Presentaciones Compressed

Foundation Course
Copyright © 2018 Information Systems Audit and Control Association, Inc. All rights reserved.
DISCLAIMER
The information contained in this session may contain privileged and confidential
information.
This presentation is for information only. Before acting on any ideas presented in this
session; security, legal, technical, and reputational risks should be independently
evaluated considering the unique factual circumstances surrounding each institution.
Any views or opinions presented do not necessarily state or reflect those of the
presenter’s organization, ISACA, or any other entity.
The following information presented is confidential and/or proprietary and is intended for
the express use by attendees. Any unauthorized release of this information is prohibited.
© 2018 ISACA. All rights reserved. For usage guidelines, see www.isaca.org/COBITuse.
2
MODULE 1
COURSE INTRODUCTION
3
MODULE 1 TOPICS
Introductions
Course Description
Learning Objectives
Intended Audience
Course Modules
Exam Requirements
4
INTRODUCTIONS
5
FACILITATOR INTRODUCTION
Facilitator name
6
COURSE DESCRIPTION
7
COURSE DESCRIPTION
COBIT ® is a framework for the enterprise

governance and management of information and
technology (I&T) that supports enterprise goal
achievement.
This Foundation Course is intended for current

COBIT 5 Foundation Certificate holders as well
as those new to COBIT who are interested in
achieving the latest foundation certificate.
This two-day course highlights the concepts,

models and key definitions of the COBIT
framework and helps prepare learners to take
the COBIT 2019 Foundation Exam.
8
LEARNING OBJECTIVES
9
COURSE LEARNING OBJECTIVES
Recognize the target audience of COBIT 2019. Understand the relationship between Governance and
Management Objectives and Governance Components.
Recognize the context, benefits and key reasons COBIT
is used as an information and technology governance Differentiate COBIT based performance management
framework. using maturity and capability perspectives.
Recognize the descriptions and purposes of the COBIT Discover how to design a tailored governance system
product architecture. using COBIT.
Recall the alignment of COBIT with other applicable Explain the key points of the COBIT business case.
frameworks, standards and bodies of knowledge.
Understand and recall the phases of the COBIT
Understand and describe the governance “system” and implementation approach.
governance “framework” principles.
Describe the relationships between the COBIT Design
Describe the components of a governance system. and Implementation Guides.
Understand the overall structure and contents of the Prepare for the COBIT 2019 Foundation exam.
Goals Cascade.
Recall the 40 Governance and Management Objectives

and their purpose statements.
10
INTENDED AUDIENCE
11
INTENDED AUDIENCE
Current COBIT 5 Foundation Certificate holders who

are interested in achieving the COBIT 2019
Foundation Certificate.
Individuals with no previous COBIT training or

certifications interested in learning the COBIT 2019
framework essentials.
12
COURSE MODULES
Module 1
Module 7
• Course Introduction • Designing a Tailored Governance System

Module 2
Module 8
• Framework Introduction
• Business Case
Module 3
• Principles Module 9
Module 4
• Implementation
• Governance System and Components
Module 5
Module 10
• Governance and Management Objectives • Closing

Module 6
• Performance Management
13
EXAM REQUIREMENTS
This COBIT Foundation exam is designed to test the candidate’s

knowledge of the framework as opposed to memorization.
• Online proctored exam
• 75 multiple-choice questions
• Closed-book
• One correct answer for each question, using three choices (A, B or C)
• Two-hours duration
• Pass rate is 65% or 49 correct answers out of 75
14
14
MODULE 2
FRAMEWORK INTRODUCTION
15
MODULE 2 TOPICS AND LEARNING OBJECTIVES
Topics Learning Objectives

• Enterprise Governance of I&T • Recognize the target audience of COBIT
• COBIT as an I&T Framework 2019.
• Intended Audience for the COBIT 2019 • Recognize the context, benefits and key
Framework reasons COBIT is used as an information
and technology governance framework.
• COBIT Format and Product
Architecture • Recognize the descriptions and purposes
of the COBIT product architecture.
• COBIT and Other Standards
• Recall the alignment of COBIT with other
• Training and Certification
applicable frameworks, standards and
• Group Discussion and Questions bodies of knowledge.
• Module Summary and Sample • Prepare for the COBIT 2019 Foundation
Questions exam.
16
ENTERPRISE GOVERNANCE OF I&T
17
ENTERPRISE GOVERNANCE OF
INFORMATION AND TECHNOLOGY
In the light of digital transformation, information and

technology (I&T) have become crucial in the
support, sustainability and growth of enterprises.
• Previously, governing boards and senior management
could delegate, ignore or avoid I&T-related decisions.
• In most sectors and industries, such attitudes are now
ill-advised.
• Digitized enterprises are increasingly dependent on I&T
for survival and growth.
• Stakeholder value creation is often driven by a high
degree of digitization in new business models, efficient
processes, successful innovation, etc.
Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 1 Introduction
18
IT VERSUS I&T
"COBIT 2019 uses "IT" to refer to the organizational

department with the main responsibility for
technology.
COBIT 2019 focuses on the governance of

information AND technology (I&T).
The framework:
• recognizes that information and technology may reside
outside of the traditional IT department.
• encompasses all information and technology the
enterprise generates, processes and uses to achieve its
goals as well as the technology to support that
throughout the enterprise.
19
ENTERPRISE GOVERNANCE OF INFORMATION AND
TECHNOLOGY
Given the centrality of I&T for enterprise risk management and value
generation, a specific focus on enterprise governance of information
and technology (EGIT) has arisen over the last two decades.
• EGIT is an integral part of corporate governance.
• Exercised by the board that oversees the definition and implementation of
processes, structures and relational mechanisms.
• Enables both business and IT people to execute their responsibilities in
support of business/IT alignment.
• Enables creation of business value from I&T-enabled business investments.
20
20
ENTERPRISE GOVERNANCE OF INFORMATION AND TECHNOLOGY
The context of Enterprise Governance of Information and Technology

includes:
Enterprise
Business/IT Value
Governance
Alignment Creation
of IT
Good governance leads to alignment, which leads to value creation.
21
BENEFITS OF INFORMATION
AND TECHNOLOGY
GOVERNANCE
Fundamentally, EGIT is concerned with

value delivery from digital transformation
and the mitigation of business risk that
results from digital transformation. More
specifically, three main outcomes can be
expected after successful adoption of
EGIT:
• Benefits realization
• Risk optimization
• Resource optimization
22
EGIT EXAMPLE
In a large case study of an international airline company, EGIT’s benefits were

demonstrated to include:
• Lower IT-related continuity costs
• Increased IT-enabled innovation capacity
• Increased alignment between digital investments and business goals and strategy
• Increased trust between business and IT
• A shift toward a “value mindset” around digital assets
23
COBIT AS AN I&T FRAMEWORK
24
COBIT AS AN I&T FRAMEWORK
Over the years, best-practice frameworks have been developed and

promoted to assist in in understanding, designing and implementing
EGIT.
COBIT 2019 builds on and integrates more than 25 years of

development in this field.
From its foundation in the IT audit community, COBIT has developed

into a broader and more comprehensive I&T governance and
management framework.
COBIT continues to establish itself as a generally accepted

framework for I&T governance.
25
25
INTENDED AUDIENCE
Boards
Risk Executive
Managem Managem
ent ent
Internal
Stakeholders
Assuran Busines
ce s
Provider Manage
s rs
IT
Manage
rs
26
INTERNAL STAKEHOLDERS
Boards
•Provides insights on how to get value from the use of I&T and explains relevant board responsibilities.
Executive Management
•Provides guidance on how to organize and monitor performance of I&T across the enterprise.
Business Managers
•Helps to understand how to obtain the I&T solutions enterprises require and how best to exploit new technology for new strategic
opportunities.
IT Managers
•Provides guidance on how best to build and structure the IT department, manage performance of IT, run an efficient and effective
IT operation, control IT costs, align IT strategy to business priorities, etc.
Assurance Providers
•Provides guidance on how best to build and structure the IT department, manage performance of IT, run an efficient and effective
IT operation, control IT costs, align IT strategy to business priorities, etc.
Risk Management
•Helps to ensure the identification and management of all IT-related risk.
27
INTENDED AUDIENCE
Regulators
External
Stakeholders
Business
Partners
IT Vendors
28
EXTERNAL STAKEHOLDERS
Regulators
• Helps to ensure the enterprise is compliant with applicable rules and regulations and has the
right governance system in place to manage and sustain compliance.
Business Partners
• Helps to ensure that a business partner’s operations are secure, reliable and compliant with
applicable rules and regulations.
IT Vendors
• Helps to ensure that an IT vendor’s operations are secure, reliable and compliant with
applicable rules and regulations.
29
WHAT COBIT IS
COBIT is a framework for the governance and management of enterprise information and technology.
COBIT is aimed at the whole enterprise.
COBIT makes a clear distinction between governance and management.
COBIT defines the components to build and sustain a governance system.
COBIT defines the design factors that should be considered by the enterprise to build a best-fit governance
system.
COBIT addresses governance issues by grouping relevant governance components into governance and
management objectives that can be managed to the required capability levels.
30
GOVERNANCE VS MANAGEMENT
The COBIT framework makes a clear distinction

between governance and management. These
two disciplines encompass different activities,
require different organizational structures and
serve different purposes.
What would you describe as the difference

between governance and management?
31
31
Governance ensures that:

• Stakeholder needs, conditions and options are evaluated to determine balanced, agreed-on
enterprise objectives.
• Direction is set through prioritization and decision making.
• Performance and compliance are monitored against agreed-on direction and objectives.
• In most enterprises, overall governance is the responsibility of the board of directors, under the
leadership of the chairperson.
• Specific governance responsibilities may be delegated to special organizational structures at an
appropriate level, particularly in larger, complex enterprises.
32
Management plans, builds, runs and monitors activities, in alignment with the direction
set by the governance body, to achieve the enterprise objectives.
In most enterprises, management is the responsibility of the executive management,

under the leadership of the chief executive officer (CEO).
33
WHAT COBIT IS NOT
COBIT is not a full description of the whole IT

environment of an enterprise.
COBIT is not a framework to organize

business processes.
COBIT is not an (IT-)technical framework to

manage all technology.
COBIT does not make or prescribe any IT-

related decisions.
34
COBIT FORMAT AND PRODUCT ARCHITECTURE
35
COBIT OVERVIEW AND PRODUCT ARCHITECTURE
Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 4 Basic Concepts
36
COBIT OVERVIEW AND PRODUCT ARCHITECTURE
COBIT® 2019 Framework: Introduction and Methodology
COBIT® 2019 Framework: Governance and Management Objectives
COBIT® 2019 Design Guide: Designing an Information and

Technology Governance Solution
COBIT® 2019 Implementation Guide: Implementing and Optimizing an

Information and Technology
Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 4 Basic Concepts
37
MAJOR DIFFERENCES BETWEEN
COBIT 5 AND COBIT 2019
38
MAJOR DIFFERENCES
COBIT guidance uses the terms governance of

enterprise information and technology (GEIT),
enterprise governance of information and
technology (EGIT), governance of IT and IT
governance (ITG) interchangeably.
COBIT® 2019 improves on prior versions of COBIT

in the following areas:
• Flexibility and openness
• Currency and relevance
• Prescriptive application
• Performance management of IT
Reference: COBIT 2019 Framework: Introduction and Methodology, Chapter 3
39
MAJOR DIFFERENCES
Modified COBIT principles concept to include both governance systems

and governance frameworks.
Governance components replace COBIT 5 enablers.
New focus areas over which specific governance practices can be

directed.
The addition of design factors—which are used to influence the design of

an enterprise’s governance system.
40 governance and management objectives that relate to each of the 40

updated processes in COBIT.
Updated goals cascade the supports the prioritization of management

objectives based on enterprise goals.
Updated performance management which includes maturity models.
Update COBIT business case.
New and updated publications.
Reference: COBIT 2019 Framework: Introduction and Methodology
40
COBIT AND OTHER STANDARDS
41
One of the guiding principles applied throughout the

development of COBIT 2019 was to maintain the
positioning of COBIT as an umbrella framework.
This means that COBIT 2019 continues to align with
a number of relevant standards, frameworks and/or
regulations.
• COBIT does not contradict any guidance in the related
standards.
• COBIT does not copy the contents of these related
standards.
• COBIT provides equivalent statements or references to
related guidance.
Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 10 COBIT and Other Standards
42
Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 10 COBIT and Other Standards
43
TRAINING AND CERTIFICATION
44
COBIT 2019 TRAINING AND CERTIFICATE SCHEME
45
GROUP DISCUSSION QUESTIONS
46
GROUP DISCUSSION QUESTIONS
How is EGIT implemented at your organization

today?
• What are the differences between Benefits
realization, Risk optimization and Resource
optimization? Which one is receiving more
attention?
What other industry frameworks or standards are

being used?
How can COBIT assist in the distinction between

governance and management?
47
47
MODULE SUMMARY
48
MODULE 2 SUMMARY
• Enterprise Governance of I&T

• COBIT as an I&T Framework
• Intended Audience for the COBIT 2019 Framework
• COBIT Format and Product Architecture
• Major Differences between COBIT 5 and COBIT 2019
• COBIT and Other Standards
• Training and Certification
49
SAMPLE QUESTION
Which of the following best describes COBIT?

A. COBIT is a framework for the governance and management of enterprise
information and technology.
B. COBIT is a full description of the whole IT environment of an enterprise.
C. COBIT is a framework to organize business processes.
50
50
MODULE 3
PRINCIPLES
51
Topics
• Governance “System” Principles
• Governance “Framework” Principles
• Module Summary
Learning Objectives
• Understand and describe the governance “system” and governance “framework”
principles.
• Prepare for the COBIT 2019 Foundation exam.
52
GOVERNANCE “SYSTEM” PRINCIPLES
53
PRINCIPLES
COBIT® 2019 was developed based on

two sets of principles:
• Principles that describe the core
requirements of a governance system for
enterprise information and technology.
• Principles for a governance framework that
can be used to build a governance system
for the enterprise.
54
GOVERNANCE SYSTEM
PRINCIPLES
Provide
Stakeholder
Value
End-to-End Holistic
Governance Approach
There are Six Principles for a Governance System
System.
These are the core requirements for a

governance system for enterprise Tailored to
Dynamic
Governance
information and technology. Enterprise Needs
System
Governance
Distinct From
Management
55
GOVERNANCE SYSTEM
PRINCIPLES
Provide
Stakeholder
Value
End-to-End Holistic
Provide Stakeholder Value Governance Approach
System
Each enterprise needs a governance
system to satisfy stakeholder needs and
to generate value from the use of I&T.
Value reflects a balance among benefits, Tailored to
Dynamic
Governance
risks and resources, and enterprises need Enterprise Needs
System
an actionable strategy and governance
system to realize this value. Governance
Distinct From
Management
56
GOVERNANCE SYSTEM
PRINCIPLES
Provide
Stakeholder
Value
End-to-End Holistic
Governance Approach
System
Holistic Approach
A governance system for enterprise I&T is
built from a number of components that
Dynamic
can be of different types and that work Tailored to
Governance
Enterprise Needs
together in a holistic way. System
Governance
Distinct From
Management
57
GOVERNANCE SYSTEM
PRINCIPLES
Provide
Stakeholder
Value
Dynamic Governance System End-to-End Holistic

Governance Approach
A governance system should be dynamic. System
This means that each time one or more of
the design factors are changed (e.g., a
change in strategy or technology), the Dynamic
impact of these changes on the EGIT Tailored to
Governance
Enterprise Needs
system must be considered. A dynamic System
view of EGIT will lead toward a viable and
Governance
future-proof EGIT system. Distinct From
Management
58
GOVERNANCE SYSTEM
PRINCIPLES
Provide
Stakeholder
Value
End-to-End Holistic
Governance Approach
System
Governance Distinct from Management
A governance system should clearly
distinguish between governance and Dynamic
Tailored to
management activities and structures. Enterprise Needs
Governance
System
Governance
Distinct From
Management
Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 3 COBIT Principles
59
GOVERNANCE SYSTEM
PRINCIPLES
Provide
Stakeholder
Value
End-to-End Holistic
Governance Approach
System
Tailored to Enterprise Needs
A governance system should be
customized to the enterprise’s needs,
using a set of design factors as Tailored to Dynamic
parameters to customize and prioritize the Enterprise Governance
System
Needs
governance system components.
Governance
Distinct From
Management
60
GOVERNANCE SYSTEM
PRINCIPLES
Provide
Stakeholder
Value
End-to-End Holistic
Governance Approach
End-to-End Governance System System
A governance system should cover the
enterprise end to end, focusing not only
on the IT function but on all technology
Dynamic
and information processing the enterprise Tailored to
Governance
Enterprise Needs
puts in place to achieve its goals, System
regardless of its location in the enterprise.

Governance
Huygh, T.; S. De Haes; “Using the Viable System Model to Study IT Governance
Dynamics: Evidence from a Single Case Study,” Proceedings of the 51st Hawaii
Distinct From
International Conference on System Sciences, 2018 Management
61
GOVERNANCE “FRAMEWORK” PRINCIPLES
62
GOVERNANCE FRAMEWORK
PRINCIPLES
The three principles of a Based on

governance framework Conceptual
identify the underlying Model
principles for a governance
Open and
framework that can be used Flexible
to build a governance system
for the enterprise. Aligned to
Major
Standards
63
PRINCIPLES
Based on Conceptual Model Based on

A governance framework should Conceptual
be based on a conceptual model, Model
identifying the key components
and relationships among Open and
components, to maximize Flexible
consistency and allow
automation. Aligned to
Major
Standards
64
PRINCIPLES
Open and Flexible

A governance framework Based on
should be open and flexible. Conceptual
It should allow the addition Model
of new content and the
Open and
ability to address new issues Flexible
in the most flexible way,
while maintaining integrity Aligned to
and consistency. Major
Standards
65
PRINCIPLES
Based on
Aligned to Major Standards Conceptual
A governance framework Model
should align to relevant major
Open and
related standards, Flexible
frameworks and regulations.
Aligned to
Major
Standards
66
SUMMARY
67
MODULE 3 SUMMARY
Governance System Principles

• Provide Stakeholder Value
• Holistic Approach
• Dynamic Governance System
• Governance Distinct from Management
• Tailored to Enterprise Needs
• End-to-End Governance System
Governance Framework Principles

• Based on Conceptual Model
• Open and Flexible
• Aligned to Major Standards
68
SAMPLE QUESTION
What is the primary difference between Governance System Principles

and Governance Framework Principles?
A. Governance System Principles focus on stakeholder needs while
Governance Framework Principles focus on Information and Technology
(I&T) needs.
B. Governance System Principles and Governance Framework Principles
are the same thing in COBIT 2019.
C. Governance System Principles describe the core requirements for a
governance system while Governance Framework Principles focus on
building that governance system.
69
69
SAMPLE QUESTION
“A governance system should be customized to the enterprise’s needs,

using a set of design factors as parameters to customize and prioritize
the governance system components” is an example of which
Governance System Principle?
A. Tailored to enterprise needs
B. Open and flexible
C. Goals cascade
70
70
MODULE 4
GOVERNANCE SYSTEMS AND COMPONENTS
71

• Governance and management • Understand and describe the
objectives components of a governance system
• Components of the governance system • Understand the overall structure and
• Focus areas contents of the Goals Cascade
• Design factors • Prepare for the COBIT 2019 Foundation
exam
• Goals cascade
• Exercise
• Module Summary
72
GOVERNANCE AND MANAGEMENT OBJECTIVES
73
For information and technology to contribute to enterprise goals, a number of

governance and management objectives should be achieved. Basic concepts include:
• A governance or management objective always relates to one process and a series of related
components of other types to help achieve the objective.
• A governance objective relates to a governance process, while a management objective relates to
a management process.
• Governance processes typically are under the accountability of boards and executive
management; management processes are the domain of senior and middle management.
Reference: COBIT 2019 Framework: Basic Concepts: Governance Systems and Components, Chapter 4
74
Governance and management objectives in COBIT are grouped into five domains. The
domains have names with verbs that express the key purpose and areas of activity of the
objectives contained in them:
Governance
Management Objectives
Objectives
EDM APO BAI DSS MEA

Evaluate, Direct and Align, Plan and Build, Acquire and Deliver, Service and Monitor, Evaluate and
Monitor Organize Implement Support Assess
75
COMPONENTS OF THE GOVERNANCE SYSTEM
77
COMPONENTS OF A
GOVERNANCE SYSTEM
To satisfy governance and management objectives,

each enterprise needs to establish, tailor and
sustain a governance system built from a number of
components.
• Components are factors that, individually and
collectively, contribute to the good operations of the
enterprise’s governance system over I&T.
• Components interact with each other, resulting in a
holistic governance system for I&T.
• Components can be of different types, the most familiar
are processes.
78
COMPONENTS OF A GOVERNANCE SYSTEM
Processes
Services,
Infrastructu Organizatio
re and nal
Application Structures
s
Governa
nce
Culture, System Information
Ethics and Flows and
Behaviour Items
People,
Principles,
Skills and
Policies,
Competenc
Procedures
ies
79
PROCESS COMPONENT
Processes
Services,
re and nal
s
Processes describe an organized set of
practices and activities to achieve Governa
certain objectives and produce a set of nce
outputs that support achievement of Ethics and Flows and
overall IT-related goals. Behaviour Items
People,
Principles,
Skills and
Policies,
Competenc
Procedures
ies
80
ORGANIZATIONAL STRUCTURES COMPONENT
Processes
Services,
re and nal
s
Organizational structures are the key Governa

decision-making entities in an nce
enterprise. Ethics and Flows and
Behaviour Items
People,
Principles,
Skills and
Policies,
Competenc
Procedures
ies
81
INFORMATION COMPONENT
Processes
Services,
re and nal
Information is pervasive throughout any Application Structures
s
organization and includes all
information produced and used by the Governa
enterprise. COBIT focuses on nce
information required for the effective Ethics and Flows and
functioning of the governance system Behaviour Items
of the enterprise.
People,
Principles,
Skills and
Policies,
Competenc
Procedures
ies
82
PEOPLE, SKILLS AND COMPETENCIES COMPONENT
Processes
Services,
re and nal
s
People, skills and competencies are

required for good decisions, execution Governa
nce
of corrective action and successful Culture, System Information
completion of all activities. Ethics and
Behaviour
Flows and
Items
People,
Principles,
Skills and
Policies,
Competenc
Procedures
ies
83
PRINCIPLES, POLICIES AND PROCEDURES COMPONENT
Processes
Services,
re and nal
s
Principles, policies and procedures Governa

translate desired behavior into practical nce
guidance for day-to-day management. Ethics and Flows and
Behaviour Items
People,
Principles,
Skills and
Policies,
Competenc
Procedures
ies
84
CULTURE, ETHICS AND BEHAVIOR COMPONENT
Processes
Services,
re and nal
s
Culture, ethics and behavior of
individuals and of the enterprise are Governa
often underestimated as factors in the nce
success of governance and Ethics and Flows and
management activities. Behaviour Items
People,
Principles,
Skills and
Policies,
Competenc
Procedures
ies
85
SERVICES, INFRASTRUCTURES AND APPLICATIONS COMPONENT
Processes
Services,
re and nal
s
Services, infrastructure and
applications include the infrastructure, Governa
technology and applications that nce
provide the enterprise with the Ethics and Flows and
governance system for I&T processing. Behaviour Items
People,
Principles,
Skills and
Policies,
Competenc
Procedures
ies
86
COMPONENTS OF A GOVERNANCE SYSTEM
Generic components are described in the COBIT core model and

apply in principle to any situation. However, they are generic in
nature and generally need customization before being practically
implemented.
Variants are based on generic components but are tailored for a

specific purpose or context within a focus area (e.g., for information
security, DevOps, a particular regulation).
87
87
FOCUS AREAS
88
FOCUS AREAS
A focus area describes a certain governance topic, domain or

issue that can be addressed by a collection of governance
and management objectives and their components.
Examples of focus
Focus areas can contain a combination of generic areas:
governance components and variants. Small and medium
enterprises
The number of focus areas is virtually unlimited. That is what Cybersecurity
makes COBIT open-ended: New focus areas can be added Risk
as required or as subject matter experts and practitioners Cloud computing
contribute. Privacy
DevOps
89
DESIGN FACTORS
90
DESIGN FACTORS
Design factors
Design factors are factors that can influence the design of an include any
enterprise’s governance system and position it for success in combination of the
the use of I&T. following:
• The design factors are listed here and the potential impacts they Enterprise strategy
can have on the governance system are noted in Module 7, Enterprise goals
Designing a Tailored Governance System. Risk profile
• More information and detailed guidance on how to use the design IT-related issues
factors for designing a governance system can be found in the Threat landscape
COBIT® 2019 Design Guide publication. Compliance requirements
Role of IT
Sourcing model for IT
IT implementation methods
Technology adoption
strategy
Enterprise size
Future factors
91
DESIGN FACTORS
92
DESIGN FACTOR 1: ENTERPRISE STRATEGY
Enterprises can have different strategies, which can be expressed as (a combination of)
the archetypes shown below. Organizations typically have a primary strategy and, at
most, one secondary strategy.
Figure 4.5—Enterprise Strategy Design Factor

Strategy Archetype Explanation
Growth/Acquisition The enterprise has a focus on growing (revenues).
Innovation/Differentiation The enterprise has a focus on offering different and/or innovative
products and services to their clients.
Cost Leadership The enterprise has a focus on short-term cost minimization.
Client Service/Stability The enterprise has a focus on providing stable and client-oriented
service.
93
DESIGN FACTOR 2: ENTERPRISE GOALS
Figure 4.6—Enterprise Goals Design Factor

Reference Balanced Enterprise Goal
Scorecard (BSC)
Dimension
Enterprise strategy is EG01 Financial Portfolio of competitive products and services
realized by the achievement EG02 Financial Managed business risk
of (a set of) enterprise goals. EG03 Financial Compliance with external laws and regulations
These goals are defined in EG04 Financial Quality of financial information
the COBIT framework, EG05 Customer Customer-oriented service culture
structured along the EG06 Customer Business-service continuity and availability
balanced scorecard (BSC) EG07 Customer Quality of management information
dimensions. EG08 Internal Optimization of internal business process
functionality
EG09 Internal Optimization of business process costs
EG10 Internal Staff skills, motivation and productivity
EG11 Internal Compliance with internal policies
EG12 Growth Managed digital transformation programs
EG13 Growth Product and business innovation
94
DESIGN FACTOR 3: RISK PROFILE
The risk profile identifies the sort of I&T-

related risk to which the enterprise is
currently exposed and indicates which
areas of risk are exceeding the risk
appetite.
95
DESIGN FACTOR 4: I&T RELATED ISSUES
A related method for an I&T risk assessment is

for the enterprise is to consider which I&T-
related issues it currently faces, or, in other
words, what I&T-related risk has materialized.
These are the most common of such issues.
96
DESIGN FACTOR 5: THREAT LANDSCAPE
The threat landscape under which the enterprise operates can be classified as shown
below.
Figure 4.9 – Threat Landscape Design Factor

Threat Landscape Explanation
Normal The enterprise is operating under what are considered normal threat
levels.
High Due to its geopolitical situation, industry sector or particular profile, the
enterprise is operating in a high-threat environment.
97
DESIGN FACTOR 6: COMPLIANCE REQUIREMENTS
The compliance requirements to which the enterprise is subject can be classified

according to the categories below.
Figure 4.10—Compliance Requirements Design Factor

Regulatory Environment Explanation
Low compliance The enterprise is subject to a minimal set of regular compliance
requirements requirements that are lower than average.
Normal compliance The enterprise is subject to a set of regular compliance requirements that
requirements are common across different industries.
High compliance The enterprise is subject to higher-than-average compliance

requirements requirements, most often related to industry sector or geopolitical
conditions.
98
DESIGN FACTOR 7: ROLE OF IT
The role of IT for the enterprise can be classified as shown below.
Figure 4.11—Role of IT Design Factor

Role of IT Explanation
Support IT is not crucial for the running and continuity of the business process
and services, nor for their innovation.
Factory When IT fails, there is an immediate impact on the running and
continuity
of the business processes and services. However, IT is not seen as a
driver for innovating business processes and services.
Turnaround IT is seen as a driver for innovating business processes and services.
At
this moment, however, there is not a critical dependency on IT for the
current running and continuity of the business processes and services.
Strategic IT is critical for both running and innovating the organization’s business
processes
Reference: COBIT 2019 Framework: Basic Concepts: Governanceand services.
Systems and Components, Chapter 4
99
DESIGN FACTOR 8: SOURCING MODEL FOR IT
The sourcing model for IT the enterprise adopts can be classified as shown below.
Figure 4.12—Sourcing Model for IT Design Factor

Sourcing Model Explanation
Outsourcing The enterprise calls upon the services of a third party to provide IT
services.
Cloud The enterprise maximizes the use of the cloud for providing IT services
to its users.
Insourced The enterprise provides for its own IT staff and services.
Hybrid A mixed model is applied, combining the other three models in varying
degrees.
100
DESIGN FACTOR 9: IT IMPLEMENTATION METHODS
The IT implementation methods the enterprise adopts can be classified as shown below.
Figure 4.13—IT Implementation Methods Design Factor

IT Implementation Explanation
Agile The enterprise uses Agile development working methods for its
software development.
DevOps The enterprise uses DevOps working methods for software building,
deployment and operations.
Traditional The enterprise uses a more classic approach to software development
(waterfall) and separates software development from operations.
Hybrid The enterprise uses a mix of traditional and modern IT implementation,
often referred to as “bimodal IT.”
101
DESIGN FACTOR 10: TECHNOLOGY ADOPTION STRATEGY
The technology adoption strategy can be classified as shown below.
Figure 4.14—Technology Adoption Strategy Design Factor
Technology Adoption Standards Explanation
First mover The enterprise generally adopts new technologies as early

as possible and tries to gain first-mover advantage.
Follower The enterprise typically waits for new technologies to

become mainstream and proven before adopting them.
Slow adopter The enterprise is very late with adoption of new

technologies.
102
DESIGN FACTOR 11: ENTERPRISE SIZE
Two categories are identified for the design of an enterprise’s governance system. Micro-
enterprises, i.e., enterprises with fewer than 50 staff members, are not considered in this
view.
Figure 4.15—Enterprise Size Design Factor

Enterprise Size Explanation
Large enterprise (Default) Enterprise with more than 250 full-time employees (FTEs)
Small and medium enterprise Enterprise with 50 to 250 FTEs
103
GOALS CASCADE
104
GOALS CASCADE
Alignment goals emphasize the

alignment of all IT efforts with
business objectives
• There is a frequent misunderstanding
that these goals indicate purely internal
objectives of the IT department within an
enterprise.
• The goals cascade is covered in more
detail in Module 5, Governance and
Management Objectives.
105
GOALS CASCADE –ENTERPRISE GOALS
BSC BSC
REF ENTERPRISE GOAL REF ENTERPRISE GOAL
DIMENSION DIMENSION
EG01 Financial Portfolio of competitive EG08 Internal Optimization of internal
products and services business process
EG02 Financial Managed business risk functionality
EG03 Financial Compliance with external EG09 Internal Optimization of business
laws and regulations process costs
EG04 Financial Quality of financial EG10 Internal Staff skills, motivation and
information productivity
EG05 Customer Customer-oriented service EG11 Internal Compliance with internal
culture policies
EG06 Customer Business service EG12 Growth Managed digital
continuity and availability transformation programs
EG07 Customer Quality of management EG13 Growth Product and business
information innovation
106
GOALS CASCADE – ALIGNMENT GOALS
BSC BSC
REF ALIGNMENT GOAL REF ENTERPRISE GOAL
DIMENSION DIMENSION
AG01 Financial IT compliance and support for AG08 Internal Enabling and supporting
business compliance with external business processes by
laws and regulations integrating applications and
AG02 Financial Managed information- and technology
technology-related risk AG09 Internal Delivery of programs on time,
AG03 Financial Realized benefits from on budget, and meeting
information- and technology- requirements and quality
enabled investments and services standards
portfolio
AG10 Internal Quality of IT management
AG04 Financial Quality of technology-related
information
financial information
AG05 Customer Delivery of I&T services in line AG11 Internal IT compliance with internal
with business requirements policies
AG06 Customer Agility to turn business AG12 Learning and Competent and motivated staff
requirements into operational Growth with mutual understanding of
solutions technology and business
AG07 Internal Security of information, processing AG13 Learning and Knowledge, expertise and
infrastructure and applications, Growth initiatives for business
and privacy innovation
107
EXERCISE AND MODULE SUMMARY
108
GROUP EXERCISE SCENARIO
NAMECO is an IT Managed Service Provider in North America. They are an aggressive, for profit organization that strives to aggressively grow revenues while providing a
stable client base. NAMECO is considered one of the top five MSPs in the industry and operates in a high threat environment with multiple competitors who are constantly
attempting to challenge their position in the market.
With over 400 tenet clients and 15,000 end users, each one has a very unique set of compliance requirements: 1) 30% of their clients are publicly traded entities, 2) 7% are
heath care related, 3) 87% process credit cards, and 4) 6% have private information regarding EU citizens.
The enterprise risk management group has identified multiple risk scenarios that have the potential of inhibiting the aggressive growth goals identified by the governing
body. These include: 1) recruiting and maintaining qualified and skilled staff, 2) the threat of competitors, 3) complex compliance requirements from multiple requirements
(NAMECO has private information from users across the globe, including EU citizens), and 4) the unknown risks of vendors who provide critical services to NAMECO.
The IT organization also supports the company’s staff of 300 FTEs and is currently considered a “necessity” which has caused some issues. Due to the nature of its
business, NAMECO cannot continue with its strategy unless IT is seen as a key success factor. Most of the services provided by IT are a mix of insourced, cloud, and
outsourced services and IT generally adopts new technologies once they have been proven in the market. Although the organization is primarily a waterfall model for
delivery, there are two full time agile teams that support the core applications of the business. This model has worked up to this point, but there are pressures from the
business to deploy services faster.
With the aggressive growth of the company, the IT organization has experienced multiple issues that have resulted in unsatisfactory client reviews. The key concerns
include: 1) failure to meet Service Level Agreements (many of these failures are due to suppliers), 2) multiple audit findings of non-compliance of data privacy, and 3)
Insufficient IT resources/knowledge required to support the goals of the enterprise.
Other key observations include: 1) there are no documented or well-understood decision matrices in the organization, 2) policies exist, but have not been updated in the last
3 years, 3) the leadership of the organization endorse a ‘risk taking’ culture, but do not support risky decisions that fail, 4) no skills matrix exists that identifies the skills and
competencies required to support IT services, 5) an IT service catalog exists, but is not acknowledged or followed, 6) there is no formal recognition of IT processes, they
are ad hoc and not well documented, and 7) there is no real understanding of the data/information architectures or flows and there is an absence of information
classification.
109
109
GROUP EXERCISE
Using the NAMECO scenario, discuss which COBIT

Design Factors would be relevant for the governance
system of NAMECO, and identify which values you
would assign to the relevant design factors.
110
110
MODULE 4 SUMMARY
Governance and management objectives
Components of the governance system
Focus areas
Design factors
Goals cascade
111
SAMPLE QUESTION
A governance or management objective always relates to _____ and a

series of related components of other types to help achieve the
objective.
A. compliance requirements
B. one process
C. one governance framework principle
112
112
SAMPLE QUESTION
Which of the following is NOT a component of the governance system?

A. Enterprise size
B. Organizational structures
C. Information
113
113
SAMPLE QUESTION
______________ are factors that can influence the design of an

enterprise’s governance system and position it for success in the use
of I&T.
A. Components of the governance system
B. Alignment goals
C. Design factors
114
114
SAMPLE QUESTION
Which of the following is a design factor for a governance system that

supports prioritization of management objectives based on prioritization
of enterprise goals?
A. Balanced scorecard
B. Holistic approach
C. Risk Profile
115
115
MODULE 5
116

• Recall the 40 Governance and
Overview of the COBIT Core Model Management Objectives and their
• Governance and Management purpose statements.
Objectives Purpose statements • Understand the relationship between
Governance and Management Objectives
Governance and Management
and Governance Components.
Objectives Detailed Guidance
• Prepare for the COBIT 2019 Foundation
• Group Exercise Exam.
• Module Summary
117
OVERVIEW OF THE COBIT CORE MODEL
118
COBIT 2019 FRAMEWORK: GOVERNANCE AND MANAGEMENT
OBJECTIVES PUBLICATION
This publication provides a comprehensive description of the

40-core governance and management objectives defined in
the COBIT core model, the processes contained therein, other
related components, and references to related guidance such
as other standards and frameworks. This publication explains:
• The structure that is used to detail the guidance for the 40 governance and management
objectives across components.
• The appendices include more detail on the mapping tables that inform the goals cascade,
descriptions of organizational structures and a list of source references.
Reference: COBIT 2019 Framework: Governance and Management Objectives
119
COBIT CORE MODEL
Reference: COBIT 2019 Framework: Governance and Management Objectives, Chapter 1 Introduction
120
COBIT CORE MODEL
Governance
Objectives
EDM APO BAI DSS MEA

Governance objectives are grouped in the Evaluate, Direct and

Monitor (EDM) domain. In this domain, the governing body evaluates
strategic options, directs senior management on the chosen strategic
options and monitors the achievement of the strategy.
121
COBIT CORE MODEL
Governance
Objectives
EDM APO BAI DSS MEA

Align, Plan and Organize (APO) addresses the overall organization,

strategy and supporting activities for I&T.
122
COBIT CORE MODEL
Governance
Objectives
EDM APO BAI DSS MEA

Evaluate, Direct and Align, Plan and Build, Acquire Deliver, Service and Monitor, Evaluate and
Monitor Organize and Implement Support Assess
Build, Acquire and Implement (BAI) treats the definition, acquisition

and implementation of I&T solutions and their integration in business
processes.
123
COBIT CORE MODEL
Governance
Objectives
EDM APO BAI DSS MEA

Evaluate, Direct and Align, Plan and Build, Acquire Deliver, Service Monitor, Evaluate and
Monitor Organize and Implement and Support Assess
Deliver, Service and Support (DSS) addresses the operational

delivery and support of I&T services, including security.
124
COBIT CORE MODEL
Governance
Objectives
MEA
EDM APO BAI DSS
Monitor,
Evaluate, Direct and Align, Plan and Build, Acquire Deliver, Service
Monitor Organize Evaluate and
and Implement and Support
Assess
Monitor, Evaluate and Assess (MEA) addresses performance

monitoring and conformance of I&T with internal performance targets,
internal control objectives and external requirements.
125
COBIT CORE MODEL
126
COBIT CORE MODEL
Governance Objectives Management Objectives

EVALUATE, DIRECT & ALIGN, PLAN & BUILD, ACQUIRE & DELIVER, SERVICE & MONITOR, EVALUATE &
MONITOR (EDM) ORGANIZE (APO) IMPLEMENT (BAI) SUPPORT (DSS) ASSESS (MEA)
EDM01 Ensured Governance APO01 Managed I&T BAI01 Managed Programs DSS01 Managed Operations MEA01 Managed
Framework Setting Framework Performance and
BAI02 Managed DSS02 Managed Service
and Maintenance Conformance
APO02 Managed Strategy Requirements Requests & Incidents
Monitoring
EDM02 Ensured Benefits Definition
APO03 Managed Enterprise DSS03 Managed Problems
Delivery MEA02 Managed System of
Architecture BAI03 Managed Solutions
DSS04 Managed Continuity Internal Control
EDM03 Ensured Risk Identification and
APO04 Managed Innovation
Optimization Build DSS05 Managed Security MEA03 Managed
APO05 Managed Portfolio Services Compliance with
EDM04 Ensured Resource BAI04 Managed Availability
External
Optimization APO06 Managed Budget & and Capacity DSS06 Managed Business Requirements
Costs Process Controls
EDM05 Ensure Stakeholder BAI05 Managed
MEA04 Managed Assurance
Engagement APO07 Managed Human Organizational
Resources Change
APO08 Managed BAI06 Manage IT Changes
Relationships
BAI07 Manage IT Change
APO09 Managed Service Acceptance and
Agreements Transitioning
APO10 Managed Vendors BAI08 Managed Knowledge
APO11 Managed Quality BAI09 Managed Assets
APO12 Managed Risk BAI10 Managed Reference: COBIT 2019 Framework:
Configuration Governance and Management Objectives,
APO13 Managed Security Chapter 1 Introduction
BAI11 Managed Projects
APO14 Managed Data
127
PURPOSE STATEMENTS
128
OBJECTIVES AND PURPOSE STATEMENTS - EDM
Domain Name: Evaluate, Direct and Monitor

Focus Area: COBIT Core Model
Governance Objective Purpose
Name
EDM01 Provide a consistent approach integrated and aligned with the enterprise governance approach. I&T-related
Ensured Governance decisions are made in line with the enterprise’s strategies and objectives and desired value is realized. To that
Framework Setting and end, ensure that I&T-related processes are overseen effectively and transparently; compliance with legal,
Maintenance contractual and regulatory requirements is confirmed; and the governance requirements for board members are
met.
EDM02 Secure optimal value from I&T-enabled initiatives, services and assets; cost-efficient delivery of solutions and
Ensured Benefits services; and a reliable and accurate picture of costs and likely benefits so that business needs are supported
Delivery effectively and efficiently.
EDM03 Ensure that I&T-related enterprise risk does not exceed the enterprise’s risk appetite and risk tolerance, the
Ensured Risk impact of I&T risk to enterprise value is identified and managed, and the potential for compliance failures is
Optimization minimized.
EDM04 Ensure that the resource needs of the enterprise are met in the optimal manner, I&T costs are optimized, and
Ensured Resource there is an increased likelihood of benefit realization and readiness for future change.
Optimization
EDM05 Ensure that stakeholders are supportive of the I&T strategy and road map, communication to stakeholders is
Ensure Stakeholder effective and timely, and the basis for reporting is established to increase performance. Identify areas for
Engagement improvement and confirm that I&T-related objectives and strategies are in line with the enterprise’s strategy.
References: COBIT 2019 Framework Introduction and Methodology, Chapter 5
129
OBJECTIVES AND PURPOSES STATEMENTS - APO
Domain Name: Align, Plan and Organize

Management Purpose
Objective Name
APO01 Implement a consistent management approach for enterprise governance requirements to be met, covering
Managed I&T governance components such as management processes; organizational structures; roles and responsibilities;
Management reliable and repeatable activities; information items; policies and procedures; skills and competencies; culture and
Framework behavior; and services, infrastructure and applications.
APO02 Support the digital transformation strategy of the organization and deliver the desired value through a road map of
Managed Strategy incremental changes. Use a holistic I&T approach, ensuring that each initiative is clearly connected to an
overarching strategy. Enable change in all different aspects of the organization, from channels and processes to
data, culture, skills, operating model and incentives.
APO03 Represent the different building blocks that make up the enterprise and its interrelationships as well as the
Managed principles guiding their design and evolution over time, to enable a standard, responsive and efficient delivery of
Enterprise operational and strategic objectives.
Architecture
APO04 Achieve competitive advantage, business innovation, improved customer experience, and improved operational
Managed effectiveness and efficiency by exploiting I&T developments and emerging technologies.
Innovation
APO05 Optimize the performance of the overall portfolio of programs in response to individual program, product and
Managed Portfolio service performance and changing enterprise priorities and demand.
APO06 Foster a partnership between IT and enterprise stakeholders to enable the effective and efficient use of I&T-
Managed Budget related resources and provide transparency and accountability of the cost and business value of solutions and
and Costs services. Enable the enterprise to make informed decisions regarding the use of I&T solutions and services.
130
OBJECTIVES AND PURPOSE STATEMENTS - APO
Domain Name: Align, Plan and Organize

Management Objective Purpose
Name
APO07 Optimize human resources capabilities to meet enterprise objectives.
Managed Human
Resources
APO08 Enable the right knowledge, skills and behaviors to create improved outcomes, increased confidence,
Managed Relationships mutual trust and effective use of resources that stimulate a productive relationship with business
stakeholders.
APO09 Ensure that I&T products, services and service levels meet current and future enterprise needs.
Managed Service
Agreements
APO10 Optimize available I&T capabilities to support the I&T strategy and road map, minimize the risk
Managed Vendors associated with nonperforming or noncompliant vendors, and ensure competitive pricing.
APO11 Ensure consistent delivery of technology solutions and services to meet the quality requirements of the
Managed Quality enterprise and satisfy stakeholder needs.
APO12 Integrate the management of I&T-related enterprise risk with overall enterprise risk management (ERM)
Managed Risk and balance the costs and benefits of managing I&T-related enterprise risk.
APO13 Keep the impact and occurrence of information security incidents within the enterprise’s risk appetite
Managed Security levels.
APO14 Ensure effective utilization of the critical data assets to achieve enterprise goals and objectives.
Managed Data
131
OBJECTIVE AND PURPOSE STATEMENTS - BAI
Domain Name: Build, Acquire and Implement

Management Objective Name Purpose
BAI01 Realize desired business value and reduce the risk of unexpected delays, costs and value erosion. To
Managed Programs do so, improve communications to and involvement of business and end users, ensure the value and
quality of program deliverables and follow up of projects within the programs, and maximize program
contribution to the investment portfolio.
BAI02 Create optimal solutions that meet enterprise needs while minimizing risk.
Managed Requirements
Definition
BAI03 Ensure agile and scalable delivery of digital products and services. Establish timely and cost-effective
Managed Solutions solutions (technology, business processes and workflows) capable of supporting enterprise strategic
Identification and Build and operational objectives.
BAI04 Maintain service availability, efficient management of resources and optimization of system
Managed Availability and performance through prediction of future performance and capacity requirements.
Capacity
BAI05 Prepare and commit stakeholders for business change and reduce the risk of failure.
Managed Organizational
Change
BAI06 Enable fast and reliable delivery of change to the business. Mitigate the risk of negatively impacting
Managed
References:ITCOBIT
Changes the stability
2019 Framework Introduction andor integrity ofChapter
Methodology, the changed
5 environment.
132
OBJECTIVE AND PURPOSE STATEMENTS - BAI
Domain Name: Build, Acquire and Implement

BAI07 Implement solutions safely and in line with the agreed expectations and outcomes.
Managed IT Change Acceptance
and Transitioning
BAI08 Provide the knowledge and information required to support all staff in the governance and
Managed Knowledge management of enterprise I&T and allow for informed decision making.
BAI09 Account for all I&T assets and optimize the value provided by their use.
Managed Assets
BAI10 Provide sufficient information about service assets to enable the service to be effectively managed.
Managed Configuration Assess the impact of changes and deal with service incidents.
BAI11 Realize defined project outcomes and reduce the risk of unexpected delays, costs and value
Managed Projects erosion by improving communications to and involvement of business and end users. Ensure the
value and quality of project deliverables and maximize their contribution to the defined programs
and investment portfolio.
133
OBJECTIVES AND PURPOSE STATEMENTS - DSS
Domain Name: Deliver, Service and Support

DSS01 Deliver I&T operational product and service outcomes as planned.
Managed Operations
DSS02 Achieve increased productivity and minimize disruptions through quick resolution of user
Managed Service Requests and queries and incidents. Assess the impact of changes and deal with service incidents. Resolve
Incidents user requests and restore service in response to incidents.
DSS03 Increase availability, improve service levels, reduce costs, improve customer convenience and
Managed Problems satisfaction by reducing the number of operational problems, and identify root causes as part of
problem resolution.
DSS04 Adapt rapidly, continue business operations and maintain availability of resources and
Managed Continuity information at a level acceptable to the enterprise in the event of a significant disruption (e.g.,
threats, opportunities, demands).
DSS05 Minimize the business impact of operational information security vulnerabilities and incidents.
Managed Security Services
DSS06 Maintain information integrity and the security of information assets handled within business
Managed Business Process processes in the enterprise or its outsourced operation.
Controls
134
OBJECTIVE AND PURPOSE STATEMENTS - MEA
Domain Name: Monitor, Evaluate and Assess

MEA01 Provide transparency of performance and conformance and drive achievement of goals.
Managed Performance and
Conformance Monitoring
MEA02 Obtain transparency for key stakeholders on the adequacy of the system of internal controls
Managed System of Internal Control and thus provide trust in operations, confidence in the achievement of enterprise objectives
and an adequate understanding of residual risk.
MEA03 Ensure that the enterprise is compliant with all applicable external requirements.
Managed Compliance With External
Requirements
MEA04 Enable the organization to design and develop efficient and effective assurance initiatives,
Managed Assurance providing guidance on planning, scoping, executing and following up on assurance reviews,
using a road map based on well-accepted assurance approaches.
135
RELATED GUIDANCE
136
GOVERNANCE AND MANAGEMENT OBJECTIVES RELATIONSHIPS
Governance and Management Objectives

40 Governance and Management objectives are organized into five domains (Governance and
Management Domains).
Processes Governance
Components
Each Governance To satisfy
and Management Governance and
objective always Management
relates to one objectives,
process in the Governance
COBIT Core. Components are
identified (one of
these components
is Processes).
References: COBIT 2019 Governance and Management Objectives, Chapter 1
137
GOVERNANCE AND MANAGEMENT OBJECTIVES DESCRIPTIONS
Each governance and management objective is described in the following ways:
High-level
Goals Cascade Related Components Related Guidance
Information
• Domain name • Supported Alignment • Processes • Standards,
• Focus area goals • Organizational frameworks and
• Governance or • Applicable Enterprise structures compliance
management goals • Information flows and requirements
objective name • Example metrics items • Detailed reference
• description • People, skills and • Related guidance is
• Purpose statement competencies found under each of
• Policies and the applicable
frameworks components – this is
different from COBIT
• Culture, ethics and
5 where this was
behavior
applied only to the
• Services, process level.
infrastructure and
applications
138
HIGH-LEVEL INFORMATION
139
HIGH-LEVEL INFORMATION EXAMPLE
BAI06 – MANAGED IT CHANGES
140
GOALS CASCADE
Each governance or management objective supports the achievement of alignment goals

that are related to larger enterprise goals.
• Alignment goals (known as IT-related goals in COBIT 5), have a primary link to a governance or
management objective.
• Alignment goals also support higher level enterprise goals.
• Each of these types of goals also includes example metrics.
141
GOALS CASCADE EXAMPLE BAI06 – MANAGED IT CHANGES
142
GOALS CASCADE – ENTERPRISE GOALS
BSC BSC
REF ENTERPRISE GOAL REF ENTERPRISE GOAL
DIMENSION DIMENSION
EG01 Financial Portfolio of competitive EG08 Internal Optimization of internal
products and services business process
EG02 Financial Managed business risk functionality
EG03 Financial Compliance with external EG09 Internal Optimization of business
laws and regulations process costs
EG04 Financial Quality of financial EG10 Internal Staff skills, motivation and
information productivity
EG05 Customer Customer-oriented service EG11 Internal Compliance with internal
culture policies
EG06 Customer Business service EG12 Growth Managed digital
continuity and availability transformation programs
EG07 Customer Quality of management EG13 Growth Product and business
information innovation
143
GOALS CASCADE – ALIGNMENT GOALS
BSC BSC
REF ALIGNMENT GOAL REF ENTERPRISE GOAL
DIMENSION DIMENSION
AG01 Financial IT compliance and support for AG08 Internal Enabling and supporting
business compliance with external business processes by
laws and regulations integrating applications and
AG02 Financial Managed information- and technology
technology-related risk AG09 Internal Delivery of programs on time,
AG03 Financial Realized benefits from on budget, and meeting
information- and technology- requirements and quality
enabled investments and services standards
portfolio
AG10 Internal Quality of IT management
AG04 Financial Quality of technology-related
information
financial information
AG05 Customer Delivery of I&T services in line AG11 Internal IT compliance with internal
with business requirements policies
AG06 Customer Agility to turn business AG12 Learning and Competent and motivated staff
requirements into operational Growth with mutual understanding of
solutions technology and business
AG07 Internal Security of information, processing AG13 Learning and Knowledge, expertise and
infrastructure and applications, Growth initiatives for business
and privacy innovation
144
GOALS CASCADE – ENTERPRISE GOALS TO ALIGNMENT GOALS
Reference: COBIT 2019 Framework: Governance and Management Objectives, Appendix A
145
GOALS CASCADE – ALIGNMENT GOALS TO GOVERNANCE AND
MANAGEMENT OBJECTIVES
Reference: COBIT 2019 Framework: Governance and Management Objectives, Appendix B
146
ALIGNMENT WITH COMPONENTS
Processes
Services,
re and nal
s
Governa
nce
Behaviour Items
People,
Principles,
Skills and
Policies,
Competenc
Procedures
ies
147
PROCESS COMPONENT DISPLAY
148
PROCESS COMPONENT EXAMPLE
BAI06 – MANAGED CHANGES
149
CAPABILITY LEVELS
A capability level is assigned to all process activities, enabling clear definition of

processes at different capability levels.
• A process reaches a certain capability level as soon as all activities of that level are performed
successfully.
• COBIT 2019 supports a Capability Maturity Model Integration® (CMMI)‐based process-capability
scheme, ranging from 0 to 5.
• The capability level is a measure of how well a process is implemented and performing.
• This is described in Module 6, performance management.
150
RELATED GUIDANCE
The Related Guidance is updated in COBIT 2019 and refers to all standards,
frameworks, compliance requirements and other guidance that are relevant for the
process at hand.
• References to other standards and guidance are included where relevant.
• Detailed references cite specific chapters or sections within related guidance.
• A complete list of sources for the related guidance is included in Appendix C of the Governance
and Management Objectives publication.
• If no “related guidance” is listed, no applicable references are known from the sources mapped.
• The practitioner community is encouraged to suggest related guidance.
151
RELATED GUIDANCE EXAMPLE
152
Processes
Services,
re and nal
s
Governa
nce
Behaviour Items
People,
Principles,
Skills and
Policies,
Competenc
Procedures
ies
153
ORGANIZATIONAL STRUCTURES DISPLAY
The organizational structures governance component suggests levels of responsibility

and accountability for process practices.
154
ORGANIZATIONAL STRUCTURES EXAMPLE
155
ROLES AND ORGANIZATIONAL STRUCTURES
The following roles and organizational structures have been defined in the context of COBIT 2019:
Board Enterprise Risk Committee Head Architect
Executive Committee Chief Information Security Officer Head Development
Chief Executive Officer Business Process Owner Head IT Operations
Chief Financial Officer Portfolio Manager Head IT Administration
Chief Operating Officer Steering (Programs/Projects) Committee Service Manager
Chief Risk Officer Program Manager Information Security Manager
Chief Information Officer Project Manager Business Continuity Manager
Chief Technology Officer Project Management Office Privacy Officer
Chief Digital Officer Data Management Function Legal Counsel
I&T Governance Board Head Human Resources Compliance
Architecture Board Relationship Manager Audit
References: COBIT 2019 Framework: Governance and Management Objectives, Appendix B
156
RESPONSIBLE AND ACCOUNTABLE
The different levels of involvement included for these Enterprises should

structures can be divided into responsible and accountable review levels of
levels: responsibility and
• Responsible (R) roles take the main operational stake in fulfilling accountability,
the practice and create the intended outcome. Who is getting the consulted and
task done? Who drives the task? informed, and update
roles and
• Accountable (A) roles carry overall accountability. As a principle,
organizational
accountability cannot be shared. Who accounts for the success
structures in the
and achievement of the task?
chart according to
the enterprise’s
context, priorities
and preferred
terminology.
157
CONSULTED AND INFORMED
Practitioners can complete charts by adding two levels of

involvement for roles and organizational structures:
• Consulted (C) roles provide input for the practice. Who is providing
input? Since the attribution
• Informed (I) roles are informed of the achievements and/or of consulted and
deliverables of the practice. Who is receiving information? informed roles
depends on
organizational
context and
priorities, they are
not included in
COBIT 2019.
158
RELATED GUIDANCE
Where relevant, references to other standards and additional guidance are included in
the organizational structure components section.
159
RELATED GUIDANCE EXAMPLE
160
Processes
Services,
re and nal
s
Governa
nce
Behaviour Items
People,
Principles,
Skills and
Policies,
Competenc
Procedures
ies
161
INFORMATION FLOWS AND ITEMS
This component provides guidance on the information flows and items linked with
process practices. Each practice includes inputs and outputs, with indications of origin
and destination.
• Each output is sent to one or a number of destinations, typically another COBIT process practice.
• Outputs become inputs to their destinations.
• A number of outputs have many destinations and are not listed as inputs in the target processes
(for readability).
• Where relevant, references to other standards and additional guidance are included in the
information flows and items component.
162
INFORMATION FLOWS AND ITEMS COMPONENT DISPLAY
• A number of outputs have many destinations (e.g., all COBIT processes or all processes within a
domain).
• For readability reasons, these outputs are not listed as inputs in the target processes
• For some inputs/outputs, “internal” is cited as a destination if input and output are shared
between activities within the same process.
163
INFORMATION FLOWS AND ITEMS EXAMPLE
164
Processes
Services,
re and nal
s
Governa
nce
Behaviour Items
People,
Principles,
Skills and
Policies,
Competenc
Procedures
ies
165
PEOPLE, SKILLS AND COMPETENCIES COMPONENT
This component identifies human resources and skills required to achieve the
governance or management objective.
COBIT 2019 based this guidance on the Skills Framework for the Information Age
(SFIA®) V6.
Other references include:

• e-Competence Framework (e-CF) - A common European Framework for ICT Professionals in all
industry sectors - Part 1: Framework.
• The Institute of Internal Auditors’ “Core Principles for the Professional Practice of Internal
Auditing.”
166
PEOPLE, SKILLS AND COMPETENCIES COMPONENT DISPLAY
167
PEOPLE, SKILLS AND COMPETENCIES EXAMPLE
168
Processes
Services,
re and nal
s
Governa
nce
Behaviour Items
People,
Principles,
Skills and
Policies,
Competenc
Procedures
ies
169
PRINCIPLES, POLICIES AND PROCEDURES COMPONENT
This component provides detailed guidance on policies and procedures that are relevant
for the governance or management objective.
• The name of relevant policies and procedures is included, with a description of the purpose and
content of the policy.
• Where relevant, references to other standards and additional guidance are included in the
information flows and items component.
170
PRINCIPLES, POLICIES AND PROCEDURES COMPONENT DISPLAY
171
PRINCIPLES, POLICIES AND PROCEDURES EXAMPLE
172
Processes
Services,
re and nal
s
Governa
nce
Behaviour Items
People,
Principles,
Skills and
Policies,
Competenc
Procedures
ies
173
CULTURE, ETHICS AND BEHAVIOR COMPONENT
This component provides detailed guidance on desired cultural elements within the
organization that support the achievement of a governance or management objective.
• The Related Guidance cites specific chapters or sections within related guidance where more
information can be consulted.
• Where relevant, references to other standards and additional guidance are included.
174
CULTURE, ETHICS AND BEHAVIOR COMPONENT DISPLAY
175
CULTURE, ETHICS AND BEHAVIOR EXAMPLE
176
Processes
Services,
re and nal
s
Governa
nce
Behaviour Items
People,
Principles,
Skills and
Policies,
Competenc
Procedures
ies
177
SERVICES, INFRASTRUCTURE AND SERVICES COMPONENT
This component provides detailed guidance on third-party services, types of

infrastructure and categories of applications that can be applied to support the
achievement of a governance or management objective.
• Guidance is generic (to avoid naming specific vendors or products).
• Entries provide direction for enterprises to build their governance system for I&T.
178
SERVICES, INFRASTRUCTURE AND SERVICES COMPONENT
DISPLAY
179
SERVICES, INFRASTRUCTURE AND SERVICES EXAMPLE
180
PRACTICAL WALKTHROUGH
Refer to Chapter 4 in the COBIT Governance

and Management Objectives – Detailed
Guidance
181
181
EXERCISE
182
GROUP EXERCISE – GOALS CASCADE
For each Enterprise Goal, circle the appropriate Balanced Scorecard dimension.
Enterprise Goal BSC Dimension

Financial Customer Internal Growth
Portfolio of competitive products and
services
Product and business innovation
Business service continuity and availability
Optimization of business process costs
Managed digital transformation programs
Customer-oriented service culture
Managed business risk
183
GROUP EXERCISE – GOALS CASCADE
For each Alignment Goal, circle the appropriate Governance or Management Objective that has a
PRIMARY relationship.
Alignment Goal Governance and Management Objectives

APO13 EDM05 BAI05 DSS04
Quality of I&T management information
APO08 EDM01 APO02 MEA01
Knowledge, expertise and initiatives for
business innovation
EDM01 EDM04 MEA01 DSS05
Managed I&T-related risk
APO11 BAI01 APO05 MEA04
Delivery of I&T services in line with business
requirements
184
GROUP EXERCISE – GOVERNANCE AND MANAGEMENT
OBJECTIVES PURPOSE STATEMENTS
Match each purpose statement with the appropriate Governance or Management objective.
Purpose Statement Governance and Management Objective

Implement solutions safely and in line with the agreed expectations and BAI07 MEA04 APO10
outcomes. Managed IT Managed Managed
Change Assurance Vendors
Acceptance and
Transitioning
Ensure that stakeholders are supportive of the I&T strategy and road map, BAI06 EDM02 EDM05
communication to stakeholders is effective and timely, and the basis for Managed IT Ensured Benefits Ensure
reporting is established to increase performance. Identify areas for Changes Delivery Stakeholder
improvement and confirm that I&T-related objectives and strategies are in Engagement
line with the enterprise’s strategy.
Implement solutions safely and in line with the agreed expectations and BAI07 BAI10 BAI06
outcomes. Managed IT Managed Managed IT
Change Configuration Changes
Acceptance and
Transitioning
Maintain information integrity and the security of information assets handled DSS04 DSS06 BAI08
within business processes in the enterprise or its outsourced operation. Managed Managed Managed
Continuity Business Knowledge
Process Controls
185
GROUP EXERCISE – GOVERNANCE COMPONENTS
Match each description with the appropriate Governance Component as it applies to Governance
and Management Objectives.
Description Governance Component

For each practice, inputs Process Organizational Information People, Skills, Policies Culture and Services,
and outputs are identified. Structures Competencies Ethics Infrastructure
and
Applications
Based on the Skills Process Organizational Information People, Skills, Policies Culture and Services,
Framework for the Structures Competencies Ethics Infrastructure
and
Information Age, or SFIA. Applications
COBIT 2019 only suggests Process Organizational Information People, Skills, Policies Culture and Services,
responsible and accountable Structures Competencies Ethics Infrastructure
and
roles. Applications
Third-party services, types of Process Organizational Information People, Skills, Policies Culture and Services,
infrastructure and categories Structures Competencies Ethics Infrastructure
and
of applications that can be Applications
applied to support the
achievement of a
governance or management
objective.
186
GROUP SCENARIO
classification.
187
187
GROUP EXERCISE
Using information from the NAMECO scenario, use the

goals cascade to determine the most appropriate
Governance or Management Objectives.
NAMECO has determined that the two most critical

enterprise goals for the upcoming year include the
following:
• Enterprise goal 2 (EG02) Managed business risk
• Enterprise goal 3 (EG03) Compliance with external

laws and regulations
• Enterprise goal 8 (EG08) Optimization of internal

business process functionality
• Enterprise goal 10 (EG10) Staff skills, motivation and

productivity
188
188
MODULE SUMMARY
189
MODULE SUMMARY
Overview of the COBIT Core Model

• Governance and Management Objectives Purpose statements
Governance and Management Objectives Detailed Guidance
190
SAMPLE QUESTION
Governance ________ are factors that,

individually and collectively, contribute to the
good operations of the enterprise’s governance
system over I&T and were known as enablers in
COBIT 5.
A. components
B. goals
C. practices
191
191
SAMPLE QUESTION
Which two levels of involvement does COBIT

2019 identify within the updated RACI chart?
A. Consulted and informed
B. Responsible and accountable
C. Ownership and delegated
192
192
SAMPLE QUESTION
Which Governance or Management Objective

has the following purpose statement?
“Realize defined project outcomes and reduce

the risk of unexpected delays, costs and value
erosion by improving communications to and
involvement of business and end users. Ensure
the value and quality of project deliverables and
maximize their contribution to the defined
programs and investment portfolio.”
A. BAI11 Managed Projects
B. BAI02 Managed Requirements Definition
C. APO09 Managed Service Agreements
193
193
SAMPLE QUESTION
Which Governance or Management Objective

has the following purpose statement?
“Achieve competitive advantage, business

innovation, improved customer experience, and
improved operational effectiveness and efficiency
by exploiting I&T developments and emerging
technologies.”
A. APO01 Managed Service Catalog
B. APO04 Managed Innovation
C. BAI08 Managed Knowledge
194
194
SAMPLE QUESTION
Within the COBIT Goals Cascade, under which

Balanced Scorecard dimension would you find
the Enterprise Goal “Managed digital
transformation programs?”
A. Align, Plan and Organize (APO)
B. DevOps
C. Growth
195
195
MODULE 6
PERFORMANCE MANAGEMENT
196
MODULE 6 TOPICS AND OBJECTIVES
Topics Objectives
• Performance management definition, • Differentiate COBIT based performance
principles and overview management using maturity and
• Managing performance of processes capability perspectives.
• Managing Performance of Other • Prepare for the COBIT 2019 Foundation
Governance System Components exam.
• Module summary
197
PERFORMANCE MANAGEMENT DEFINITION,
PRINCIPLES AND OVERVIEW
198
COBIT PERFORMANCE MANAGEMENT
DEFINITION AND PRINCIPLES
COBIT Performance Management refers to how well the

governance and management system and all the components
of an enterprise work, and how they can be improved up to
the required level. It includes concepts and methods such as The term “COBIT
capability levels and maturity levels. COBIT 2019 is based on Performance
the following principles: Management” (CPM)
is used to describe
• Simple to understand and use these activities, and
• Consistent with, and support the COBIT conceptual model the concept is an
• Provide reliable, repeatable and relevant results integral part of the
COBIT framework.
• Must be flexible
• Should support different types of assessments
Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 6 Performance Management in COBIT
199
COBIT PERFORMANCE MANAGEMENT OVERVIEW
The CPM model largely aligns to and extends CMMI® Development 2.0 concepts:
• Process activities are associated to capability levels. This is included in the COBIT Framework:
Governance and Management Objectives guide.
• Other governance and management component types (e.g., organizational structures,
information) may also have capability levels defined for them in future guidance that ISACA may
release.
• Maturity levels are associated with focus areas (i.e., a collection of governance and management
objectives and underlying components) and will be achieved if all required capability levels are
achieved.
200
COBIT PERFORMANCE MANAGEMENT OVERVIEW
201
MANAGING PERFORMANCE OF PROCESSES
202
PROCESS CAPABILITY LEVELS
COBIT 2019 supports a CMMI-based process

capability scheme. The process within each
governance and management objective can
operate at various capability levels, ranging
from 0 to 5.
203
RATING CAPABILITY LEVELS
A capability level can be achieved to varying degrees, which can be expressed by a set of ratings.
The range of available ratings depends on the context in which the performance assessment is
made.
Some formal methods leading to independent certification use a binary pass/ fail set of ratings.
Less formal methods that are often used in performance-improvement contexts work better with a
larger range of ratings, such as the following set:
• Fully—The capability level is achieved for more than 85 percent.
• This remains a judgment call, but it can be substantiated by the examination or assessment of the
components of the enabler, such as process activities, process goals or organizational structure good
practices.
• Largely—The capability level is achieved between 50 percent and 85 percent.
• Partially—The capability level is achieved between 15 percent and 50 percent.
• Not—The capability level is achieved less than 15 percent.
204
FOCUS AREA MATURITY LEVELS
Maturity levels can be used for when a

higher level is required for expressing
performance. COBIT 2019 defines
maturity levels as a performance
measure at the focus area level.
205
MANAGING PERFORMANCE OF OTHER
GOVERNANCE SYSTEM COMPONENTS
206
MANAGING PERFORMANCE OF OTHER
GOVERNANCE SYSTEM COMPONENTS
Managing the performance of other governance system

components is also crucial. In the COBIT 2019 Framework
publication examples are provided that include the following
governance components:
• Organizational Structures Examples of
• Information Items Organizational
Structures,
• Culture and Behavior
Information Items
and Culture and
Behavior are on the
following slides.
207
PERFORMANCE MANAGEMENT OF ORGANIZATIONAL
STRUCTURES
Although no generally accepted or formal method exists for assessing organizational

structures, they can be less formally assessed according to the following criteria. For
each criterion, a number of subcriteria can be defined, linked to the various capability
levels. The criteria are:
• Successful execution of those process practices for which the organizational structure (or role)
has accountability or responsibility (an A or an R, respectively, in a responsible-accountable-
consulted-informed [RACI] chart)
• Successful application of a number of good practices for organizational structures, such as:
• Operating principles
• Composition
• Span of control
• Level of authority/decision rights
• Delegation of authority
• Escalation procedures
208
PERFORMANCE MANAGEMENT OF INFORMATION ITEMS
The information item component for a governance system of I&T is more or less
equivalent to the process work products as described in COBIT® 2019 Framework:
Governance and Management Objectives.
Although no generally accepted or formal method exists for assessing information items,
they can be less formally assessed according to the information reference model first
presented in COBIT® 5: Enabling Information.
This model defines three main quality criteria for information and 15 sub criteria, as
illustrated on the following slides.
209
210
211
212
PERFORMANCE MANAGEMENT OF CULTURE AND BEHAVIOR
For the culture and behavior governance component, it should be possible to define a set
of desirable (and/or undesirable) behaviors for good governance and management of IT,
and to assign different levels of capability to each.
COBIT® 2019 Framework: Governance and Management Objectives defines aspects of

the culture and behavior component for most objectives.
From there, it is possible to assess the extent to which these conditions or behaviors are
met.
Focus area content, which will contain a more detailed set of desired behaviors, will be
developed going forward.
The user is advised to consult isaca.org/cobit for the latest status and available focus
area guidance.
213
MODULE SUMMARY
214
MODULE 6 SUMMARY
• Performance management definition, principles and overview

• Capability vs. Maturity
• Managing performance of other governance system components
215
SAMPLE QUESTION
Which of the following is a key principle to COBIT Performance

Management (CPM)?
A. The CPM should include 5 levels of capability and maturity.
B. Assessing performance should be completed at the governance
component level only.
C. The CPM should support different types of assessments.
216
216
SAMPLE QUESTION
COBIT 2019 Performance management supports which industry-based

process capability scheme?
A. CMMI-based process capability scheme.
B. COBIT has its own capability scheme and does not support any industry-
based frameworks.
C. Skills Framework for the Information Age (SFIA).
217
217
MODULE 7
DESIGNING A TAILORED GOVERNANCE SYSTEM
218
Topics
• Introduction to designing a tailored governance system
• Impact of design factors
• Designing a tailored system
• Module summary
Objectives
• Discover how to design a tailored governance system using COBIT
• Prepare for the COBIT 2019 Foundation exam
219
INTRODUCTION TO DESIGNING
A TAILORED GOVERNANCE SYSTEM
220
INTRODUCTION TO DESIGNING A TAILORED GOVERNANCE
SYSTEM
Governance over a complex matter like information and technology requires a multitude
of components, including processes, organizational structures, information flows,
behaviors, etc.
All of these need to work together in a systemic way.
For that reason we will refer to the tailored governance solution every enterprise should
build as the ‘governance system for enterprise information & technology’, or ‘governance
system’ in short.
Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 7 Designing a Tailored Governance System
221
THE NEED FOR TAILORING
Each enterprise is distinct in many various aspects: size, sector, regulatory landscape, threat
landscape, role of IT for the organization, tactical technology related choices and others.
COBIT collectively refer to these as ‘design factors’ – covered in Module 4.
Organizations should tailor their governance system to gain the most value out of their use of
Information and Technology.
There is no unique governance system for enterprise Information and Technology that fits all.
Tailoring means that an enterprise starts from the COBIT Core model and applies changes to this
generic framework based on the relevance and importance of a series of design factors.
This process is called ‘designing the governance system for enterprise information and technology’.
222
IMPACT OF DESIGN FACTORS
223
DESIGN FACTORS
224
Management
Objective
Priority and
Target
Capability
Levels
Design factors influence in different ways

the tailoring of the governance system of Design
an enterprise. There are three different Factors
types of impacts.
Specific Focus Component

Areas Variations
225
Managem
ent
Objective
Priority
and Target
Capability Management Objective Priority and
Levels
Target Capability Levels
Design factor influence can make some governance
Desig and management objectives more important than
n others. In practice, this higher importance translates
Factor into setting higher target capability levels.
s
Specific Componen
Focus t
Areas Variations
226
Management Objective Priority and Target Capability Levels - EXAMPLES

When an enterprise identifies the most relevant enterprise goal(s) from the enterprise goal list and applies the
goals cascade, this will lead to a selection of priority management objectives. For example, when EG01
Portfolio of competitive products and services is ranked as very high by an enterprise, this will make
management objective APO05 Managed portfolio an important part of this enterprise’s governance system.
An enterprise that is very risk averse will give more priority to management objectives that aspire to govern and
manage risk and security. Governance and management objectives EDM03 Ensured risk optimization, APO12
Managed risk, APO13 Managed security and DSS05 Managed security services will become important parts of
that enterprise’s governance system and will have higher target capability levels defined for them.
An enterprise operating within a high threat landscape will require highly capable security-related processes:
APO13 Managed security and DSS05 Managed security services.
An enterprise in which the role of IT is strategic and crucial to the success of the business will require high
involvement of IT-related roles in organizational structures, a thorough understanding of business by IT
professionals (and vice versa), and a focus on strategic processes such as APO02 Managed strategy and
APO08 Managed relationships.
227
Managem
ent
Objective
Priority
and Target
Capability
Levels
Component Variations
Components are required to achieve governance and
Desig management objectives. Some design factors can
n influence the importance of one or more components or
Factor can require specific variations.
s
Specific Componen
Focus t
Areas Variations
228
Components Variation - EXAMPLES
Small and medium-sized enterprises might not need the full set of roles and organizational
structures as laid out in the COBIT core model, but may use a reduced set instead. This reduced set
of governance and management objectives and the included components is defined in the Small
and Medium Enterprise focus area (in development).
An enterprise which operates in a highly regulated environment will attribute more importance to
documented work products and policies and procedures and to some roles, e.g. the compliance
officer function.
An enterprise that uses DevOps in solution development and operations will require specific
activities, organizational structures, culture, etc., focused on BAI03 Managed solutions identification
and build and DSS01 Managed operations.
229
Managem
ent
Objective
Priority
and Target
Capability
Levels
Specific Focus Areas
Some design factors, such as threat landscape, specific
Desig risk, target development methods and infrastructure set-
n up, will drive the need for variation of the core COBIT
Factor model content to a specific context.
s
Specific Componen
Focus t
Areas Variations
230
Specific Focus Areas - EXAMPLES
Enterprises adopting a DevOps approach will require a governance system that has a variant of
several generic COBIT processes, described in the DevOps focus area guidance (in development) for
COBIT.
Small and medium enterprises have less staff, fewer IT resources, and shorter and more direct
reporting lines, and differ in many more aspects from large enterprises. For that reason, their
governance system for I&T will have to be less onerous, compared to large enterprises. This is
described in the SME focus area guidance of COBIT (in development).
231
DESIGNING A TAILORED SYSTEM
232
DESIGNING A TAILORED SYSTEM
233
MODULE SUMMARY
MODULE 7 SUMMARY
• Impact of design factors

• Designing a tailored system
235
SAMPLE QUESTION
Designing a tailored governance system will result in recommendations

for prioritizing governance and management objectives or related
governance system components, for ____________, or for adopting
specific variants of a governance system component.
A. target capability levels
B. documenting the four enabler dimensions
C. documenting the most appropriate accountabilities and responsibilities
References: COBIT 2019 Framework: Introduction and Methodology Chapter 7 Designing a Tailored Governance System COBIT 2019 Design Guide
236
236
SAMPLE QUESTION
Which of the following is the correct set of steps in the governance

system design workflow?
A. Understand the enterprise context and strategy; Determine the initial
scope of the governance system; Refine the scope of the governance
system; Conclude the governance system design.
B. What are the drivers; Where are we now; Where to we want to be; What
needs to be done; How do we get there; Did we get there; How do we
keep the momentum going.
C. Direct the governance system; Plan the governance system; Build the
governance system; Run the governance system; Monitor the governance
system.
References: COBIT 2019 Framework: Introduction and Methodology Chapter 7 Designing a Tailored Governance System COBIT 2019 Design Guide
237
237
SAMPLE QUESTION
In which stage of the Governance System Design Workflow would an

enterprise consider the current I&T-related issues?
A. Understand enterprise strategy
B. Determine the initial scope of the governance system
C. Plan program
238
238
MODULE 8
GETTING STARTED WITH COBIT: MAKING THE CASE
239
Topics
• Making a case for getting started
• Overview of the COBIT business case
• Example scenario
• Module summary
Objectives
• Explain the key points of the COBIT business case.
240
MAKING A CASE FOR GETTING STARTED
241
INTRODUCTION TO THE COBIT BUSINESS CASE
COBIT provides a nonprescriptive, generic guide to

encourage preparation of a business case.
Every enterprise has its own reasons for improving EGIT and
its own approach to preparing business cases. Common business
practices dictates
The COBIT 2019 Framework: Introduction and Methodology preparing a business
publication provides an example scenario. case to analyze and
justify the initiation
of a large project
and/or financial
investment.
Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 9 The COBIT Business Case
242
OVERVIEW OF THE COBIT BUSINESS CASE
243
THE COBIT BUSINESS CASE COMPONENTS
Executive Summary
Background
Business Challenges
•Gap Analysis and Goal
Alternatives Considered
Proposed Solution
•Phase 1. Pre-Planning
•Phase 2. Program Implementation
•Program Scope
•Program Methodology and Alignment
•Program Deliverables
•Program Risk
•Stakeholders
•Cost-Benefit Analysis
•Challenges and Success Factors
244
EXAMPLE SCENARIO
245
EXAMPLE SCENARIO – ACME CORPORATION
The example scenario is Acme Corporation, a large multinational enterprise with a mixture
of traditional, well-established business units as well as new Internet-based businesses
adopting the very latest technologies. Many of the business units have been acquired and
exist in various countries with different local political, cultural and economic environments.
The central group’s executive management team has been influenced by the latest
enterprise governance guidance, including COBIT, which they have used centrally for some
time. They want to make sure that rapid expansion and adoption of advanced IT will deliver
the value expected; they also intend to manage significant new risk. They have, therefore,
mandated enterprise wide adoption of a uniform EGIT approach. This approach includes
involvement by the audit and risk functions and internal annual reporting by business unit
management of the adequacy of controls in all entities.
246
246
GROUP SCENARIO
classification.
247
247
GROUP EXERCISE
Using information learned from the ACME sample and

the NAMECO scenario, complete a business case
section in your small groups.
248
248
MODULE SUMMARY
249
MODULE 8 SUMMARY
• Making a case for getting started

• Overview of the COBIT business case
• Example scenario
250
SAMPLE QUESTION
When developing a business case, which of the

following is an applicable reference when
deriving challenges and success factors?
A. COBIT Design Factors
B. The COBIT 2019 Implementation Guide
C. All of the above
251
251
MODULE 9
IMPLEMENTING ENTERPRISE GOVERNANCE OVER IT
252
Topics
• Implementation guide purpose and scope
• Implementation phases
• Design guide and implementation guide relationships
• Module summary
Objectives
• Understand and recall the phases of the COBIT implementation approach.
• Describe the relationships between the COBIT Design and Implementation
Guides
253
IMPLEMENTATION GUIDE PURPOSE AND SCOPE
254
IMPLEMENTATION GUIDE PURPOSE AND SCOPE
The COBIT 2019 Implementation

Guide emphasizes an enterprise-
wide view of governance of I&T. It
recognizes that I&T are pervasive
in enterprises and that it is neither
possible nor good practice to
separate business and IT-related
activities.
Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 8, Implementing Enterprise Governance of IT
255
IMPLEMENTATION LIFECYCLE
256
IMPLEMENTATION STEPS
257
PHASE 1 WHAT ARE THE DRIVERS?
Phase 1 of the implementation approach identifies current

change drivers and creates at executive management levels a
desire to change that is then expressed in an outline of a
business case.
A change driver is an internal or external event, condition or key

issue that serves as a stimulus for change. Events, trends
(industry, market or technical), performance shortfalls, software
implementations and even the goals of the enterprise can all act
as change drivers.
Risk associated with implementation of the program itself is

described in the business case and managed throughout the life
cycle.
Preparing, maintaining and monitoring a business case are

fundamental and important disciplines for justifying, supporting
and then ensuring successful outcomes for any initiative,
including improvement of the governance system. They ensure
a continuous focus on the benefits of the program and their
realization.
258
PHASE 2 WHERE ARE WE NOW?
Phase 2 aligns I&T-related objectives with

enterprise strategies and risk, and prioritizes the
most important enterprise goals, alignment goals
and processes.
The COBIT® 2019 Design Guide provides

several design factors to help with the selection.
Based on the selected enterprise and IT-related

goals and other design factors, the enterprise
must identify critical governance and
management objectives and underlying
processes that are of sufficient capability to
ensure successful outcomes.
Management needs to know its current capability

and where deficiencies may exist. This can be
achieved by a process capability assessment of
the current status of the selected processes.
259
PHASE 3 WHERE DO WE WANT TO BE?
Phase 3 sets a target for improvement

followed by a gap analysis to identify
potential solutions.
Some solutions will be quick wins and

others more challenging, long-term
tasks. Priority should be given to
projects that are easier to achieve and
likely to give the greatest benefit.
Longer-term tasks should be broken
down into manageable pieces.
260
PHASE 4 WHAT NEEDS TO BE DONE?
Phase 4 describes how to plan feasible

and practical solutions by defining
projects supported by justifiable
business cases and a change plan for
implementation. A well-developed
business case can help ensure that the
project’s benefits are identified and
continually monitored.
261
PHASE 5 HOW DO WE GET THERE?
Phase 5 provides for implementing the

proposed solutions via day-to-day
practices and establishing measures
and monitoring systems to ensure that
business alignment is achieved, and
performance can be measured.
Success requires engagement,

awareness and communication,
understanding and commitment of top
management, and ownership by the
affected business and IT process
owners.
262
PHASE 6 DID WE GET THERE?
Phase 6 focuses on sustainable

transition of the improved governance
and management practices into normal
business operations. It further focuses
on monitoring achievement of the
improvements using the performance
metrics and expected benefits.
263
PHASE 7 HOW DO WE KEEP THE MOMENTUM GOING?
Phase 7 reviews the overall success of the initiative,

identifies further governance or management
requirements and reinforces the need for continual
improvement. It also prioritizes further opportunities to
improve the governance system.
Program and project management is based on good

practices and provides for checkpoints at each of the
seven phases to ensure that the program’s performance
is on track, the business case and risk are updated, and
planning for the next phase is adjusted as appropriate. It
is assumed that the enterprise’s standard approach
would be followed.
Further guidance on program and project management

can also be found in COBIT management objectives
BAI01 Managed programs and BAI11 Managed
projects. Although reporting is not mentioned explicitly in
any of the phases, it is a continual thread through all of
the phases and iterations.
264
DESIGN GUIDE AND IMPLEMENTATION GUIDE
RELATIONSHIPS
265
DESIGN GUIDE AND IMPLEMENTATION GUIDE RELATIONSHIPS
The workflow explained in the COBIT 2019 Design Guide elaborates a set of tasks defined in the
Implementation Guide and has the following connection points:
COBIT Implementation Guide COBIT Design Guide
Phase 1
What are the drivers? Step 1 – Understand the enterprise context and
(Continuous improvement (CI) strategy
Tasks)
Step 2 – Determine the initial scope of the
Phase 2 governance system
Where are we now? Step 3 – Refine the scope of the governance system
(CI Task) Step 4 – Conclude the governance system design
Phase 3
Where do we want to be? Step 4 – Conclude the governance system design
(CI Tasks)
266
MODULE SUMMARY
267
MODULE 9 SUMMARY
• Implementation guide purpose and scope

• Implementation phases
• Design guide and implementation guide relationships
268
SAMPLE QUESTION
What is the best description of the alignment

between the COBIT Implementation and Design
Guides?
A. They both require all Governance and
Management objectives to be assessed at a high
maturity level.
B. Both approaches have seven steps, and each of
those steps aligns with each other.
C. The COBIT Design Guide primarily aligns with the
first three phases of the implementation lifecycle.
269
269
SAMPLE QUESTION
In which phase of the implementation lifecycle

would an enterprise “Define the Road Map” for
the implementation?
A. Phase 3, Where do we want to be?
B. Phase 6, Did we get there?
C. Phase 1, Assess Current State
Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 8, Implementing

Enterprise Governance of IT
270
270
MODULE 10
CLOSING
271
COURSE SUMMARY
at you have completed the course you should be able to:

Recognize the context, benefits and key reasons COBIT Understand the relationship between Governance and
is used as an information and technology governance Management Objectives and Governance Components.
framework.
Differentiate COBIT based performance management
Recognize the descriptions and purposes of the COBIT using maturity and capability perspectives.
product architecture.
Discover how to design a tailored governance system
Recall the alignment of COBIT with other applicable using COBIT.
frameworks, standards and bodies of knowledge.
Explain the key points of the COBIT business case.
Understand and describe the governance “system” and
governance “framework” principles. Understand and recall the phases of the COBIT
implementation approach.
Describe the components of a governance system.
Describe the relationships between the COBIT Design
Understand the overall structure and contents of the and Implementation Guides.
Goals Cascade.
Prepare for the COBIT 2019 Foundation exam.
Recall the 40 Governance and Management Objectives
and their purpose statements.
272
Q&A

Presentaciones Compressed

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Presentaciones Compressed

Uploaded by

Copyright:

Available Formats

Foundation Course

COBIT ® is a framework for the enterprise

This Foundation Course is intended for current

This two-day course highlights the concepts,

Recall the 40 Governance and Management Objectives

Current COBIT 5 Foundation Certificate holders who

Individuals with no previous COBIT training or

• Course Introduction • Designing a Tailored Governance System

• Governance and Management Objectives • Closing

This COBIT Foundation exam is designed to test the candidate’s

Topics Learning Objectives

In the light of digital transformation, information and

Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 1 Introduction

"COBIT 2019 uses "IT" to refer to the organizational

COBIT 2019 focuses on the governance of

Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 1 Introduction

Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 1 Introduction

The context of Enterprise Governance of Information and Technology

Good governance leads to alignment, which leads to value creation.

Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 1 Introduction

Fundamentally, EGIT is concerned with

Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 1 Introduction

In a large case study of an international airline company, EGIT’s benefits were

Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 1 Introduction

Over the years, best-practice frameworks have been developed and

COBIT 2019 builds on and integrates more than 25 years of

From its foundation in the IT audit community, COBIT has developed

COBIT continues to establish itself as a generally accepted

Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 1 Introduction

Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 1 Introduction

Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 1 Introduction

Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 1 Introduction

Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 1 Introduction

COBIT is aimed at the whole enterprise.

COBIT makes a clear distinction between governance and management.

COBIT defines the components to build and sustain a governance system.

Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 1 Introduction

The COBIT framework makes a clear distinction

What would you describe as the difference

Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 1 Introduction

Governance ensures that:

Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 1 Introduction

In most enterprises, management is the responsibility of the executive management,

Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 1 Introduction

COBIT is not a full description of the whole IT

COBIT is not a framework to organize

COBIT is not an (IT-)technical framework to

COBIT does not make or prescribe any IT-

Reference: COBIT 2019 Framework: Introduction and Methodology Chapter 1 Introduction

COBIT® 2019 Framework: Introduction and Methodology

COBIT® 2019 Framework: Governance and Management Objectives

COBIT® 2019 Design Guide: Designing an Information and

COBIT® 2019 Implementation Guide: Implementing and Optimizing an

COBIT guidance uses the terms governance of

COBIT® 2019 improves on prior versions of COBIT

Reference: COBIT 2019 Framework: Introduction and Methodology, Chapter 3

Modified COBIT principles concept to include both governance systems

Governance components replace COBIT 5 enablers.

New focus areas over which specific governance practices can be

The addition of design factors—which are used to influence the design of

40 governance and management objectives that relate to each of the 40

Updated goals cascade the supports the prioritization of management

Updated performance management which includes maturity models.

Update COBIT business case.