Governance System

Principle of Governance System where more than just IT functions are considered in a governance system

• All processes in the organization involving IT should be factored into an end-to-end approach

Governance Framework

3 Principles for Governance Framework ←- CFA = “Cashmere Feels Awesome”

1. Based on Conceptual Framework

2. Open and Flexible

3. Aligned to Major Standards

Based on Conceptual Framework

Principle for Governance Framework where it identifies key components and relationships between them to provide greater automation and maximize consistency

Open and Flexible

Principle for Governance Framework where it has the ability to change, adding relevant content, and removing irrelevant content, while keeping consistency and integrity

Aligned to Major Standards

Principle for Governance Framework where framework is aligned with regulations, other frameworks, and standards

Governance Objectives

Objectives that always relate to a governance process where BOD are responsible for governance

1. Evaluate, Direct, and Monitor (EDM): TCWG evaluate strategic objectives, direct management to achieve objectives, and monitor if objectives are being met

   1. Benefits delivered

   2. Governance framework setting and maintenance

   3. Risk optimization

   4. Resource optimization

   5. Stakeholder engagement

Management Objectives

Objectives that always relate to a management process where senior management is responsible

1. Align, Plan, Organize (APO): Align strategy, plan technology, organize for effectiveness and efficiency

2. Build, Aquire, Implement (BAI): Address implementation of IT solutions in an organization’s business process

3. Deliver, Service, Support (DSS): Addresses Deliver, Service, and Support of IT services

4. Monitor, Evaluate, Assess (MEA): Continuous monitoring, evaluation, and assessment of IT systems, controls, operations

Align, Plan, and Organize (APO)

Management objective that deals with aligning the overall organization and strategy of IT governance

• Align strategy, plan technology, organize resources for effective and efficient usage

• Objectives

  1. Managed Data

  2. Managed Strategy

  3. Managed Innovation

  4. Managed Budget and costs

  5. Managed Human Resources

  6. Managed Vendors

  7. Managed Quality

  8. Managed Security

  9. Managed Risk

  10. Managed Relationships

  11. Managed Portfolio

  12. Managed Enterprise architecture

  13. Managed Service agreements

  14. Managed IT Mangement Framework

Build, Aquire, Implement (BAI)

Management objective that addresses the implementation of IT solutions in the organization’s business process

• Focuses on identifying IT requirements, acquiring the technology, and implementing it into current business processes

• Deals with defining, procuring, and deploying IT solutions and integrating them into business processes

Objectives

1. Managed Programs

2. Managed Requirement Definitions

3. Managed Solutions ID & Build

4. Managed Availability & Capacity

5. Managed Organizational Change

6. Managed IT Changes

7. Managed IT Change Acceptance & Transitioning

8. Managed Knowledge

9. Managed Assets

10. Managed Configuration

11. Managed Projects

Deliver, Service, Support (DSS)

Management objective that focuses on the security, delivery, and support of IT services

• Actual delivery of required services, including managing operations, service requests, and problems

• Deals with day-to-day operations

Objectives:

1. Managed Operations

2. Service Requests & Incidents

3. Managed Problems

4. Managed Continuity

5. Managed Security Services

6. Managed Business Processing Controls

Monitor, Evaluate, Assess (MEA)

Management objective that addresses IT’s conformance to the company’s performance targets and control objectives along with external requirements

• Continuous monitoring, evaluation, and assessment of IT system, controls, components

• Objectives:

  1. Managed Performance and conformance monitoring

  2. Managed system of internal controls

  3. Managed compliance with external requirements

  4. Managed assurance

Components of the Governance System

Factors that collectively or individually contribute to the successful execution of a company’s governance system over IT and systems

7 Components ←- “POP-PICS”

1. Processes

2. Organizational Structure

3. Principles, Policies, Frameworks

4. People, Skills, Competencies: Needed so sound decisions are made, corrective actions are taken, and critical objectives are completed

5. Information: Needed for system to function properly

6. Culture, Ethics, Behavior: Factors that influence success of all management and governance activities

7. Service, Infrastructure, Applications

Processes

Component of the governance system that are a set of activities or practices that produce outputs that help achieve overall IT goals

Organizational Structure

Component of the governance system that are the decision-making entities within an organization

Principles, Policies, Frameworks

Component of the governance system that servce as the guide for turning desired behavior into practice

Services, Infrastructure, Applications

Component of the governance system that are tools required so that a well-designed governance system is in place for IT processing

Design Factors

Factors that influence the design of a company’s IT governance system

1. Enterprise Strategy

2. Enterprise Goals ←- Balance scorecard evaluates strategy/ goals

3. Risk Profile ←- Current risk exposure vs. risk appetite

4. IT Issues

5. Threat Landscape ←- Normal vs. High

6. Compliance Requirements ←- Low, Normal, High

7. Role of IT

   1. Support: IT system that is not critical for business operations (Maintain contunity)

   2. Factory: IT system has immediate impact on business operations (Continuity fails)

   3. Turnaround: IT sys drives innovation, but it NOT required for critical business operations

   4. Strategic: IT sys. is crucial for innovation & business operations

8. Sourcing Model for IT ←- Outsourcing, cloud-based, built in-house

9. IT Implementation Models

10. Technology Adoption Strategy

    1. First mover strategy

    2. Follower strategy

    3. Slow-adopter strategy

11. Enterprise Size ←- Large Companies = 250+ employees full-time

COBIT 2019 Publications

Set of publications that help achieve customization of the IT governance system and is designed so companies can adopt its recommendations in a way that is customized to their own organizational needs

1. COBIT 2019 Framework: Introduction and Methodology ←- Core concepts of COBIT

2. COBIT 2019: Governance & Mangement Objectives

3. COBIT 2019 Design Guide: Designing IT Governance Solutions

4. COBIT 2019 Implementation Guide: Implementing and Optimizing IT Governance Solutions