Isaca COBIT-2019 - COBIT 2019 Foundation

The enterprise’s risk profile is the most important enterprise risk management concept to fully understand prior to finalizing the design of an IT governance system. Enterprise risk management is the process of identifying, analyzing, evaluating, treating, monitoring, and communicating risks that affect the achievement of enterprise objectives. Enterprise risk management concepts include risk appetite (the amount and type of risk that an enterprise is willing to accept), risk tolerance (the acceptable variation in outcomes related to specific performance measures), risk profile (the overall exposure or level of risk that an enterprise faces), etc. The enterprise’s risk profile is the most important concept to fully understand prior to finalizing the design of an IT governance system because it helps to determine the appropriate level of risk optimization for each governance objective.14 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System

 An IT implementation method design factor is a characteristic that influences how an enterprise implements IT solutions and services. DevOps is an IT implementation method that focuses on software building, deployment and operations, by integrating development and operations teams to improve collaboration and productivity1, p. 31. References: 1: COBIT 2019 Framework: Introduction and Methodology

 One of the benefits derived from the use of COBIT is that it helps to ensure compliance with applicable rules and regulations. This benefit is primarily associated with an external stakeholder, such as a regulator, auditor, customer, or partner, who expects the enterprise to adhere to certain standards and requirements. COBIT provides guidance on how to align the governance and management of enterprise IT with relevant laws, regulations, and contractual obligations12. COBIT also helps to establish and maintain a compliance culture and program within the enterprise3. References: 1: COBIT 2019 Framework: Introduction and Methodology, page 17 2: COBIT 2019 Framework: Governance and Management Objectives, page 19 3: COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution, page 77

 A governance or management objective always relates to a single process. A governance or management objective is a desired outcome or result of a governance or management activity for information and technology. A process is a set of interrelated or interacting activities that transform inputs into outputs. A process can be described by its purpose, goals, practices, activities, inputs, outputs, roles, metrics, etc. A governance or management objective always relates to a single process by defining its purpose and goals, as well as providing guidance on how to perform it effectively and efficiently.12 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance and Management Objectives

 The primary reason for management to conduct a process capability assessment is to better understand the current state as compared to the target state. A process capability assessment is a method of measuring and evaluating how well a process or activity is performed in terms of effectiveness, efficiency, completeness, reliability, etc. A process capability assessment can be done using different models or frameworks, such as CMMI or ISO/IEC 15504. A process capability assessment helps management to better understand the current state of a process by identifying its strengths, weaknesses, gaps, and improvement opportunities. A process capability assessment also helps management to compare the current state with the target state, which is the desired level of performance or outcome for a process.13 References: COBIT 2019 Framework: Introduction and Methodology, COBIT Process Assessment Model (PAM): Using COBIT 5

The process activities component of governance and management objectives includes the expected capability level. A process activity is a specific task or action that contributes to achieving a process outcome or objective. A capability level is a measure of how well a process or activity is performed in terms of effectiveness, efficiency, completeness, reliability, etc. A capability level can range from 0 (incomplete) to 5 (optimizing). Each governance and management objective in COBIT defines a set of process activities that are required to achieve it, as well as an expected capability level for each activity.12 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance and Management Objectives

The risk profile of an enterprise is a design factor that describes how an enterprise identifies, assesses, responds to, monitors, and reports on information and technology risks. The risk profile helps to determine the level of risk appetite and tolerance that an enterprise has for its information and technology activities, as well as the level of control and assurance that is required for its governance framework. When reviewing the risk profile of an enterprise during the governance design phase, one of the prerequisites that must be established prior to conducting a high-level risk analysis is the enterprise’s risk appetite. The risk appetite is the amount and type of risk that an enterprise is willing to accept in pursuit of its objectives. The risk appetite provides a basis for defining the risk criteria, thresholds, indicators, and responses that will be used in the risk analysis process. The risk appetite also helps to align the governance framework with the enterprise’s strategy and objectives.

 The enterprise goal titled “Optimization of Business Process Costs” is aligned to the internal dimension of the balanced scorecard (BSC). The internal dimension focuses on the efficiency and effectiveness of the business processes that deliver value to customers and stakeholders. Optimization of business process costs is one of the 17 generic enterprise goals defined by COBIT that supports the internal dimension.12 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance and Management Objectives

 An enterprise will often fail to realize implementation commitments during the execution of an EGIT implementation program plan if it focuses on enabling IT value over business value. IT value is the contribution of IT to achieving enterprise objectives, while business value is the overall benefit that the enterprise derives from its use of information and technology. Focusing on IT value over business value may result in a disconnect between IT and business stakeholders, a lack of alignment between IT goals and business strategy, or a failure to deliver expected benefits or outcomes. Therefore, it is important to balance both IT value and business value when implementing a governance system. The answer is based on the COBIT 2019 Implementation Guide3, page 38. References: 3: COBIT 2019 Implementation Guide | Digital | English

The different levels of involvement associated with roles and organizational structure are primarily divided into responsibility and accountability levels. Responsibility and accountability are two key concepts that define the degree of involvement and authority that a role has in performing a task or process. Responsibility means performing or overseeing a task or process, while accountability means being answerable for the outcome or result of a task or process. COBIT uses a RACI chart to assign different levels of responsibility and accountability to roles and organizational structures for each governance and management objective.13 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Roles, Responsibilities & RACI Charts