Cobit

COBIT

Overview

COBIT was first released in 1996. Its mission is “to research, develop, publicize and promote an authoritative, up-to-date, international set of generally accepted information technology control objectives for day-to-day use by business managers and auditors.” Managers, auditors, and users benefit from the development of COBIT because it helps them understand their IT systems and decide the level of security and control that is necessary to protect their companies’ assets through the development of an IT governance model.

COBIT has 34 high level processes that cover 318 control objectives categorized in four domains: Planning and Organization, Acquisition and Implementation, Delivery and Support and Monitoring. COBIT provides benefits to managers, IT users, and auditors. Managers benefit from COBIT because it provides them with a foundation upon which IT related decisions and investments can be based. Decision making is more effective because COBIT aids management in defining a strategic IT plan, defining the information architecture, acquiring the necessary IT hardware and software to execute an IT strategy, ensuring continuous service, and monitoring the performance of the IT system. IT users benefit from COBIT because of the assurance provided to them by COBIT’s defined controls, security, and process governance. COBIT benefits auditors because it helps them identify IT control issues within a company’s IT infrastructure. It also helps them corroborate their audit findings.

COBIT product family

The complete COBIT package is a set consisting of six publications:

• Executive Summary
• Framework
• Control Objectives
• Audit Guidelines
• Implementation Tool Set
• Management Guidelines

A brief overview of each of the above components is provided below.

Executive Summary

Sound business decisions are based on timely, relevant and concise information. Specifically designed for time-pressed senior executives and managers, the COBIT Executive Summary consists of an Executive Overview which provides a thorough awareness and understanding of COBIT's key concepts and principles. Also included is a synopsis of the Framework, which provides a more detailed understanding of these concepts and principles, while identifying COBIT's four domains (Planning and Organization, Acquisition and Implementation, Delivery and Support, Monitoring) and 34 IT processes

Control Objectives for Information and related Technology (COBIT®) provides good practices across a domain and process

framework and presents activities in a manageable and logical structure. COBIT’s good practices represent the consensus of experts.

They are strongly focused more on control, less on execution. These practices will help optimise IT-enabled investments, ensure

service delivery and provide a measure against which to judge when things do go wrong.

For IT to be successful in delivering against business requirements, management should put an internal control system or framework

in place. The COBIT control framework contributes to these needs by:

• Making a link to the business requirements

• Organising IT activities into a generally accepted process model

• Identifying the major IT resources to be leveraged

• Defining the management control objectives to be considered

Thus, COBIT supports IT governance (figure 2) by providing a framework to ensure that:

• IT is aligned with the business

• IT enables the business and maximises benefits

• IT resources are used responsibly

• IT risks are managed appropriately

The COBIT products have been organised

into three levels (figure 3) designed to

support:

• Executive management and boards

• Business and IT management

• Governance, assurance, control and

security professionals

Briefly, the COBIT products include:

• Board Briefing on IT Governance,

2nd Edition—Helps executives understand

why IT governance is important, what its

issues are and what their responsibility is

for managing it

• Management guidelines/maturity models—

Help assign responsibility, measure

performance, and benchmark and address

gaps in capability

• Frameworks—Organise IT governance

objectives and good practices by IT

domains and processes, and links them to

business requirements

• Control objectives— Provide a complete

set of high-level requirements to be

considered by management for effective

control of each IT process

• IT Governance Implementation Guide:

Using COBIT ® and Val IT TM, 2nd Edition—

Provides a generic road map for

implementing IT governance using the

COBIT and Val ITTM resources

• COBIT® Control Practices: Guidance to

Achieve Control Objectives for Successful

IT Governance, 2nd Edition—Provides guidance on why controls are worth

implementing and how to implement them

• IT Assurance Guide: Using COBIT ®—Provides guidance on how COBIT can be used to support a variety of assurance activities

together with suggested testing steps for all the IT processes and control objectives

The COBIT content diagram depicted in figure 3 presents the primary audiences, their questions on IT governance and the generally

applicable products that provide responses. There are also derived products for specific purposes, for domains such as security or for

specific enterprises.

Framework

A successful organization is built on a solid framework of data and information. The Framework explains how IT processes deliver the information that the business needs to achieve its objectives. This delivery is controlled through 34 high-level control objectives, one for each IT process, contained in the four domains. The Framework identifies which of the seven information criteria (effectiveness, efficiency, confidentiality, integrity, availability, compliance and reliability), as well as which IT resources (people, applications, information and infrastructure) are important for the IT processes to fully support the business process.

To govern IT effectively, it is important to appreciate the activities and

risks within IT that need to be managed. They are usually ordered into

the responsibility domains of plan, build, run and monitor. Within the

COBIT framework, these domains, as shown in figure 8, are called:

• Plan and Organise (PO)—Provides direction to solution delivery

(AI) and service delivery (DS)

• Acquire and Implement (AI)—Provides the solutions and passes

them to be turned into services

• Deliver and Support (DS)—Receives the solutions and makes them

usable for end users

• Monitor and Evaluate (ME)—Monitors all processes to ensure that

the direction provided is followed

Control Objectives

The key to maintaining profitability in a technologically changing environment is how well you maintain control. COBIT's Control Objectives provides the critical insight needed to delineate a clear policy and good practice for IT controls. Included are the statements of desired results or purposes to be achieved by implementing the 214 specific, detailed control objectives throughout the 34 IT processes.

Audit Guidelines

To achieve your desired goals and objectives you must constantly and consistently audit your procedures. Audit Guidelines outline and suggest actual activities to be performed corresponding to each of the 34 high-level IT control objectives, while substantiating the risk of control objectives not being met. Audit Guidelines are an invaluable tool for information systems auditors in providing management assurance and/or advice for improvement.

Implementation Tool Set

An Implementation Tool Set, which contains Management Awareness and IT Control Diagnostics, and Implementation Guide, FAQs, case studies from organizations currently using COBIT, and slide presentations that can be used to introduce COBIT into organizations. The new Tool Set is designed to facilitate the implementation of COBIT, relate lessons learned from organizations that quickly and successfully applied COBIT in their work environments, and lead management to ask about each COBIT process: Is this domain important for our business objectives? Is it well performed? Who does it and who is accountable? Are the processes and control formalized?

Management Guidelines

To ensure a successful enterprise, you must effectively manage the union between business processes and information systems. The new Management Guidelines are composed of Maturity Models, to help determine the stages and expectation levels of control and compare them against industry norms; Critical Success Factors, to identify the most important actions for achieving control over the IT processes; Key Goal Indicators, to define target levels of performance; and Key Performance Indicators, to measure whether an IT control process is meeting its objective. These Management Guidelines will help answer the questions of immediate concern to all those who have a stake in enterprise success.

COBIT structure

COBIT covers four domains:

• Plan and Organize
• Acquire and Implement
• Deliver and Support
• Monitor and Evaluate

Plan and Organization

The Planning and Organization domain covers the use of information & technology and how best it can be used in a company to help achieve the company’s goals and objectives. It also highlights the organizational and infrastructural form IT is to take in order to achieve the optimal results and to generate the most benefits from the use of IT. The following table lists the high level control objectives for the Planning and Organization domain.

HIGH LEVEL CONTROL OBJECTIVES

Plan and Organize

PO1	Define a Strategic IT Plan and direction
PO2	Define the Information Architecture
PO3	Determine Technological Direction
PO4	Define the IT Processes, Organization and Relationships
PO5	Manage the IT Investment
PO6	Communicate Management Aims and Direction
PO7	Manage IT Human Resources
PO8	Ensure Compliance with External Requirements
PO9	Assess and Manage IT Risks
PO10	Manage Projects
PO11	Manage Quality

Acquire and Implement

The Acquire and Implement domain covers identifying IT requirements, acquiring the technology, and implementing it within the company’s current business processes. This domain also addresses the development of a maintenance plan that a company should adopt in order to prolong the life of an IT system and its components. The following table lists the high level control objectives for the Acquisition and Implementation domain.

HIGH LEVEL CONTROL OBJECTIVES

Acquire and Implement

AI1	Identify Automated Solutions
AI2	Acquire and Maintain Application Software
AI3	Acquire and Maintain Technology Infrastructure
AI4	Enable Operation and Use
AI5	Procure IT Resources
AI6	Manage Changes
AI7	Install and Accredit Solutions and Changes

Delivery and Support

The Delivery and Support domain focuses on the delivery aspects of the information technology. It covers areas such as the execution of the applications within the IT system and its results, as well as, the support processes that enable the effective and efficient execution of these IT systems. These support processes include security issues and training. The following table lists the high level control objectives for the Delivery and Support domain.

HIGH LEVEL CONTROL OBJECTIVES

Deliver and Support

DS1	Define and Manage Service Levels
DS2	Manage Third-party Services
DS3	Manage Performance and Capacity
DS4	Ensure Continuous Service
DS5	Ensure Systems Security
DS6	Identify and Allocate Costs
DS7	Educate and Train Users
DS8	Manage Service Desk and Incidents
DS9	Manage the Configuration
DS10	Manage Problems
DS11	Manage Data
DS12	Manage the Physical Environment
DS13	Manage Operations

Monitor and Evaluate

The Monitoring and Evaluation domain deals with a company’s strategy in assessing the needs of the company and whether or not the current IT system still meets the objectives for which it was designed and the controls necessary to comply with regulatory requirements. Monitoring also covers the issue of an independent assessment of the effectiveness of IT system in its ability to meet business objectives and the company’s control processes by internal and external auditors. The following table lists the high level control objectives for the Monitoring domain.

HIGH LEVEL CONTROL OBJECTIVES

Monitor and Evaluate

ME1	Monitor and Evaluate IT Processes
ME2	Monitor and Evaluate Internal Control
ME3	Ensure Regulatory Compliance
ME4	Provide IT Governance