COBIT-2019 COBIT 2019 Foundation Questions and Answers

The enterprise goal titled quality of management information is within the customer dimension of the IT balanced scorecard. The customer dimension focuses on how well the enterprise meets the needs and expectations of its customers and stakeholders. Quality of management information is one of the 17 generic enterprise goals defined by COBIT that supports the customer dimension. It describes the desired outcome of providing accurate, timely, relevant, and reliable information to support decision making and performance management.13 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance and Management Objectives

The risk profile of an enterprise is a design factor that describes how an enterprise identifies, assesses, responds to, monitors, and reports on information and technology risks. The risk profile helps to determine the level of risk appetite and tolerance that an enterprise has for its information and technology activities, as well as the level of control and assurance that is required for its governance framework. When reviewing the risk profile of an enterprise during the governance design phase, one of the prerequisites that must be established prior to conducting a high-level risk analysis is the enterprise’s risk appetite. The risk appetite is the amount and type of risk that an enterprise is willing to accept in pursuit of its objectives. The risk appetite provides a basis for defining the risk criteria, thresholds, indicators, and responses that will be used in the risk analysis process. The risk appetite also helps to align the governance framework with the enterprise’s strategy and objectives.References: : COBIT 2019 Design Guide, page 41-43 : COBIT 2019 Framework: Introduction and Methodology, page 28-29

 The percent of stakeholders satisfied with program/project quality would be an appropriate metric to align with a goal of “Delivery of programs on time, on budget, and meeting requirements and quality standards”. A metric is a quantifiable measure that is used to track and assess the status of a specific process or activity. A goal is a specific target or outcome that an enterprise sets to achieve its vision and mission. Delivery of programs on time, on budget, and meeting requirements and quality standards is one of the 17 generic enterprise goals defined by COBIT that describes the desired outcome of ensuring that IT-enabled investments are delivered successfully. The percent of stakeholders satisfied with program/project quality is a metric that reflects how well this goal is achieved.13 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance and Management Objectives

 Within the COBIT goals cascade, stakeholder drivers are transformed into the enterprise’s actionable strategy. The COBIT goals cascade is a mechanism that helps enterprises to align their governance objectives with their stakeholder needs. It consists of four levels: stakeholder drivers, enterprise goals, alignment goals, and governance and management objectives. Stakeholder drivers are the needs or expectations of the internal or external stakeholders of the enterprise. Enterprise goals are the specific targets or outcomes that the enterprise sets to achieve its vision and mission. Alignment goals are the intermediate goals that link the enterprise goals with the governance and management objectives. Governance and management objectives are the desired outcomes of the governance system for information and technology. Stakeholder drivers are transformed into enterprise goals through a process of analysis, prioritization, and validation. Enterprise goals form the basis of the enterprise’s actionable strategy.12 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System

 A due diligence review is a process that involves conducting a comprehensive analysis and assessment of an enterprise’s information and technology assets, capabilities, risks, issues, opportunities, etc., before making a significant decision or transaction. A due diligence review helps to ensure that an enterprise has a clear understanding of the current state and potential impacts of its information and technology activities on its strategy, objectives, performance, value, etc., as well as on its compliance with relevant laws, regulations, standards, guidelines, contracts, or agreements. It is critical to perform a due diligence review following a merger, acquisition, or divestiture event. A merger is an event that involves combining two or more enterprises into one entity. An acquisition is an event that involves one enterprise purchasing another enterprise or its assets. A divestiture is an event that involves one enterprise selling or transferring part of its business or assets to another enterprise. By performing a due diligence review following a merger acquisition or divestiture event an enterprise can ensure that it has identified and addressed any information and technology related risks issues gaps etc., that may arise from the integration or separation of information and technology assets capabilities processes systems structures culture etc., that it has aligned its information and technology governance and management with its new strategy objectives needs expectations etc., that it has optimized its information and technology performance and value delivery etc34 References: 3: COBIT 2019 Framework: Governance and Management Objectives: page 20-21 4: COBIT 2019 Design Guide: page 47-48

To gain the greatest benefit from the COBIT framework, a stakeholder should have a certain level of experience and a thorough understanding of the entire enterprise. A stakeholder is a person or group that has an interest or concern in an enterprise’s activities or outcomes. Examples of stakeholders are board members, executives, managers, employees, customers, suppliers, regulators, etc. To gain the greatest benefit from the COBIT framework, a stakeholder should have a certain level of experience in I&T governance or management practices, as well as a thorough understanding of the entire enterprise’s vision, mission, values, goals, objectives, strategies, processes, culture, etc. This would help them to apply the COBIT framework effectively and efficiently to their specific context and needs.1 References: COBIT 2019 Framework: Introduction and Methodology, [COBIT 2019 Framework: Stakeholder Needs]

The principles, policies and frameworks component of a governance system translates desired behavior into practical guidance. Principles are the fundamental norms or rules that guide decision-making and actions. Policies are the statements of intent or direction that define what is expected or required. Frameworks are the conceptual models or structures that define the key elements, relationships, and principles of a system. The principles, policies and frameworks component of a governance system translates desired behavior into practical guidance by providing a consistent and coherent basis for information and technology governance and management.14 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System

 The Align, Plan and Organize (APO) domain incorporates managed risk as one of its management objectives. The APO domain covers the activities related to aligning IT strategy with business strategy, planning IT resources and capabilities, organizing IT governance structures and processes, managing IT performance, innovation, risk, quality, human resources, security, information, services, etc. The APO domain consists of 13 management objectives that describe the desired outcomes of these activities.14 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance and Management Objectives

The high-level risk analysis is a process that involves identifying, assessing, and prioritizing the information and technology risks that an enterprise faces in relation to its governance system design. The high-level risk analysis helps to determine the level of risk appetite and tolerance that an enterprise has for its information and technology activities, as well as the level of control and assurance that is required for its governance framework. The primary benefit of conducting a high-level risk analysis during governance design is to prioritize governance and management objectives. The governance and management objectives are the statements of what an enterprise wants to achieve in terms of its information and technology governance. The governance and management objectives are derived from the enterprise goals, which are the high-level statements of what an enterprise wants to achieve in terms of its mission, vision, values, and strategy. By conducting a high-level risk analysis, an enterprise can identify the areas of risk that have the most impact on its enterprise goals, and therefore prioritize the governance and management objectives that address those risks. This will also help to align the governance framework with the enterprise’s strategy and objectives12 References: 1: COBIT 2019 Design Guide: page 41-43 2: COBIT 2019 Framework: Introduction and Methodology: page 25-26

The business case and program plan are essential documents that describe the rationale, objectives, scope, approach, benefits, costs, risks, and timeline of the EGIT implementation program. The business case and program plan provide the basis for obtaining approval, funding, resources, and support for the program from the stakeholders. Therefore, it is important that these documents are realistic and achievable, reflecting the current state and target state of information and technology governance in the enterprise. One of the roles that ensures the business case and program plan are realistic and achievable is the chief information officer (CIO), who is the senior executive responsible for leading and managing the information and technology function in the enterprise. The CIO has a role in developing, reviewing, validating, and approving the business case and program plan, ensuring that they are aligned with the enterprise’s strategy, objectives, needs, and expectations. The CIO also has a role in communicating and presenting the business case and program plan to other stakeholders such as the board, executives, business managers, IT managers, etc., and obtaining their buy-in and commitment for the program34 References: 3: COBIT 2019 Implementation Guide, page 39-40 4: COBIT 2019 Framework: Governance and Management Objectives, page 20-21

The primary objective of reviewing the effectiveness of a new IT governance system that has been operational for 6 months is to identify further governance requirements. An IT governance system is a set of components that provide direction, oversight, evaluation, monitoring, assurance, etc., for an enterprise’s information and technology. The effectiveness of an IT governance system can be reviewed using different methods or tools, such as audits, assessments, surveys, feedbacks, etc. The primary objective of reviewing the effectiveness of a new IT governance system that has been operational for 6 months is to identify further governance requirements that may arise from changes in the internal or external environment, stakeholder needs, business objectives, etc.12 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Implementation Guide: Implementing an Information and Technology Governance Solution

 The IT design factor is a design factor that describes how an enterprise uses information and technology to achieve its goals and objectives. There are six IT design factors defined in COBIT 2019: strategic; operational; data-driven; compliance-driven; innovation-driven; customer intimacy-driven. Each design factor has different implications for the governance and management of information and technology in terms of focus areas, processes, practices, roles, structures, and metrics. When considering the role of IT design factor, and the design factor value is strategic, one of the management objectives that should be a priority is managed innovation (APO04), which involves identifying new opportunities for using information and technology to create value for the enterprise. This management objective supports the strategic role of IT in enabling business transformation, differentiation, competitiveness, growth, and sustainability. This management objective also involves establishing an innovation culture and process that encourages creativity, experimentation, collaboration, learning, and improvement5 References: 5: COBIT 2019 Design Guide: page 35-36 : COBIT 2019 Process Reference Guide: page 57-59

According to the COBIT 2019 Framework: Introduction and Methodology, one of the imperative factors to the successful implementation of IT governance is that IT governance is sponsored by executives. Executive sponsorship ensures that IT governance has sufficient authority, resources and support from the top management of the organization. Executive sponsorship also demonstrates commitment and leadership for IT governance, and fosters a culture of accountability and collaboration among stakeholders.3, p. 33-34 References: 3: COBIT 2019 Framework: Introduction and Methodology

The pursuit of continuous improvement is the most essential attribute of the highest process capability level (Level 5). A process capability level is a measure of how well a process or activity is performed in terms of effectiveness, efficiency, completeness, reliability, etc. A process capability level can range from 0 (incomplete) to 5 (optimizing). Level 5 (optimizing) means that the process continuously improves its performance through both incremental and innovative improvements. The pursuit of continuous improvement is the most essential attribute of Level 5, as it implies that the process is constantly monitored, evaluated, learned from, and enhanced.14 References: CMMI for Development, Version 1.3, CMMI Institute - Capability Maturity Model Integration

The focus of an enterprise that has a cost leadership strategy design factor is short-term cost minimization. A cost leadership strategy is a competitive strategy that aims to achieve lower costs than competitors by offering standardized products or services at low prices. A cost leadership strategy design factor affects how an enterprise designs its governance system, as it implies a focus on operational efficiency, process automation, economies of scale, outsourcing, etc. An enterprise that has a cost leadership strategy design factor would prioritize short-term cost minimization over long-term cost optimization or medium-term cost equalization.12 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution

A guiding principle in the development of COBIT is that COBIT aligns with other related and relevant I&T standards, frameworks and regulations. This is based on the principle of integration, which states that “governance of enterprise I&T should ensure integration into enterprise governance; alignment with other related standards, frameworks and regulations; and provision of a common language for all stakeholders” . COBIT does not include or replace other standards, frameworks or regulations, but rather complements them by providing a holistic and comprehensive approach to governance of enterprise I&T. 

 The enterprise strategy archetype is a design factor that describes how an enterprise uses information and technology to achieve its goals and objectives. There are six enterprise strategy archetypes defined in COBIT 2019: growth/acquisition; operational excellence; customer intimacy; product leadership; data-driven; innovation-driven. Each archetype has different implications for the governance and management of information and technology in terms of focus areas processes practices roles structures,and metrics. The enterprise strategy archetype that is focused on increasing revenues is growth/acquisition. Growth/acquisition is a strategy archetype that emphasizes expanding market share revenue customer base or product range through organic growth or acquisition of other businesses or assets. This strategy archetype requires effective portfolio management of information and technology investmentsand initiatives that support business growth or acquisition objectives. Portfolio management involves selecting prioritizing balancing monitoring evaluating,and optimizing informationand technology investmentsand initiatives based on their alignment with business strategy value delivery potential risk exposure resource availability interdependencies etc.Portfolio management also involves ensuring that informationand technology investmentsand initiatives are integrated with business processes systems structures culture etc especially in case of mergers or acquisitions.5 References: 5: COBIT 2019 Design Guide: page 35-36 : COBIT 2019 Process Reference Guide: page 59-61

The process practices are the descriptions of the activities that are performed within a process to achieve its purpose and outcomes. The process practices are organized into three levels: basic, intermediate, and advanced. The process practices also include inputs, outputs, roles, responsibilities, goals, and metrics for each activity. The process practices are aligned with the capability levels that can be used as benchmarks to measure and improve the performance of a process. The capability levels are a measure of how well an enterprise performs its information and technology governance and management processes in terms of process attributes such as process performance, process definition, process deployment, process measurement, process control, process optimization etc. The capability levels range from 0 (incomplete) to 5 (optimizing), indicating the degree of maturity and effectiveness of an enterprise’s information and technology governance and management processes. By using the process practices as benchmarks, an enterprise can assess its current capability level for each process, identify the gaps or issues that need to be addressed, set the target capability level for each process based on its strategy, objectives, needs, expectations, etc., and implement the actions and initiatives that are required to enhance the capability level for each process12 References: 1: COBIT 2019 Process Reference Guide: Governance and Management Objectives: page 13-15 2: COBIT 2019 Process Assessment Model: page 11-13

According to the COBIT 2019 Implementation Guide: Implementing an Information and Technology Governance Solution, one of the most significant drivers to be considered when refining the scope of a new IT governance system during the design phase is cloud versus on-premises services. This driver reflects the different delivery models of I&T services, such as software as a service (SaaS), platform as a service (PaaS), infrastructure as a service (IaaS) or on-premises solutions. The choice of delivery model has implications for governance objectives, roles, responsibilities, policies, processes, controls, risks and performance measures.5, p. 40-41 References: 5: COBIT 2019 Implementation Guide: Implementing an Information and Technology Governance Solution

 A key principle associated with the Accountable (A) role of an organizational structure is that accountability cannot be shared. This means that only one person can be accountable for each activity or decision, and that person is ultimately liable for the success and achievement of the assigned tasks2, p. 34. References: 2: COBIT 2019 Framework: Introduction and Methodology

IT-related issues should be considered as part of the design factors for a governance system in order to manage risks that have a high impact. Design factors are the characteristics of the enterprise that influence the design and operation of a governance system, such as size, industry, culture, strategy, etc. IT-related issues are one of the 11 design factors defined in COBIT 2019, and they refer to the specific challenges or opportunities that arise from the use of information and technology in the enterprise, such as cybersecurity, digital transformation, innovation, etc. These issues may pose significant risks to the enterprise’s objectives, performance, or reputation, and therefore need to be addressed by the governance system. The answer is based on the COBIT 2019 Design Guide1, page 15. References: 1: COBIT 2019 Design Guide | Digital | English.

The primary purpose for aligning role descriptions to the enterprise’s business context, organization and operating environment when tailoring the COBIT organizational structure is to assign levels of accountability and responsibility for governance and management activities. This purpose helps to ensure that roles are clearly defined, communicated, understood, and accepted by all stakeholders, and that there are no gaps or overlaps in roles. The purpose is based on the COBIT 2019 Implementation Guide5, page 45. References: 5: COBIT 2019 Implementation Guide | Digital | English

The industry sector is a design factor that describes the type of business or economic activity that an enterprise engages in. The industry sector influences the governance and management of information and technology in terms of the specific standards, guidelines, regulations, best practices, challenges, opportunities, etc., that are applicable or relevant for that sector. The industry sector that can be characterized by a low level of regulation and a high level of focus on cost is nonprofit enterprises. Nonprofit enterprises are organizations that operate for a social or environmental purpose rather than for profit. Nonprofit enterprises typically have a low level of regulation compared to other sectors such as financial, health care, public, etc., which have more stringent and complex compliance requirements regarding their information and technology activities. Nonprofit enterprises also have a high level of focus on cost, as they have limited resources and funding, and they need to optimize their spending and demonstrate their accountability and transparency to their donors, beneficiaries, partners, etc. Therefore, nonprofit enterprises need to ensure that their information and technology governance system is efficient, effective, and value-driven.References: : COBIT 2019 Design Guide: page 45-46 : COBIT 2019 Framework: Introduction and Methodology: page 33-34

 Processes are key components of a governance system. Processes are the structured sets of activities that produce outputs or outcomes for achieving specific objectives. Processes define what needs to be done, by whom, when, how, and why. Processes are one of the seven enablers of a governance system, as defined by COBIT.12 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System

In COBIT 2019, "Time-to-market" is closely associated with the enterprise goal of maintaining a portfolio of competitive products and services. This metric reflects the enterprise’s ability to deliver new offerings to the market efficiently, which is essential for competitive advantage. The COBIT goals cascade links time-to-market to this objective, emphasizing the importance of quick responsiveness to market demands as part of enterprise strategy​.

Enterprise strategy cascades to enterprise goals within the COBIT goals cascade. The COBIT goals cascade is a mechanism that helps enterprises to align their governance objectives with their stakeholder needs. It consists of four levels: stakeholder drivers, enterprise goals, alignment goals, and governance and management objectives. Enterprise strategy is the high-level direction and guidance that defines how the enterprise will achieve its vision and mission. Enterprise goals are the specific targets or outcomes that the enterprise sets to achieve its vision and mission. Enterprise strategy cascades to enterprise goals through a process of analysis, prioritization, and validation.12 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System

The threat landscape is a design factor that describes the types and levels of threats that an enterprise faces from internal and external sources that could compromise its information and technology assets. The threat landscape helps to determine the level of security and resilience that an enterprise needs to protect its information and technology assets from unauthorized access use disclosure modification destruction or disruption. When tailoring a governance system for an enterprise what would be the most appropriate level of threat landscape for an enterprise in the health care sector is high. The health care sector is a sector that provides health care services such as diagnosis treatment prevention rehabilitation etc., to individuals or populations. The health care sector has a high level of threat landscape compared to other sectors such as manufacturing or retail which have lower levels of threat landscape. This is because the health care sector handles sensitive personal data such as medical records health insurance information patient identifiers etc., that are subject to strict privacy and security regulations such as HIPAA GDPR etc., as well as ethical and legal obligations. The health care sector also relies on critical information and technology systems such as electronic health records telemedicine devices medical devices etc., that are essential for delivering quality health care services to patients. The health care sector faces various types of threats such as cyberattacks data breaches identity theft ransomware malware phishing social engineering natural disasters human errors etc., that could compromise its information and technology assets resulting in financial losses reputational damage legal liabilities regulatory penalties patient harm etc. Therefore when tailoring a governance system for an enterprise in the health care sector it is important to consider a high level of threat landscape and design a governance system that can effectively manage the potential impacts of threats on its information and technology assets5 References: 5: COBIT 2019 Design Guide: page 41-43 : COBIT 2019 Design Guide: page 47-48

The level achieved when all processes of a focus area achieve a particular capability level is referred to as the maturity level. A focus area is a topic or issue that can be addressed by governance objectives, such as digital transformation, cybersecurity, privacy, etc. A focus area consists of a set of processes that are relevant and applicable for the topic or issue. A capability level is a measure of how well a process or activity is performed in terms of effectiveness, efficiency, completeness, reliability, etc. A capability level can range from 0 (incomplete) to 5 (optimizing). A maturity level is the level achieved when all processes of a focus area achieve a particular capability level. A maturity level can range from 0 (non-existent) to 5 (optimized).12 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System

Time-to-market is a market factor that is directly related to the enterprise goal of portfolio of competitive products and services. Time-to-market is the measure of how quickly an enterprise can deliver new or improved products or services to its customers. It affects the competitiveness, profitability, and customer satisfaction of the enterprise. Portfolio of competitive products and services is one of the 17 generic enterprise goals defined by COBIT that describes the desired outcome of providing products or services that meet customer needs and expectations, and that are superior to those offered by competitors.13 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance and Management Objectives

In COBIT 2019, DevOps is classified as a design factor and a hybrid method. Design factors influence the tailoring of a governance system. As a hybrid method, DevOps combines development and operations practices, emphasizing continuous delivery and integration. This concept aligns with COBIT’s adaptable framework, which accommodates various focus areas and methodologies to enhance agility and responsiveness in IT processes​.

 An enterprise goal is a high-level statement of what the enterprise wants to achieve, aligned with the mission, vision and values of the enterprise. Portfolio of competitive services is an enterprise goal that would most likely be evaluated by using a metric “percent of services that meet or exceed targets in revenues and market share”, as it reflects the need to offer products and services that are attractive to customers and differentiate the enterprise from its competitors2, p. 17. References: 2: COBIT 2019 Framework: Governance and Management Objectives

The investment justification element of a business case best enables senior leadership to assess the future success of the IT governance program. A business case is a document that provides the rationale and evidence for initiating, continuing, or terminating a project or program. A business case typically consists of several elements, such as problem statement, objectives, scope, benefits, costs, risks, assumptions, etc. The investment justification element of a business case describes how the project or program aligns with the enterprise strategy and objectives, how it supports the value creation process, how it compares with alternative options, and how it provides a positive return on investment (ROI). The investment justification element enables senior leadership to assess the future success of the IT governance program by showing how it contributes to the enterprise goals and delivers value to the stakeholders.12 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Implementation Guide: Implementing an Information and Technology Governance Solution

 An IT implementation method design factor is a characteristic that influences how an enterprise implements IT solutions and services. DevOps is an IT implementation method that focuses on software building, deployment and operations, by integrating development and operations teams to improve collaboration and productivity1, p. 31. References: 1: COBIT 2019 Framework: Introduction and Methodology

 After IT department goals have been aligned with enterprise goals, the next step is to link the alignment goals with governance and management objectives. Alignment goals are the intermediate goals that link the enterprise goals with the governance and management objectives. Governance and management objectives are the desired outcomes of the governance system for information and technology. Alignment goals are derived from the enterprise goals, which reflect the stakeholder drivers and needs. Governance and management objectives are derived from the alignment goals, which reflect how information and technology can support the enterprise strategy and objectives.14 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System

 The management objective APO09 Managed Service Agreements involves ensuring that IT services are delivered in accordance with agreed-upon service levels and costs. This management objective covers the activities of defining, negotiating, establishing, monitoring, reporting, and reviewing service agreements between service providers and service consumers. This management objective is most relevant for an enterprise that plans to outsource all of its noncore IT operations but wants to ensure the proper level of governance, risk and compliance (GRC) controls. By applying this management objective, the enterprise can improve its service governance and management capabilities, ensure alignment of IT services with business strategy and objectives, enhance service performance and outcomes, and increase service consumer satisfaction and value realization. This management objective also involves ensuring that the outsourced IT services comply with the applicable laws, regulations, standards, guidelines, contracts, or agreements that govern the information and technology activities of the enterprise, as well as with the enterprise’s policies, procedures, processes, practices, etc. This management objective also involves managing the risks associated with outsourcing IT services such as loss of control, vendor lock-in, quality issues, security breaches, etc.References: : COBIT 2019 Process Reference Guide: Governance and Management Objectives: page 63-65 : COBIT 2019 Implementation Guide: page 49-50

The primary target audience for COBIT is business and IT management responsible for building and deploying I&T solutions. COBIT is designed to help these managers address the challenges of aligning I&T with business goals, delivering value from I&T, managing I&T risks, optimizing I&T resources, and measuring I&T performance5. COBIT provides a comprehensive and flexible framework that can be adapted to different contexts and situations. COBIT also helps to establish a common language and understanding among business and IT stakeholders6. References: 5: COBIT 2019 Framework: Introduction and Methodology, page 15 6: COBIT 2019 Framework: Introduction and Methodology, page 25

The EGIT business case outline and details are documents that describe the rationale, objectives, scope, approach, benefits, costs, risks, and timeline of the EGIT implementation program. The EGIT business case outline and details provide the basis for obtaining approval, funding, resources, and support for the program from the stakeholders. The responsibility for developing an EGIT business case outline and details resides with the CIO and program steering committee. The CIO is the senior executive responsible for leading and managing the information and technology function in an enterprise. The CIO has a role in developing, reviewing, validating, and approving the EGIT business case outline and details, ensuring that they are aligned with the enterprise’s strategy, objectives, needs, and expectations. The CIO also has a role in communicating and presenting the EGIT business case outline and details to other stakeholders such as the board, executives, business managers, IT managers, etc., and obtaining their buy-in and commitment for the program. The program steering committee is a group of senior stakeholders who provide strategic direction, oversight, guidance, and approval for the EGIT implementation program. The program steering committee has a role in developing, reviewing, validating, and approving the EGIT business case outline and details, ensuring that they are consistent with the enterprise’s vision, mission, values, strategy goals,and objectives. The program steering committee also has a role in monitoring and controlling the execution of the EGIT implementation program plan against the EGIT business case outline and details34 References: 3: COBIT 2019 Implementation Guide: page 37-38 4: COBIT 2019 Implementation Guide: page 39-40

The enterprise goal of compliance with external laws and regulations is aligned to the financial dimension of the balanced scorecard (BSC). The BSC is a strategic performance management tool that helps enterprises to translate their vision and strategy into operational objectives and measures. The BSC consists of four dimensions: financial, customer, internal, and growth. The financial dimension focuses on the financial performance and value creation of the enterprise. Compliance with external laws and regulations is one of the 17 generic enterprise goals defined by COBIT that supports the financial dimension.12 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance and Management Objectives

In COBIT 2019, enterprise governance of IT (EGIT) is an essential responsibility of the board. The board holds ultimate accountability for governance by setting direction, monitoring performance, and ensuring compliance with the enterprise’s goals. This responsibility includes establishing structures and mechanisms to support EGIT, which falls under the Evaluate, Direct, and Monitor (EDM) domain, specifically addressed in governance objective EDM01. The framework specifies that governance is led by the board, with executive management supporting execution​.

The best way to enable an enterprise to show and prove the benefits realized from the implementation of an EGIT program plan is to communicate the results and benefits in business impact terms. The EGIT program plan is a document that describes the rationale, objectives, scope, approach, benefits, costs, risks, and timeline of the EGIT implementation program. The EGIT implementation program is a program that involves designing and implementing a governance system for an enterprise using COBIT 2019. Communicating the results and benefits in business impact terms means using appropriate tools, methods, formats, frequencies, etc., to report on the progress and outcomes of the EGIT implementation program to relevant stakeholders such as the board, executives, business managers, IT managers, etc., using language and metrics that demonstrate how the program has contributed to achieving the enterprise’s strategy, objectives, performance, value, etc. By communicating the results and benefits in business impact terms, an enterprise can ensure that it has a clear and compelling evidence of the value and benefits delivered by the EGIT implementation program, that it has met stakeholder requirements and expectations, that it has obtained stakeholder feedback and recognition, that it has enhanced stakeholder trust and confidence, etc12 References: 1: COBIT 2019 Implementation Guide: page 51-52 2: COBIT 2019 Framework: Governance and Management Objectives: page 19-20

The information flow and items component of COBIT includes a list of artifacts with links to relevant governance and management practices. An artifact is a tangible or intangible object that is produced, modified, or used by a process or activity. An artifact can be a document, a report, a record, a plan, a policy, a procedure, a service, a product, etc. The information flow and items component of COBIT provides a comprehensive list of artifacts that are relevant for each governance and management objective, as well as links to the practices that produce, modify, or use them.12 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System

People, skills and competencies are required for successful completion of all activities within a governance system. People are the individuals or groups who perform or are accountable for the governance activities and tasks. Skills and competencies are the abilities and knowledge that people need to perform their roles and responsibilities. People, skills and competencies are one of the seven enablers of a governance system, as defined by COBIT.12 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System

 The COBIT principle that addresses the need to consider how changes in technology or strategy impact the enterprise governance system as a whole is that a governance system should be dynamic. This principle states that “a governance system should be responsive to changing stakeholder needs, conditions and options; adaptable to changing circumstances; able to learn from experience; and innovative in supporting continual improvement” 4. A dynamic governance system can anticipate and respond to changes in the internal and external environment, such as new technologies, business models, risks, or opportunities5. References: 4: COBIT 2019 Framework: Introduction and Methodology, page 23 5: COBIT 2019 Framework: Governance and Management Objectives, page 20

The information security function within the IT corporate structure is responsible for classifying information using an agreed-upon classification scheme for a new data collection system. According to the COBIT 2019 Implementation Guide, information security is one of the key enablers of IT governance and management, and it includes the processes and practices for ensuring the confidentiality, integrity, and availability of information assets. One of the activities of information security is to define and implement an information classification scheme that categorizes information based on its sensitivity, criticality, and value to the enterprise. This scheme helps to determine the appropriate level of protection and controls for different types of information, especially for new data collection systems that may involve personal or sensitive data. References: : COBIT 2019 Implementation Guide: Implementing and Optimizing an Information and Technology Governance Solution, page 15 1 : COBIT 2019 Design Guide: Designing an Information & Technology Governance Solution, page 62 .

 Design factors are based on generic components of a governance system but are tailored for a specific purpose or context within a focus area. Design factors are the characteristics or aspects of an enterprise that influence the design and implementation of a governance system. They include factors such as enterprise size, industry sector, risk profile, regulatory environment, sourcing model, etc. Focus areas are topics or issues that can be addressed by governance objectives, such as digital transformation, cybersecurity, privacy, etc. COBIT provides guidance on how to use design factors and focus areas to customize a governance system.13 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution

The value that I&T delivers should be aligned directly with the values on which the business is focused. This is based on the principle of alignment, which states that “governance of enterprise I&T should ensure that I&T-enabled investments are aligned with the enterprise strategy and deliver the expected benefits” . Value delivery is not only about maintaining or increasing value from existing I&T investments, but also about ensuring that new investments support the strategic objectives and stakeholder needs of the enterprise.

 A governance or management objective always relates to a single process. A governance or management objective is a desired outcome or result of a governance or management activity for information and technology. A process is a set of interrelated or interacting activities that transform inputs into outputs. A process can be described by its purpose, goals, practices, activities, inputs, outputs, roles, metrics, etc. A governance or management objective always relates to a single process by defining its purpose and goals, as well as providing guidance on how to perform it effectively and efficiently.12 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance and Management Objectives

 The COBIT performance model is integrated into the COBIT core model. The COBIT core model consists of two main elements: the governance and management objectives (which define what needs to be achieved) and the performance model (which defines how well it needs to be achieved). The performance model is based on existing maturity and capability models (such as ISO/IEC 15504) and provides a common language to measure and communicate performance. The performance model consists of six levels (from 0 to 5) that describe the increasing degree of capability for each governance or management objective.15 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System

COBIT 2019 provides a comprehensive framework to support the decision-making process rather than prescribing specific solutions. It guides the structuring of governance and management objectives across different domains, such as EDM, APO, and BAI, enabling stakeholders to understand the components and decision levels required for efficient IT governance. This aligns with COBIT's goals to establish clear responsibilities and decision-making criteria for various roles, ensuring alignment with enterprise objectives and stakeholder needs​.

 Culture, ethics and behavior are the most likely components of a governance system to be underestimated as factors in the success of governance and management activities. Culture, ethics and behavior are the shared values, beliefs, norms, and attitudes that influence how people behave and interact within an enterprise. They affect the motivation, commitment, collaboration, and performance of people, as well as the trust and reputation of the enterprise. Culture, ethics and behavior are one of the seven enablers of a governance system, as defined by COBIT.12 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System

 An element of governance is evaluating stakeholder needs to determine enterprise objectives. This is based on the principle of stakeholder value, which states that “governance of enterprise I&T should ensure that stakeholder needs, conditions and options are evaluated to determine balanced, agreed-on enterprise objectives to be achieved; setting direction through prioritization and decision making; and monitoring performance and compliance against agreed-on direction and objectives” 1. Evaluating stakeholder needs involves identifying who the stakeholders are, what their interests and expectations are, and how they can influence or be influenced by the enterprise’s activities2. References: 1: COBIT 2019 Framework: Introduction and Methodology, page 23 2: COBIT 2019 Framework: Governance and Management Objectives, page 18

 The legal office is a function that provides legal advice and support to an enterprise on various matters related to its information and technology activities. The legal office also ensures that the enterprise complies with the applicable laws, regulations, standards, guidelines, contracts, or agreements that govern its information and technology activities. One of the responsibilities of the legal office is to execute contracts that retain independent legal consultants to review the level of regulatory compliance of a proposed IT solution. This means that the legal office is responsible for negotiating, drafting, signing, and enforcing contracts with external legal experts who can provide independent and objective assessment of the compliance status of an IT solution that an enterprise intends to implement or use. The legal office also ensures that the contracts are aligned with the enterprise’s strategy, objectives, needs, and expectations, as well as with the relevant compliance requirements34 References: 3: COBIT 2019 Framework: Governance and Management Objectives: page 20-21 4: COBIT 2019 Design Guide: page 47-48

The role of IT design factor describes how IT supports the enterprise strategy and objectives. Turnaround is a role of IT that is viewed as a driver for business process and service innovation, by enabling new ways of doing business, creating new sources of revenue, and enhancing customer satisfaction1, p. 29. References: 1: COBIT 2019 Framework: Introduction and Methodology

The oversight of technology and innovation processes by the board is critical to ensuring I&T-related decisions are aligned with the enterprise’s strategies and objectives. The board is the highest governing body of the enterprise that provides direction, oversight, and accountability for the enterprise’s performance. Technology and innovation processes are the activities that enable the enterprise to leverage information and technology to create value, achieve strategic goals, and respond to changing business needs. The oversight of technology and innovation processes by the board ensures that I&T-related decisions are consistent with the enterprise’s vision, mission, values, policies, and risk appetite.13 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System