COBIT: IT Governance in Service of Business Strategy

What is COBIT?

COBIT (Control Objectives for Information and Related Technologies) is a governance and IT management framework developed by ISACA (Information Systems Audit and Control Association), founded in 1969.

Currently at version COBIT 2019, COBIT is used in more than 180 countries and is the reference standard for IT governance, particularly in regulated sectors (finance, healthcare, government).

While ITIL focuses on operational IT service management, COBIT focuses on strategic governance - how to ensure IT creates value and risks are managed.

The 6 Principles of COBIT 2019

For the governance system:

1. Provide value to stakeholders: IT exists to create value, not for itself.
2. Holistic approach: governance is an interconnected system.
3. Dynamic system: governance adapts to changing context.

For the governance framework: 4. Distinguish governance from management: governance defines objectives; management plans and executes. 5. Tailored to business needs: COBIT adapts by organization size, sector, and maturity level. 6. End-to-end governance system: covers all IT scope and stakeholders.

The 40 Governance and Management Objectives

COBIT 2019 defines 40 objectives in 2 main domains:

Governance Domain (5 objectives, prefix EDM):

• EDM01: Ensure governance framework establishment
• EDM02: Ensure benefits realization
• EDM03: Ensure risk optimization
• EDM04: Ensure resource optimization
• EDM05: Ensure stakeholder transparency

Management Domain (35 objectives):

• APO: Align, Plan and Organise
• BAI: Build, Acquire and Implement
• DSS: Deliver, Service and Support
• MEA: Monitor, Evaluate and Assess

The COBIT Maturity Model

COBIT uses a 5-level maturity model:

• 0 - Incomplete: process not implemented
• 1 - Initial: process achieves objectives unpredictably
• 2 - Managed: process is planned and tracked
• 3 - Defined: process is standardized and documented
• 4 - Quantitatively managed: process is measured statistically
• 5 - Optimized: process improves continuously

COBIT and Regulatory Compliance

COBIT addresses multiple regulatory frameworks:

• SOX: IT controls on financial systems
• GDPR: personal data protection
• PCI-DSS: payment card data security
• ISO 27001: information security management
• Basel III/IV: operational risk management

COBIT and Sinra

For development teams, COBIT interfaces with Sinra at the governance level. Sinra’s releases must align with IT governance objectives. Capabilities must be evaluated for business value and risk exposure.

Sinra’s pages can document IT policies and controls required by COBIT for each relevant objective.

COBIT vs ITIL vs ISO 27001

These frameworks are complementary, not competitors.

Conclusion

COBIT is not a daily framework for development teams. It’s a governance tool for CIOs, auditors, and executive leadership. But every developer in a regulated organization, or aspiring to IT management, must understand COBIT principles. The question “does IT create value for the business?” is fundamental.