COBIT 2019 Framework: Governance Objectives, Design Factors and Use

The COBIT framework is ISACA's model for governing and managing enterprise information and technology. Where security standards ask "is this system protected?", COBIT asks a broader question: is IT directed, controlled and measured in a way that serves the business and that leadership can account for? It is the reference many IT auditors use, which is why IT service providers meet it in client audits even if they never adopt it themselves.

The current version, COBIT 2019, defines 40 governance and management objectives, the components needed to achieve them, and design factors to tailor the framework. This guide explains the structure, how to apply it in a practical way, how it relates to ITIL, ISO/IEC 27001, COSO and SOX, and what it means for software and IT service companies.

What is COBIT?

COBIT originally stood for Control Objectives for Information and Related Technologies. Today ISACA uses the name on its own for a framework for the governance and management of enterprise information and technology (I&T). COBIT 2019 consists of a core model and supporting publications:

• Introduction and Methodology: concepts, principles and the overall structure.
• Governance and Management Objectives: detailed descriptions of the 40 objectives, their processes, practices, activities, metrics and related guidance.
• Design Guide: how to tailor a governance system using design factors.
• Implementation Guide: a life cycle approach to putting governance in place and improving it.
• Focus area guides: content for specific topics such as information security, DevOps, small and medium enterprises and risk.

COBIT separates governance (evaluating stakeholder needs, setting direction and monitoring performance, usually by the board) from management (planning, building, running and monitoring activities in line with that direction, usually by executives).

History and why COBIT was introduced

COBIT was first published in 1996 by ISACA, then known as the Information Systems Audit and Control Association, as a set of control objectives for IT auditors. Over successive versions it grew from an audit tool into a governance framework: COBIT 4.1 (2007) was widely used for SOX IT controls; COBIT 5 (2012) introduced the separation of governance and management and the enabler model; COBIT 2019 (released in November 2018) added design factors, focus areas, capability levels based on CMMI, and a more flexible, open model updated over time.

COBIT exists because boards were accountable for outcomes of IT spending and risk without a structured way to oversee them, and auditors needed a reference set of controls that matched how IT was actually run.

Who uses COBIT?

• Enterprises seeking structured IT governance, especially in regulated sectors such as banking, insurance, government and healthcare.
• Internal and external IT auditors, who often build audit programmes from COBIT objectives.
• Companies subject to SOX or similar internal control requirements, which use COBIT to define IT general controls.
• IT service providers and outsourcers, whose clients assess them against COBIT-based controls such as change management and access management.

COBIT is voluntary and global. Some regulators and supervisory guidance reference it, and many audit methodologies are built on it.

Principles and components

Six principles for a governance system

1. Provide stakeholder value.
2. A whole-system approach: a governance system is built from interacting components.
3. Dynamic governance system: it changes when design factors change.
4. Governance distinct from management.
5. Tailored to enterprise needs, using design factors.
6. End-to-end governance system covering all of the enterprise's information and technology.

Seven components

• Processes.
• Organisational structures.
• Principles, policies and frameworks.
• Information.
• Culture, ethics and behaviour.
• People, skills and competencies.
• Services, infrastructure and applications.

Each governance or management objective is achieved through a combination of these components, not through processes alone. That is a useful reminder that controls depend on people, culture and tools as much as on written procedures.

The 40 governance and management objectives

Domain	Purpose	Objectives
EDM: Evaluate, Direct and Monitor	Governance by the board	5 objectives, including ensured governance framework setting, benefits delivery, risk optimisation, resource optimisation and stakeholder engagement
APO: Align, Plan and Organise	Management: strategy and organisation	14 objectives, including managed strategy, architecture, innovation, portfolio, budget, human resources, relationships, service agreements, vendors, quality, risk, security and data
BAI: Build, Acquire and Implement	Management: delivering solutions	11 objectives, including managed programmes, requirements, solutions identification and build, availability and capacity, organisational change, IT changes, change acceptance and transitioning, knowledge, assets, configuration and projects
DSS: Deliver, Service and Support	Management: running IT	6 objectives: managed operations, service requests and incidents, problems, continuity, security services, and business process controls
MEA: Monitor, Evaluate and Assess	Management: monitoring and assurance	4 objectives: managed performance and conformance monitoring, system of internal control, compliance with external requirements, and assurance

For IT and software companies, objectives that auditors test most often include BAI06 (managed IT changes), DSS05 (managed security services), APO13 (managed security), APO10 (managed vendors), DSS01 (managed operations), DSS04 (managed continuity) and BAI03 (managed solutions identification and build).

Design factors and the goals cascade

COBIT 2019 uses design factors to decide which objectives matter most and how mature they need to be. The design factors include enterprise strategy, enterprise goals, risk profile, I&T-related issues, the threat environment, compliance requirements, the role of IT, the sourcing model for IT, IT implementation methods, the technology adoption strategy and enterprise size. A company that relies on outsourced cloud services and agile delivery will weight vendor management and change acceptance differently from a bank running its own data centres.

The goals cascade links stakeholder needs to enterprise goals, then to alignment goals for I&T, then to governance and management objectives. It gives a traceable answer to "why do we need this control?"

Capability and maturity levels

COBIT 2019 rates processes on capability levels from 0 to 5, based on the CMMI approach: 0 means the process lacks basic capability; 1 means it achieves its purpose incompletely; 2 means basic activities are performed; 3 means activities are well defined; 4 means the process is measured; 5 means it is continuously improved. Focus areas can be rated on maturity levels in a similar way. Organisations set target levels by design factors rather than aiming for 5 everywhere.

Setting targets is where design factors earn their keep. A small software company that outsources hosting may set capability level 3 for change management and vendor management, because those carry most of its risk, and accept level 2 for areas such as innovation or enterprise architecture. A bank's core banking platform would set higher targets across operations, continuity and security. Writing down the target and the reason for it gives auditors a clear basis for judging whether the gap between current and target capability is acceptable, and gives management a short, defensible improvement list instead of an open-ended programme.

What clients audit when they use COBIT on vendors

Banks, insurers and listed companies that use COBIT often extend it to their IT vendors through outsourcing contracts and vendor audits. For a software or IT services company, the questions usually cluster around a handful of objectives:

Objective	Typical audit questions	Evidence to keep ready
BAI06 Managed IT changes	Are changes requested, assessed, approved, tested and recorded? Are emergency changes reviewed afterwards?	Change tickets linked to pull requests, approval records, deployment logs, post-implementation reviews
DSS05 Managed security services	How is access granted, reviewed and removed? How are endpoints, networks and data protected?	Access requests and quarterly reviews, offboarding records, MFA and device management reports
DSS02 Managed service requests and incidents	Are incidents logged, prioritised and resolved within agreed levels?	Incident tickets, SLA reports, escalation records
DSS03 Managed problems	Are root causes found and fixed for recurring incidents?	Problem records and root cause analyses
DSS04 Managed continuity	Are backups taken and restores tested? Is there a continuity plan?	Backup reports, restore test records, continuity plan and test results
APO10 Managed vendors	How do you manage your own subcontractors and cloud providers?	Vendor inventory, contracts, security reviews, SOC 2 or ISO certificates of key providers
BAI03 Managed solutions identification and build	How are requirements, design, coding standards and testing controlled?	Development standards, code review records, test results, release approvals

Most of this evidence already exists in well-run engineering teams; the work is making it consistent and easy to retrieve. Teams that keep approvals and reviews inside their ticketing, code hosting and identity tools pass these audits with far less effort than those that rebuild evidence by hand before each visit.

How to apply COBIT step by step

1. Understand the enterprise context: strategy, goals, risk profile and current issues, as inputs to the design factors.
2. Determine the initial scope of the governance system using the design factors.
3. Refine the scope: prioritise objectives and set target capability levels.
4. Assess current capability of the prioritised processes and the other components.
5. Plan improvements following the implementation life cycle: what are the drivers, where are we now, where do we want to be, what needs to be done, how do we get there, did we get there, how do we keep the momentum going.
6. Implement improvements in processes, roles, policies, information, skills and tools.
7. Monitor with metrics from the objectives and report to the board through EDM.

Documentation you will need

• IT governance charter or terms of reference for governance bodies.
• Policies for IT risk, security, change management, vendor management and data management.
• RACI charts for key processes.
• Process descriptions and procedures for prioritised objectives.
• Capability assessments and improvement plans.
• Performance and conformance reports to management and the board.
• Evidence of controls operating: change records, access reviews, incident and problem records, continuity tests, vendor reviews.

Assessment and certification

There is no COBIT certification for organisations. ISACA offers certifications for individuals (for example COBIT Foundation and COBIT Design and Implementation), and its CISA and CGEIT credentials are closely related to COBIT. Organisations can perform capability assessments themselves or engage assessors. In practice, COBIT shows up in external audits: an auditor testing SOX IT general controls or a regulator reviewing IT governance will often structure the work around COBIT objectives.

Timeline and cost considerations

COBIT is adopted gradually. The framework publications are inexpensive or free to ISACA members; the cost lies in the people who assess and improve processes, any tools for governance, risk and compliance, and training. A focused effort on a few high-priority objectives, such as change management and access management, delivers value quickly; enterprise-wide adoption takes longer.

Benefits and the risk of weak IT governance

COBIT gives boards a structured way to oversee IT, aligns IT investment with business goals, clarifies accountability, and supports audit and regulatory compliance. It also fits around other frameworks, so security (ISO/IEC 27001), service management (ITIL) and project methods can sit inside one governance system.

There is no penalty for not using COBIT. Weak IT governance shows up as audit findings on change and access management, projects that do not deliver value, unmanaged vendor risk, and boards surprised by IT incidents.

Common mistakes and challenges for IT companies

• Trying to implement all 40 objectives at once. Use design factors to prioritise.
• Treating COBIT as a process catalogue only. Culture, skills, information and tools are components too.
• Confusing COBIT with ITIL. COBIT says what must be governed and controlled; ITIL describes how to run service management practices.
• Paper controls. Auditors test whether change approvals and access reviews actually happen in the tools.
• No link to business goals. Without the goals cascade, governance looks like overhead.

Best practices, tools and technologies

• Start with objectives that auditors test most: BAI06 change management, DSS05 security services, APO10 vendor management.
• Enforce controls in tools: approval workflows in ticketing and deployment systems, access reviews from the identity provider, automated evidence collection.
• Use a GRC platform to map controls to COBIT objectives and other frameworks.
• Report to the board with a small set of metrics per EDM objective.
• Align with ISO/IEC 27001 for security and ITIL or ISO/IEC 20000-1 for service management.

Business applications that support financial and operational processes need approval trails, segregation of duties and audit logs; we build those into CRM and ERP systems and custom software.

How COBIT relates to other frameworks

Framework	Relationship
ITIL	Service management practices that implement many COBIT management objectives in DSS and BAI.
COSO	Enterprise internal control framework; COBIT applies similar ideas to IT and is used for IT general controls.
SOX	Law requiring internal control over financial reporting; COBIT is a common reference for the IT part.
ISO/IEC 38500	International standard for governance of IT by the governing body; aligned with COBIT's EDM domain.
ISO/IEC 27001	Security management system that implements APO13 and DSS05 in depth.
NIST CSF	Cybersecurity outcomes that fit within COBIT's governance structure.

Real-world implementation examples

COBIT has been adopted by central banks, government agencies and large enterprises as the backbone of IT governance and IT audit, and many national audit offices and internal audit functions base their IT audit programmes on it. ISACA publishes case studies of organisations using COBIT to structure governance and improve audit results.

An illustrative case for an IT services firm: a banking client's auditors assess the firm against change management, access management and incident management controls. The firm maps its practices to BAI06, DSS05 and DSS02, enforces approvals in its deployment pipeline, runs quarterly access reviews from its identity provider, and keeps incident records with root cause analysis. The next audit has no findings in those areas, and the same evidence supports the firm's ISO/IEC 27001 certification.

Next steps

1. Identify which stakeholders (board, auditors, clients) expect COBIT-based governance.
2. Apply the design factors and pick a short list of priority objectives.
3. Assess capability and set targets.
4. Embed controls in tools and collect evidence automatically.
5. Report to leadership and iterate.

Frequently asked questions

What is the latest version of COBIT?

COBIT 2019, released by ISACA in November 2018 and extended with focus-area publications since.

How many objectives are in COBIT 2019?

Forty governance and management objectives in five domains: EDM, APO, BAI, DSS and MEA.

Is COBIT mandatory?

No. It is voluntary, though auditors and some regulators use it as a reference for IT governance and controls.

Can an organisation be COBIT certified?

No. ISACA certifies individuals. Organisations can have their process capability assessed.

What is the difference between COBIT and ITIL?

COBIT is a governance and control framework covering all of enterprise IT. ITIL is a service management framework describing practices to deliver and support services. They are often used together.

What are COBIT design factors?

Factors such as enterprise strategy, goals, risk profile, compliance requirements, sourcing model and size that are used to tailor which objectives matter and how capable they need to be.

How is COBIT used for SOX?

Auditors and companies use COBIT objectives, especially those on change management, access and operations, to define and test IT general controls that support financial reporting.

What are COBIT capability levels?

A scale from 0 to 5, based on CMMI, describing how well a process achieves its purpose, from incomplete to continuously improving.

Is COBIT suitable for small companies?

Yes, when tailored. ISACA publishes a focus area for small and medium enterprises, and design factors keep the scope proportionate.

What is the difference between governance and management in COBIT?

Governance (EDM) evaluates needs, sets direction and monitors, usually by the board. Management (APO, BAI, DSS, MEA) plans, builds, runs and monitors activities within that direction.

Do IT vendors need to know COBIT?

Vendors to banks, insurers, governments and listed companies benefit from understanding it, because client auditors often structure vendor assessments around COBIT objectives such as change, access, incident and vendor management.

Does COBIT cover cybersecurity?

Yes, through objectives such as APO13 managed security and DSS05 managed security services, and an information security focus area. Detailed controls usually come from ISO/IEC 27001 or NIST.