A BUSINESS GUIDE FOR OWNERS AND BOARDS

COBIT® 2019
Make technology serve the business.

COBIT 2019 is a framework from ISACA that helps business leaders decide what they need from information and technology, who should be accountable, and how to check that the business is benefiting.

For an owner or board member, the starting questions are practical: Are we spending on the right things? Can we keep serving customers when something goes wrong? Are our information and decisions reliable? Are people responsible for delivering the promised results?

Understand the Goals Cascade Explore the Design Toolkit ↓

WHAT IS COBIT?

A way to connect business decisions with technology results.

Your business depends on information and technology whenever it takes an order, pays a supplier, serves a customer or reviews its performance. Decisions about these capabilities affect growth, cost, service and risk. COBIT gives leaders a structured way to govern those decisions.

A governance framework describes how direction, responsibility and oversight should work. Using COBIT means agreeing which business outcomes matter, choosing the practices that support them and checking whether those practices deliver results. It can be used alongside your existing management methods and standards.

About COBIT — ISACA ↗

WHO DOES WHAT?

The board sets direction. Management delivers it.

Owners and boards bring the business perspective. Technology specialists explain the options and constraints. Both need a shared view of the outcomes, responsibilities and evidence of progress.

For example, a board can ask whether customer orders will continue during an outage and whether recovery has been tested. The delivery team determines how to achieve the agreed service requirement and provides evidence that it can.

THE GOALS CASCADE

Turn business ambition into actionable priorities.

The Goals Cascade in COBIT connects stakeholder needs and enterprise priorities to the information and technology outcomes that support them, then to governance and management objectives. It helps explain why a particular practice deserves attention.

“Cascade” means carrying the purpose through each level. One business goal can depend on several technology outcomes and practices. A single practice can support several business goals. These connections form a network rather than a simple one-to-one checklist.

Goals Cascade and enterprise strategy — ISACA ↗

AN ILLUSTRATIVE BUSINESS EXAMPLE

“Keep serving customers when systems fail.”

Imagine a distributor whose ordering system goes offline. Customers cannot place orders, warehouse teams lose visibility and deliveries are delayed. The owner wants to protect customer service and revenue during disruption.

The board discussion becomes concrete: which services are critical, how much interruption is acceptable, who owns recovery and what evidence shows the arrangements work? Management can propose tested recovery procedures, supplier arrangements and reporting measures.

This example illustrates one supported path in the supplied workbook. A complete design considers other linked objectives and the organization’s own circumstances. Explore business continuity and COBIT — ISACA ↗

WHAT DOES THE DESIGN TOOLKIT DO?

Help you decide where governance needs attention.

The Design Toolkit helps tailor COBIT to an organization’s strategy, goals, risks and operating context. It calculates relative priorities across the 40 objectives and proposes capability targets: how well the relevant practices should work.

In this website’s implementation, start by entering your actual organizational goals in a Balanced Scorecard. Group them under financial outcomes, customers, internal processes, and learning and growth. Give the perspectives and goals weights to express their importance, then review their links to COBIT’s strategy categories and enterprise goals.

A high priority score means an objective deserves attention relative to the other objectives in the design. It does not mean the organization is performing well or poorly. Current capability must be assessed separately using evidence.

The Balanced Scorecard weighting bridge on this website is a custom organizational mapping. Visitors review and apply its proposed strategy and enterprise-goal ratings. The downstream COBIT links use the supplied workbook. Strategy categories and the enterprise-goals cascade are distinct design paths.

Try the Design Toolkit ↓

TAKE THIS INTO THE BOARDROOM

Five questions to start the conversation.

1. Which business goals are most important over the next planning period?
2. Which information and technology capabilities do those goals depend on?
3. What could prevent us from achieving them?
4. Who is accountable for each outcome, and what evidence will show progress?
5. Which improvements should we fund first, and when will we review the results?

Bring business owners, finance, operations, technology and risk colleagues into the discussion. Agree the business meaning of the goals and weights before relying on the calculated priorities.

THE PROCESS STRUCTURE

40 objectives across five domains.

The core model organizes governance and management into five domains. Each objective is supported by a process. Together, the domains connect executive direction with planning, solution delivery, daily operations and assurance.

Explore the interactive map below. Hover over a process for a quick explanation, or select it to keep the details open. Use Full screen for a larger view. For assessment-specific results, open the Design Toolkit and choose Goal-linked process map: select an organizational goal to highlight its related processes and display their concluded priority scores. Results & Refinement also provides a radar comparing initial, refined and concluded priorities.

Open interactive process map ↗

A process alone is not the whole governance system. Implementation also depends on organizational structures, policies, information, skills, culture and supporting services. A governance design should consider how these elements work together.

THE GOVERNANCE DESIGN PROCESS

Understand the context. Design the priorities.

The COBIT design workflow uses enterprise context to establish an initial scope, refine it and conclude a tailored governance design.

The resulting priorities guide the next implementation discussion: what needs to change, who owns the change, how progress will be measured and which improvements come first. Review the design when the enterprise’s context changes.

Read ISACA’s explanation of the governance design workflow ↗

EXPLORE THE DESIGN TOOLKIT

Put your enterprise context into practice.

Start with a Balanced Scorecard: define your actual organizational goals, weight the four perspectives and the goals within them, then map those goals to COBIT enterprise strategy categories and enterprise goals. Governance Studio carries the proposed ratings into the design workbook and helps you explore priorities across all 40 objectives.

Open the Design Toolkit ↗ Discuss your governance priorities

No sign-in is required. Assessments stay in your browser unless you download them. Scores show relative design priorities; they do not measure your current process capability.