COBIT-2019 COBIT 2019 Foundation Questions and Answers

 A capability maturity model is a tool that assesses how well a process is implemented and performing at a given level, ranging from 0 (non-existent) to 5 (optimized). Each level defines a set of attributes that describe the characteristics of the process at that level, such as process performance, process documentation, process control, process measurement, etc.  The model is based on the COBIT 2019 Process Assessment Model 4 , page 11.  References:   4 : COBIT 2019 Process Assessment Model | Digital | English

The principle that the governance framework should allow for flexibility in addressing new issues is an important principle of a proper governance framework. A governance framework is a conceptual model or structure that defines the key elements, relationships, and principles of a governance system. A proper governance framework should follow certain principles or guidelines that ensure its effectiveness, efficiency, and alignment with the enterprise goals and objectives.  The principle that the governance framework should allow for flexibility in addressing new issues is an important principle of a proper governance framework because it helps to ensure that the governance system can adapt to changes in the internal or external environment, stakeholder needs, business objectives, etc. 1 3   References:   COBIT 2019 Framework: Introduction and Methodology ,  COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution

The best way to determine whether IT governance is achieving intended outcomes one year after implementation is to evaluate performance measurements identified in the business case. The business case is a document that defines the objectives, benefits, costs, risks, and success factors of IT governance implementation, and specifies the key performance indicators (KPIs) and target values that will be used to measure and monitor the outcomes. By comparing the actual performance results with the expected results, the enterprise can assess the effectiveness and efficiency of IT governance and identify any gaps or issues that need to be addressed.  The way is based on the COBIT 2019 Implementation Guide 1 , page 32.  References:   1 : COBIT 2019 Implementation Guide | Digital | English

 The COBIT principle that addresses the need to consider how changes in technology or strategy impact the enterprise governance system as a whole is that a governance system should be dynamic.  This principle states that “a governance system should be responsive to changing stakeholder needs, conditions and options; adaptable to changing circumstances; able to learn from experience; and innovative in supporting continual improvement”  4 .  A dynamic governance system can anticipate and respond to changes in the internal and external environment, such as new technologies, business models, risks, or opportunities 5 .  References:   4 : COBIT 2019 Framework: Introduction and Methodology, page 23  5 : COBIT 2019 Framework: Governance and Management Objectives, page 20

The enterprise’s risk profile is the most important enterprise risk management concept to fully understand prior to finalizing the design of an IT governance system. Enterprise risk management is the process of identifying, analyzing, evaluating, treating, monitoring, and communicating risks that affect the achievement of enterprise objectives. Enterprise risk management concepts include risk appetite (the amount and type of risk that an enterprise is willing to accept), risk tolerance (the acceptable variation in outcomes related to specific performance measures), risk profile (the overall exposure or level of risk that an enterprise faces), etc.  The enterprise’s risk profile is the most important concept to fully understand prior to finalizing the design of an IT governance system because it helps to determine the appropriate level of risk optimization for each governance objective. 1 4   References:   COBIT 2019 Framework: Introduction and Methodology ,  COBIT 2019 Framework: Governance System

In the COBIT framework, adapting components with related documentation, including inputs and outputs, is primarily associated with " Process activities. " Each governance and management objective within COBIT is supported by detailed processes that encompass specific activities. These activities are meticulously documented, outlining the necessary inputs required to execute them and the expected outputs resulting from their execution.

Process Activities: These are detailed tasks or actions within a process designed to achieve a specific purpose. For each activity, COBIT provides comprehensive documentation that includes:

Inputs: Resources, information, or prerequisites needed to perform the activity.

Outputs: The results, deliverables, or outcomes produced by the activity.

This structured documentation ensures that enterprises can effectively implement and tailor COBIT processes to align with their unique requirements. By referring to process activities, organizations gain access to the necessary guidance on what is needed to perform each task and what should be achieved upon its completion.

Option A, " Process practices, " refers to broader guidelines or best practices for processes but does not provide the granular level of detail concerning specific inputs and outputs.

Option B, " Goals and metrics, " pertains to the objectives and performance indicators used to measure success and effectiveness, rather than the detailed documentation of process execution.

Therefore, for enterprises aiming to adapt COBIT components with detailed documentation on inputs and outputs, " Process activities " serve as the most pertinent reference.

According to the COBIT 2019 Process Assessment Model, one of the prerequisites for determining performance measures for a process improvement initiative is to perform a process risk assessment. A process risk assessment identifies and evaluates the potential threats and opportunities that may affect the achievement of process objectives.  A process risk assessment also helps to prioritize improvement actions based on their impact and likelihood. 4 , p.  11-12  References:   4 : COBIT 2019 Process Assessment Model: Using COBIT 2019

 Culture, ethics and behavior are the most likely components of a governance system to be underestimated as factors in the success of governance and management activities. Culture, ethics and behavior are the shared values, beliefs, norms, and attitudes that influence how people behave and interact within an enterprise. They affect the motivation, commitment, collaboration, and performance of people, as well as the trust and reputation of the enterprise.  Culture, ethics and behavior are one of the seven enablers of a governance system, as defined by COBIT. 1 2   References:   COBIT 2019 Framework: Introduction and Methodology ,  COBIT 2019 Framework: Governance System

The primary objective of implementing the process of managed innovation is to improve customer experience by identifying and realizing new opportunities for business value creation from information and technology. This process involves scanning the external environment for emerging trends and technologies, engaging with stakeholders to understand their needs and expectations, evaluating and prioritizing innovative ideas, and executing and monitoring innovation initiatives.  The process is based on the COBIT 2019 Design Guide 1 , page 75.  References:   1 : COBIT 2019 Design Guide | Digital | English

COBIT 2019 explicitly states—when describing the COBIT publication set—that the “Governance and Management Objectives” publication includes references to other standards and frameworks.

Exact Extract (COBIT 2019 Framework: Introduction and Methodology):

“COBIT® 2019 Framework: Governance and Management Objectives—Describes the core COBIT governance and management objectives, their purpose statements and related guidance. This guide also references other standards and frameworks. ”

This is further confirmed in the Implementation Guide’s overview of the COBIT publications:

Exact Extract (COBIT 2019 Implementation Guide):

“COBIT® 2019 Framework: Governance and Management Objectives … This guide also references other standards and frameworks. ”

Therefore, the correct answer is B. COBIT 2019 Framework: Governance and Management Objectives .

Providing clear definition of the processes and required activities facilitates the achievement of different capability levels in COBIT core model. Processes are structured sets of activities that produce outputs or outcomes for achieving specific objectives. Activities are specific tasks or actions that contribute to achieving a process outcome or objective. Processes and activities are defined by their inputs, outputs, roles, responsibilities, controls, etc.  Providing clear definition of processes and activities helps to ensure that they are performed consistently, effectively, efficiently, and reliably, which leads to higher capability levels. 1 2   References:   COBIT 2019 Framework: Introduction and Methodology ,  COBIT 2019 Framework: Governance and Management Objectives

COBIT 2019 lists the alignment goals and shows how each aligns to an IT balanced scorecard (IT BSC) dimension . In the COBIT goals cascade table for alignment goals, AG12 is explicitly placed under the Learning and Growth dimension.

Exact Extract (COBIT 2019 Framework: Introduction and Methodology — Goals Cascade, Alignment Goals and Metrics):

“ AG12 Learning and Growth — Competent and motivated staff with mutual understanding of technology and business …”

In the same table, the other answer options are shown under different IT BSC dimensions:

“Realized benefits from I & T-enabled investments and services portfolio” is listed under the Financial dimension (AG03).

“Delivery of I & T services in line with business requirements” is listed under the Customer dimension (AG05).

Therefore, the alignment goal in the Learning and Growth dimension is C. Competent and motivated staff with mutual understanding of technology and business (AG12) .

The business case outline is a document that provides a high-level overview of the rationale, objectives, scope, approach, benefits, costs, risks, and timeline of the EGIT implementation program. The EGIT implementation program is a program that involves designing and implementing a governance system for an enterprise using COBIT 2019. The business case outline provides the basis for obtaining approval in principle from the stakeholders for initiating the EGIT implementation program. The business case outline is a key input to be considered when defining drivers for a COBIT implementation. The drivers are the internal and external factors that trigger or influence the need for designing and implementing a governance system for an enterprise using COBIT 2019. The drivers include aspects such as business strategy objectives performance risks issues opportunities etc., information and technology strategy objectives performance risks issues opportunities etc., stakeholder needs expectations requirements etc., standards guidelines regulations best practices etc., market conditions competitive pressures customer demands etc., etc. By considering the business case outline when defining drivers for a COBIT implementation an enterprise can ensure that it has a clear understanding of why it needs to design and implement a governance system using COBIT 2019 what are the expected outcomes benefits value etc.,

The value that I & T delivers should be aligned directly with the values on which the business is focused. This is based on the principle of alignment, which states that “governance of enterprise I & T should ensure that I & T-enabled investments are aligned with the enterprise strategy and deliver the expected benefits” . Value delivery is not only about maintaining or increasing value from existing I & T investments, but also about ensuring that new investments support the strategic objectives and stakeholder needs of the enterprise.

The different levels of involvement associated with roles and organizational structure are primarily divided into responsibility and accountability levels. Responsibility and accountability are two key concepts that define the degree of involvement and authority that a role has in performing a task or process. Responsibility means performing or overseeing a task or process, while accountability means being answerable for the outcome or result of a task or process.  COBIT uses a RACI chart to assign different levels of responsibility and accountability to roles and organizational structures for each governance and management objective. 1 3   References:   COBIT 2019 Framework: Introduction and Methodology ,  COBIT 2019 Framework: Roles, Responsibilities & RACI Charts

 The enterprise strategy archetype is a design factor that describes how an enterprise uses information and technology to achieve its goals and objectives. There are six enterprise strategy archetypes defined in COBIT 2019: growth/acquisition; operational excellence; customer intimacy; product leadership; data-driven; innovation-driven. Each archetype has different implications for the governance and management of information and technology in terms of focus areas processes practices roles structures,and metrics. The enterprise strategy archetype that is focused on increasing revenues is growth/acquisition. Growth/acquisition is a strategy archetype that emphasizes expanding market share revenue customer base or product range through organic growth or acquisition of other businesses or assets. This strategy archetype requires effective portfolio management of information and technology investmentsand initiatives that support business growth or acquisition objectives.  Portfolio management involves selecting prioritizing balancing monitoring evaluating,and optimizing informationand technology investmentsand initiatives based on their alignment with business strategy value delivery potential risk exposure resource availability interdependencies etc.Portfolio management also involves ensuring that informationand technology investmentsand initiatives are integrated with business processes systems structures culture etc especially in case of mergers or acquisitions. 5   References:   5 : COBIT 2019 Design Guide: page 35-36 : COBIT 2019 Process Reference Guide: page 59-61

The primary target audience for COBIT is business and IT management responsible for building and deploying I & T solutions.  COBIT is designed to help these managers address the challenges of aligning I & T with business goals, delivering value from I & T, managing I & T risks, optimizing I & T resources, and measuring I & T performance 5 . COBIT provides a comprehensive and flexible framework that can be adapted to different contexts and situations.  COBIT also helps to establish a common language and understanding among business and IT stakeholders 6 .  References:   5 : COBIT 2019 Framework: Introduction and Methodology, page 15  6 : COBIT 2019 Framework: Introduction and Methodology, page 25

The alignment goal titled “Delivery of IT services in line with business requirements” is most likely to be associated with the metric “percent of IT services with defined operational costs and expected benefits”. This metric measures the extent to which IT services are aligned with business needs and expectations, and deliver value for money. The alignment goal is one of the 17 enterprise goals defined in COBIT 2019, which describe the outcomes that an enterprise wants to achieve from its use of information and technology.  The alignment goal is based on the COBIT 2019 Framework 4 , page 36.  References:   4 : COBIT 2019 Framework | Digital | English

The size of the enterprise is a design factor that describes the scale or magnitude of an enterprise’s information and technology activities in terms of aspects such as number of employees, customers, locations, products, services, processes, systems, data, etc. The size of the enterprise influences the governance and management of information and technology in terms of the level of complexity, diversity, variability, standardization, centralization, decentralization, etc., that are required for its information and technology activities. The key benefit of considering the size of the enterprise when designing governance is targeting capability levels of governance and management objectives. The capability levels are a measure of how well an enterprise performs its information and technology governance and management processes in terms of process attributes such as process performance, process definition, process deployment, process measurement, process control, process optimization, etc. The capability levels range from 0 (incomplete) to 5 (optimizing), indicating the degree of maturity and effectiveness of an enterprise’s information and technology governance and management processes. The governance and management objectives are the statements of what an enterprise wants to achieve in terms of its information and technology governance. The governance and management objectives are derived from the enterprise goals, which are the high-level statements of what an enterprise wants to achieve in terms of its mission, vision, values, strategy, etc. By considering the size of the enterprise when designing governance, an enterprise can target capability levels of governance and management objectives that are appropriate for its scale and magnitude of information and technology activities.  This will also help to optimize its information and technology performance and value delivery 1 2   References:   1 : COBIT 2019 Design Guide: page 47-48  2 : COBIT 2019 Process Assessment Model: page 11-13

The initial scope of a governance system is the extent and boundaries of the governance system that an enterprise intends to design and implement using COBIT 2019. The initial scope helps to define the focus and direction of the governance system design process, as well as the resources and efforts required for its implementation. One of the key considerations when determining the initial scope of a governance system is the compliance requirements faced by the enterprise. The compliance requirements are the laws, regulations, standards, guidelines, contracts, or agreements that an enterprise must comply with regarding its information and technology activities. The compliance requirements influence the level of control and assurance that an enterprise needs to demonstrate its adherence to the applicable rules and obligations. By considering the compliance requirements when determining the initial scope of a governance system, an enterprise can ensure that its governance system is appropriate for its context and objectives, and that it can effectively manage the potential impacts of non-compliance on its reputation, performance, value, and stakeholder trust.

The industry sector is a design factor that describes the type of business or economic activity that an enterprise engages in. The industry sector influences the governance and management of information and technology in terms of the specific standards, guidelines, regulations, best practices, challenges, opportunities, etc., that are applicable or relevant for that sector. The industry sector that can be characterized by a low level of regulation and a high level of focus on cost is nonprofit enterprises. Nonprofit enterprises are organizations that operate for a social or environmental purpose rather than for profit. Nonprofit enterprises typically have a low level of regulation compared to other sectors such as financial, health care, public, etc., which have more stringent and complex compliance requirements regarding their information and technology activities. Nonprofit enterprises also have a high level of focus on cost, as they have limited resources and funding, and they need to optimize their spending and demonstrate their accountability and transparency to their donors, beneficiaries, partners, etc. Therefore, nonprofit enterprises need to ensure that their information and technology governance system is efficient, effective, and value-driven.

 The Build, Acquire and Implement (BAI) domain deals with the definition of IT solutions and their integration in business processes. This domain covers the activities related to identifying, developing, acquiring, implementing, testing, integrating, and deploying IT solutions that meet business requirements.  The BAI domain consists of 10 management objectives that describe the desired outcomes of these activities. 1 4   References:   COBIT 2019 Framework: Introduction and Methodology ,  COBIT 2019 Framework: Governance and Management Objectives

 A process can meet a higher capability level if all activities of that level are successfully performed, in addition to the activities of lower levels.  The capability levels range from 0 (incomplete) to 5 (optimizing), and each level has a set of generic attributes that describe the expected performance of the process activities 2 , p.  30.  References:   2 : COBIT 2019 Framework: Introduction and Methodology

According to the COBIT 2019 Implementation Guide, the best way for senior leadership to communicate its expectations for IT governance prior to commencing a governance implementation plan is to include a scope statement in the business case. The scope statement defines the boundaries and objectives of the IT governance system, as well as the roles and responsibilities of the stakeholders involved.  The scope statement also provides clarity and alignment on what is expected from IT governance and how it will support the enterprise strategy. 2 , p.  25-26  References:   2 : COBIT 2019 Implementation Guide: Implementing an Information and Technology Governance Solution

The primary role of business leadership when defining the future state in a business case is to assess proposed solutions against goals. The business case is a document that defines the objectives, benefits, costs, risks, and success factors of IT governance implementation, and proposes one or more solutions that can deliver the desired outcomes. Business leadership is responsible for evaluating the feasibility, viability, and desirability of each solution, as well as ensuring alignment with the enterprise’s strategic direction and stakeholder expectations.  The role is based on the COBIT 2019 Implementation Guide 4 , page 31.  References:   4 : COBIT 2019 Implementation Guide | Digital | English

People, skills and competencies are required for good decisions, execution of corrective actions, and successful completion of all activities. This component acts as a primary driver for corrective actions, making it essential for achieving governance or management objectives.

 An element of governance is evaluating stakeholder needs to determine enterprise objectives.  This is based on the principle of stakeholder value, which states that “governance of enterprise I & T should ensure that stakeholder needs, conditions and options are evaluated to determine balanced, agreed-on enterprise objectives to be achieved; setting direction through prioritization and decision making; and monitoring performance and compliance against agreed-on direction and objectives”  1 .  Evaluating stakeholder needs involves identifying who the stakeholders are, what their interests and expectations are, and how they can influence or be influenced by the enterprise’s activities 2 .  References:   1 : COBIT 2019 Framework: Introduction and Methodology, page 23  2 : COBIT 2019 Framework: Governance and Management Objectives, page 18

The number of business processing hours lost due to unplanned service interruptions would be an appropriate metric associated with an enterprise goal of business service continuity and availability. A metric is a quantifiable measure that is used to track and assess the status of a specific process or activity. Business service continuity and availability is one of the 17 generic enterprise goals defined by COBIT that describes the desired outcome of ensuring that critical business services are delivered at agreed levels and are resilient to disruptions.  The number of business processing hours lost due to unplanned service interruptions is a metric that reflects how well this outcome is achieved. 1 3   References:   COBIT 2019 Framework: Introduction and Methodology ,  COBIT 2019 Framework: Governance and Management Objectives

 A due diligence review is a process that involves conducting a comprehensive analysis and assessment of an enterprise’s information and technology assets, capabilities, risks, issues, opportunities, etc., before making a significant decision or transaction. A due diligence review helps to ensure that an enterprise has a clear understanding of the current state and potential impacts of its information and technology activities on its strategy, objectives, performance, value, etc., as well as on its compliance with relevant laws, regulations, standards, guidelines, contracts, or agreements. It is critical to perform a due diligence review following a merger, acquisition, or divestiture event. A merger is an event that involves combining two or more enterprises into one entity. An acquisition is an event that involves one enterprise purchasing another enterprise or its assets. A divestiture is an event that involves one enterprise selling or transferring part of its business or assets to another enterprise.  By performing a due diligence review following a merger acquisition or divestiture event an enterprise can ensure that it has identified and addressed any information and technology related risks issues gaps etc., that may arise from the integration or separation of information and technology assets capabilities processes systems structures culture etc., that it has aligned its information and technology governance and management with its new strategy objectives needs expectations etc., that it has optimized its information and technology performance and value delivery etc 3 4   References:   3 : COBIT 2019 Framework: Governance and Management Objectives: page 20-21  4 : COBIT 2019 Design Guide: page 47-48

The strategy archetype is a design factor that describes how an enterprise uses information and technology to achieve its goals and objectives. There are six strategy archetypes defined in COBIT 2019: customer intimacy, product leadership, operational excellence, compliance-driven, data-driven, and innovation-driven. Each archetype has different implications for the governance and management of information and technology in terms of focus areas, processes, practices, roles, structures, and metrics. The best approach when determining which strategy archetype most closely aligns with an enterprise’s own strategy is to select the one that reflects the enterprise’s information and technology risk profile, which is another design factor that describes how an enterprise identifies, assesses, responds to, monitors, and reports on information and technology risks. The risk profile helps to determine the level of risk appetite and tolerance that an enterprise has for its information and technology activities, as well as the level of control and assurance that is required for its governance framework.  By selecting the strategy archetype that matches the risk profile, an enterprise can ensure that its governance framework is appropriate for its context and objectives 5   References:   5 : COBIT 2019 Design Guide, page 35-39 : COBIT 2019 Design Guide, page 41-43

 The Align, Plan and Organize (APO) domain incorporates managed risk as one of its management objectives. The APO domain covers the activities related to aligning IT strategy with business strategy, planning IT resources and capabilities, organizing IT governance structures and processes, managing IT performance, innovation, risk, quality, human resources, security, information, services, etc.  The APO domain consists of 13 management objectives that describe the desired outcomes of these activities. 1 4   References:   COBIT 2019 Framework: Introduction and Methodology ,  COBIT 2019 Framework: Governance and Management Objectives

COBIT 2019 explicitly states that enterprise goals are defined in the COBIT framework and are structured along the balanced scorecard (BSC) dimensions .

Exact Extract (COBIT 2019 Framework: Introduction and Methodology):

“These goals are defined in the COBIT framework, structured along the balanced scorecard (BSC) dimensions , and include the elements shown in figure 4.6.”

This is also reinforced in the COBIT 2019 Design Guide, using the same wording when describing the enterprise goals design factor.

Exact Extract (COBIT 2019 Design Guide):

“These goals are defined in the COBIT framework, structured along the balanced scorecard (BSC) dimensions , and include the following (figure 2.6)…”

Therefore, the correct choice is C. Balanced scorecard .

The change enablement tasks are the tasks that involve preparing for managing and sustaining the changes that are required for implementing a governance system for an enterprise using COBIT 2019. The change enablement tasks help to ensure that the changes are aligned with the enterprise’s strategy objectives needs expectations etc., that they deliver value and benefits to the enterprise and its stakeholders that they overcome resistance and barriers to change that they create a culture of continuous improvement etc. One of the key change enablement tasks that must be completed during the driver identification phase of an IT initiative is identify the business and governance drivers. The driver identification phase is the first phase of the governance implementation roadmap which involves identifying and analyzing the internal and external factors that trigger or influence the need for designing and implementing a governance system for an enterprise using COBIT 2019. The business drivers are the factors that relate to the enterprise’s business strategy objectives performance risks issues opportunities etc., such as market conditions customer demands competitive pressures regulatory requirements etc. The governance drivers are the factors that relate to the enterprise’s information and technology governance strategy objectives performance risks issues opportunities etc., such as IT alignment IT value delivery IT risk management IT resource management IT performance measurement etc. By identifying the business and governance drivers during the driver identification phase an enterprise can establish a clear understanding of why it needs to design and implement a governance system using COBIT 2019 what are the expected outcomes benefits value etc., from doing so who are the relevant stakeholders their roles responsibilities requirements expectations etc., how to communicate engage involve them in the change process etc.

The organizational structures component of the governance system are the key decision-making entities in an enterprise. Organizational structures are the arrangements of roles and responsibilities that enable the enterprise to achieve its objectives. Organizational structures can be formal or informal, hierarchical or flat, centralized or decentralized, etc. Organizational structures can include entities such as board, executive management, committees, forums, teams, units, etc.  The organizational structures component of the governance system are the key decision-making entities in an enterprise by providing authority, accountability, direction, oversight, evaluation, etc., for information and technology. 1 3   References:   COBIT 2019 Framework: Introduction and Methodology ,  COBIT 2019 Framework: Roles, Responsibilities & RACI Charts

Enterprise strategy cascades to enterprise goals within the COBIT goals cascade. The COBIT goals cascade is a mechanism that helps enterprises to align their governance objectives with their stakeholder needs. It consists of four levels: stakeholder drivers, enterprise goals, alignment goals, and governance and management objectives. Enterprise strategy is the high-level direction and guidance that defines how the enterprise will achieve its vision and mission. Enterprise goals are the specific targets or outcomes that the enterprise sets to achieve its vision and mission.  Enterprise strategy cascades to enterprise goals through a process of analysis, prioritization, and validation. 1 2   References:   COBIT 2019 Framework: Introduction and Methodology ,  COBIT 2019 Framework: Governance System

The internal audit function is an independent and objective assurance and consulting activity that evaluates and improves the effectiveness of governance, risk management, and control processes in an enterprise. The internal audit function has a role in defining the EGIT target state, which is the desired state of information and technology governance in an enterprise that is aligned with its strategy, objectives, and stakeholder needs. The role of the internal audit function in this process is to provide advice and assist with target-state positioning and gap priorities. This means that the internal audit function can help to identify the current state of information and technology governance in an enterprise, assess the gaps and issues that need to be addressed, determine the target state of information and technology governance that is optimal for the enterprise, and prioritize the actions and initiatives that are required to achieve the target state. The internal audit function can also provide assurance on the design and implementation of the EGIT target state by evaluating its adequacy, effectiveness, efficiency, and compliance.

The enterprise goal of compliance with external laws and regulations is aligned to the financial dimension of the balanced scorecard (BSC). The BSC is a strategic performance management tool that helps enterprises to translate their vision and strategy into operational objectives and measures. The BSC consists of four dimensions: financial, customer, internal, and growth. The financial dimension focuses on the financial performance and value creation of the enterprise.  Compliance with external laws and regulations is one of the 17 generic enterprise goals defined by COBIT that supports the financial dimension. 1 2   References:   COBIT 2019 Framework: Introduction and Methodology ,  COBIT 2019 Framework: Governance and Management Objectives

The management objective BAI11 Managed Projects involves ensuring that IT-enabled change initiatives are delivered on time, within budget, and in accordance with stakeholder expectations. This management objective covers the activities of initiating, planning, executing, monitoring, controlling, and closing IT projects, as well as managing project risks, issues, quality, scope, resources, communications, and stakeholders. This management objective is best for the consultant to recommend for developing a governance and management system that can address the issue of multiple IT-enabled change initiatives frequently being delivered late and failing to meet business needs.  By applying this management objective, the enterprise can improve its project governance and management capabilities, ensure alignment of IT projects with business strategy and objectives, enhance project performance and outcomes, and increase stakeholder satisfaction and value realization 1 2   References:   1 : COBIT 2019 Process Reference Guide: Governance and Management Objectives, page 77-79  2 : COBIT 2019 Implementation Guide: page 49-50

 According to the COBIT 2019 Framework: Introduction and Methodology, a maturity level is a performance measure that is used to assess a specific focus area. A focus area is a topic that is relevant for governance and management of enterprise information and technology (I & T), such as cybersecurity, privacy or digital transformation. A maturity level indicates the extent to which a focus area is implemented and integrated in the enterprise’s governance system.  There are six maturity levels defined in COBIT 2019, ranging from 0 (incomplete) to 5 (optimized). 3 , p.  77-78  References:   3 : COBIT 2019 Framework: Introduction and Methodology

 An enterprise goal is a high-level statement of what the enterprise wants to achieve, aligned with the mission, vision and values of the enterprise.  Portfolio of competitive services is an enterprise goal that would most likely be evaluated by using a metric “percent of services that meet or exceed targets in revenues and market share”, as it reflects the need to offer products and services that are attractive to customers and differentiate the enterprise from its competitors 2 , p.  17.  References:   2 : COBIT 2019 Framework: Governance and Management Objectives

The risk profile is a design factor that describes how an enterprise identifies, assesses, responds to, monitors, and reports on information and technology risks. The risk profile helps to determine the level of risk appetite and tolerance that an enterprise has for its information and technology activities, as well as the level of control and assurance that is required for its governance framework. When tailoring COBIT 2019 to enterprise requirements, the primary objective of preparing a risk profile is to identify areas of risk that exceed risk appetite. The risk appetite is the amount and type of risk that an enterprise is willing to accept in pursuit of its objectives. The risk appetite provides a basis for defining the risk criteria, thresholds, indicators, and responses that will be used in the risk profile process. By identifying areas of risk that exceed risk appetite, an enterprise can prioritize its governance objectives, processes, practices, roles, structures, and metrics according to the level of risk exposure and impact. This will also help to align the governance framework with the enterprise’s strategy and objectives.

 A quantitative approach involves numeric mapping tables created for each of the design factors. According to the COBIT 2019 Design Guide, a quantitative approach is one of the four possible approaches for designing a governance system based on the design factors. A design factor is a characteristic of the enterprise that influences how the governance system should be designed. A quantitative approach uses numeric values to represent the impact of each design factor on the governance components, such as processes, organizational structures, roles, and practices. The numeric values are derived from mapping tables that show how each design factor affects each governance component. The mapping tables are based on empirical data, expert judgment, or best practices. The quantitative approach helps to provide a more objective and consistent way of designing a governance system that is tailored to the enterprise context and needs.  References:  : COBIT 2019 Design Guide: Designing an Information & Technology Governance Solution, page 54 : COBIT 2019 Design Guide: Designing an Information & Technology Governance Solution, page 56

The process ‘Ensured Stakeholder Engagement’ (EDM04) is one of the governance processes in COBIT 2019 that involves establishing transparent communication with stakeholders about their needs and expectations from information and technology governance. This process also involves ensuring stakeholder involvement in governance decision making and monitoring stakeholder satisfaction with governance outcomes. One of the roles that is best suited for this responsibility is the board and executive management, who are the highest-level governance body and decision makers in an enterprise. The board and executive management have a duty to ensure that they understand the needs and expectations of various stakeholders such as shareholders, regulators, customers, employees, suppliers, etc., and that they communicate effectively with them about the enterprise’s strategy, objectives, performance, risks, issues, opportunities, etc., related to information and technology governance. The board and executive management also have a responsibility to involve stakeholders in governance decision making by soliciting their input, feedback, opinions, suggestions, etc., and by considering their interests and perspectives when making governance choices. The board and executive management also have a role in monitoring stakeholder satisfaction with governance outcomes by measuring stakeholder value realization from information and technology investments and initiatives.

 The management objective APO09 Managed Service Agreements involves ensuring that IT services are delivered in accordance with agreed-upon service levels and costs. This management objective covers the activities of defining, negotiating, establishing, monitoring, reporting, and reviewing service agreements between service providers and service consumers. This management objective is most relevant for an enterprise that plans to outsource all of its noncore IT operations but wants to ensure the proper level of governance, risk and compliance (GRC) controls. By applying this management objective, the enterprise can improve its service governance and management capabilities, ensure alignment of IT services with business strategy and objectives, enhance service performance and outcomes, and increase service consumer satisfaction and value realization. This management objective also involves ensuring that the outsourced IT services comply with the applicable laws, regulations, standards, guidelines, contracts, or agreements that govern the information and technology activities of the enterprise, as well as with the enterprise’s policies, procedures, processes, practices, etc. This management objective also involves managing the risks associated with outsourcing IT services such as loss of control, vendor lock-in, quality issues, security breaches, etc.

People, skills and competencies are required for successful completion of all activities within a governance system. People are the individuals or groups who perform or are accountable for the governance activities and tasks. Skills and competencies are the abilities and knowledge that people need to perform their roles and responsibilities.  People, skills and competencies are one of the seven enablers of a governance system, as defined by COBIT. 1 2   References:   COBIT 2019 Framework: Introduction and Methodology ,  COBIT 2019 Framework: Governance System

 In most cases, management of the enterprise is the responsibility of the executive management team. The executive management team consists of senior managers who are accountable for implementing the strategies and policies set by the board or other governing body.  They are also responsible for planning, organizing, directing, controlling, and reporting on the enterprise’s operations 3 .  The executive management team may delegate some of their management responsibilities to other managers or staff, but they remain ultimately accountable for the outcomes 4 .  References:   3 : COBIT 2019 Framework: Introduction and Methodology, page 28  4 : COBIT 2019 Framework: Governance and Management Objectives, page 21

The Deliver, Service and Support (DSS) domain incorporates managed business process controls as one of its management objectives. The DSS domain covers the activities related to delivering IT services to internal and external customers, supporting IT operations and users, managing service requests, incidents, problems, continuity, security, availability, capacity, etc.  The DSS domain consists of 6 management objectives that describe the desired outcomes of these activities. 1 4   References:   COBIT 2019 Framework: Introduction and Methodology ,  COBIT 2019 Framework: Governance and Management Objectives

When assessing organizational structures, it is most helpful when subcriteria for each criterion are defined and linked to capability levels. Organizational structures are the arrangements of roles and responsibilities that enable the enterprise to achieve its objectives. Organizational structures can be assessed using six criteria: clarity, comprehensiveness, integration, alignment, authority, and accountability. Each criterion can be further divided into subcriteria that describe the specific aspects or attributes of the criterion. Capability levels are the measures of how well a process or activity is performed in terms of effectiveness, efficiency, completeness, reliability, etc. Capability levels can range from 0 (incomplete) to 5 (optimizing).  Defining and linking subcriteria to capability levels helps to evaluate the current and desired state of organizational structures, as well as to identify gaps and improvement opportunities. 1 2 3   References:   COBIT 2019 Framework: Introduction and Methodology ,  COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution ,  COBIT 2019 Framework: Roles, Responsibilities & RACI Charts

 A managed system of internal controls is most important to providing trust in operations, confidence in the achievement of enterprise objectives, and an adequate understanding of residual risk. A system of internal controls is a set of policies, procedures, practices, tools, techniques, etc., that are designed to provide reasonable assurance that an enterprise will achieve its objectives, prevent or detect errors or fraud, comply with laws and regulations, safeguard assets, etc.  A managed system of internal controls means that the system is regularly monitored, evaluated, updated, and improved to ensure its effectiveness and efficiency. 1 5   References:   COBIT 2019 Framework: Introduction and Methodology ,  COBIT 2019 Framework: Governance System

The CIO and the program steering committee are responsible for performing a stakeholder satisfaction survey and gathering feedback on lessons learned from the implementation of an EGIT program plan. According to the COBIT 2019 Implementation Guide, the CIO is the executive sponsor of the EGIT program, who provides strategic direction, leadership, and oversight for the program. The program steering committee is a group of senior stakeholders who support the CIO in governing and monitoring the program. One of their responsibilities is to conduct regular reviews of the program performance and outcomes, including stakeholder satisfaction and lessons learned.  These reviews help to evaluate the effectiveness and efficiency of the EGIT program plan and identify areas for improvement.  References:  : COBIT 2019 Implementation Guide: Implementing and Optimizing an Information and Technology Governance Solution, page 23  1  : COBIT 2019 Implementation Guide: Implementing and Optimizing an Information and Technology Governance Solution, page 45  1

The high involvement of IT-related roles in organizational structures is a critical requirement when the IT function is strategic and crucial to the success of the business. The IT function is the part of the enterprise that is responsible for planning, delivering, operating, and supporting information and technology services. The IT function can have different levels of strategic importance for the business, depending on the nature, scope, and objectives of the enterprise. When the IT function is strategic and crucial to the success of the business, it means that information and technology are essential for creating value, achieving competitive advantage, enabling innovation, etc.  In this case, it is critical to have high involvement of IT-related roles in organizational structures, such as having IT representation at the board level, having clear IT leadership roles and responsibilities, having effective IT governance committees or forums, etc. 1 3   References:   COBIT 2019 Framework: Introduction and Methodology ,  COBIT 2019 Framework: Roles, Responsibilities & RACI Charts

A well-developed business case is essential to help ensure that a project’s benefits are identified and continually monitored. A business case is a document that provides the rationale and evidence for initiating, continuing, or terminating a project or program. A business case typically consists of several elements, such as problem statement, objectives, scope, benefits, costs, risks, assumptions, etc.  A well-developed business case helps to ensure that a project’s benefits are identified and continually monitored by defining the expected outcomes or value that will be delivered by the project, as well as the metrics and indicators that will be used to measure and track them. 1 2   References:   COBIT 2019 Framework: Introduction and Methodology ,  COBIT 2019 Implementation Guide: Implementing an Information and Technology Governance Solution

According to the COBIT 2019 Framework: Introduction and Methodology, one of the imperative factors to the successful implementation of IT governance is that IT governance is sponsored by executives. Executive sponsorship ensures that IT governance has sufficient authority, resources and support from the top management of the organization.  Executive sponsorship also demonstrates commitment and leadership for IT governance, and fosters a culture of accountability and collaboration among stakeholders. 3 , p.  33-34  References:   3 : COBIT 2019 Framework: Introduction and Methodology

To gain the greatest benefit from the COBIT framework, a stakeholder should have a certain level of experience and a thorough understanding of the entire enterprise. A stakeholder is a person or group that has an interest or concern in an enterprise’s activities or outcomes. Examples of stakeholders are board members, executives, managers, employees, customers, suppliers, regulators, etc. To gain the greatest benefit from the COBIT framework, a stakeholder should have a certain level of experience in I & T governance or management practices, as well as a thorough understanding of the entire enterprise’s vision, mission, values, goals, objectives, strategies, processes, culture, etc.  This would help them to apply the COBIT framework effectively and efficiently to their specific context and needs. 1   References:   COBIT 2019 Framework: Introduction and Methodology , [COBIT 2019 Framework: Stakeholder Needs]

 COBIT addresses governance issues by grouping relevant governance components into objectives that can be managed to a required capability level. This is based on the principle of performance, which states that “governance of enterprise I & T should ensure that I & T performance is measured using relevant metrics; transparently communicated to stakeholders; evaluated against targets; and leads to appropriate management actions” . COBIT does not provide a full description of the entire IT environment or define specific governance strategies and processes, but rather provides a generic and flexible framework that can be adapted to different contexts and situations. 

A focus area within COBIT is a topic that is relevant to governance and management of enterprise information and technology, and that requires additional guidance to address specific challenges or priorities.  Digital transformation is one of the focus areas that COBIT provides guidance on, as it involves the use of technology to create new or modify existing business processes, culture, and customer experiences to meet changing business and market requirements 1 , p.  23.  References:   1 : COBIT 2019 Framework: Introduction and Methodology