COBIT-2019 COBIT 2019 Foundation Questions and Answers

 A principle associated with the key components of a governance framework is that key components should function independently to maintain integrity. Key components include governance components (such as structures, processes, principles, policies, etc.), governance enablers (such as people, skills, culture, information, services, etc.), and governance outcomes (such as value creation, risk optimization, resource optimization, etc.). These components should operate independently from each other to avoid conflicts of interest, bias, or undue influence. They should also have clear roles, responsibilities, authorities, and accountabilities. COBIT ensures the independence of key components by defining their relationships and interactions in a transparent and consistent manner.14 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System

The information flow and items component of COBIT includes a list of artifacts with links to relevant governance and management practices. An artifact is a tangible or intangible object that is produced, modified, or used by a process or activity. An artifact can be a document, a report, a record, a plan, a policy, a procedure, a service, a product, etc. The information flow and items component of COBIT provides a comprehensive list of artifacts that are relevant for each governance and management objective, as well as links to the practices that produce, modify, or use them.12 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System

A well-developed business case is essential to help ensure that a project’s benefits are identified and continually monitored. A business case is a document that provides the rationale and evidence for initiating, continuing, or terminating a project or program. A business case typically consists of several elements, such as problem statement, objectives, scope, benefits, costs, risks, assumptions, etc. A well-developed business case helps to ensure that a project’s benefits are identified and continually monitored by defining the expected outcomes or value that will be delivered by the project, as well as the metrics and indicators that will be used to measure and track them.12 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Implementation Guide: Implementing an Information and Technology Governance Solution

 Within the COBIT organizational structures component, the Accountable (A) role is solely liable for the success and achievement of assigned tasks. This role has the authority to approve or veto any decision or activity related to the tasks, and is responsible for ensuring that the Responsible ® role has adequate resources and skills to perform the tasks2, p. 34. References: 2: COBIT 2019 Framework: Introduction and Methodology

The fact that the governance system includes many components that work together in a holistic way best enables a governance system to achieve governance and management objectives. A governance system is a set of components that provide direction, oversight, evaluation, monitoring, assurance, etc., for an enterprise’s information and technology. A governance objective is a desired outcome of the governance system for information and technology. A management objective is a desired outcome of the management processes for information and technology. The fact that the governance system includes many components that work together in a holistic way best enables a governance system to achieve governance and management objectives by providing a comprehensive and integrated approach that covers all aspects of information and technology governance and management, as well as by enabling customization and tailoring to suit different contexts, needs, priorities, etc.12 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System

The alignment goal titled “Delivery of IT services in line with business requirements” is most likely to be associated with the metric “percent of IT services with defined operational costs and expected benefits”. This metric measures the extent to which IT services are aligned with business needs and expectations, and deliver value for money. The alignment goal is one of the 17 enterprise goals defined in COBIT 2019, which describe the outcomes that an enterprise wants to achieve from its use of information and technology. The alignment goal is based on the COBIT 2019 Framework4, page 36. References: 4: COBIT 2019 Framework | Digital | English

 The number of focus areas describing a certain governance topic or issue that can be addressed by governance objectives is virtually unlimited. Focus areas are topics or issues that can be addressed by governance objectives, such as digital transformation, cybersecurity, privacy, etc. Focus areas can be defined by any stakeholder or group within or outside the enterprise, depending on their needs and interests. COBIT provides examples of some common focus areas, but they are not exhaustive or prescriptive.13 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution

The primary purpose of reexamining the IT strategic plan after IT governance has been operating for three years and is satisfactorily achieving desired outcomes is to assess improvement opportunities. The IT strategic plan is a document that defines the vision, mission, goals, objectives, strategies, and tactics for IT governance and management, as well as the alignment with the enterprise’s business strategy. By reexamining the plan periodically, the enterprise can identify any changes in the internal or external environment that may affect IT governance, as well as any areas for enhancement or optimization. The purpose is based on the COBIT 2019 Implementation Guide3, page 26. References: 3: COBIT 2019 Implementation Guide | Digital | English

 The chief information officer (CIO) ensures the board is kept informed of major decisions related to value delivery of I&T deployment in accordance with the enterprise strategy. The CIO is the senior executive responsible for leading, directing, and managing the information and technology function of the enterprise. The CIO has a strategic role in aligning I&T with business requirements, ensuring I&T performance, managing I&T risks, fostering innovation, etc. The CIO ensures the board is kept informed of major decisions related to value delivery of I&T deployment by providing regular reports, updates, feedback, recommendations, etc., as well as by participating in board meetings or committees.1 References: COBIT 2019 Framework: Introduction and Methodology, [COBIT 2019 Framework: Roles, Responsibilities & RACI Charts]

 A quantitative approach involves numeric mapping tables created for each of the design factors. According to the COBIT 2019 Design Guide, a quantitative approach is one of the four possible approaches for designing a governance system based on the design factors. A design factor is a characteristic of the enterprise that influences how the governance system should be designed. A quantitative approach uses numeric values to represent the impact of each design factor on the governance components, such as processes, organizational structures, roles, and practices. The numeric values are derived from mapping tables that show how each design factor affects each governance component. The mapping tables are based on empirical data, expert judgment, or best practices. The quantitative approach helps to provide a more objective and consistent way of designing a governance system that is tailored to the enterprise context and needs. References: : COBIT 2019 Design Guide: Designing an Information & Technology Governance Solution, page 54 : COBIT 2019 Design Guide: Designing an Information & Technology Governance Solution, page 56

The alignment goal titled “Knowledge, expertise and initiatives for business innovation” is aligned to the Learning and Growth dimension of the IT balanced scorecard (BSC). The IT BSC is a tool that translates the IT-related goals into a set of performance indicators that can be measured and monitored. The Learning and Growth dimension focuses on the capabilities and skills of the IT staff, as well as the culture and climate that foster innovation and learning. The alignment goal is based on the COBIT 2019 Framework5, page 38. References: 5: COBIT 2019 Framework | Digital | English

 A key consideration when finalizing a governance system design with competing priorities is that the enterprise should be prepared to deviate from previously identified priorities with justified reasons. According to the COBIT 2019 Design Guide, competing priorities are one of the common challenges that enterprises face when designing a governance system. Competing priorities may arise from different stakeholder expectations, requirements, preferences, perspectives, or interests. The COBIT 2019 Design Guide recommends that enterprises use a structured approach to resolve competing priorities, such as the COBIT 2019 Governance System Design Workflow. The workflow helps enterprises to identify and prioritize their improvement opportunities based on a gap analysis between their current and desired states of governance. However, the workflow also allows enterprises to adjust their priorities as needed during the design process, as long as they provide clear and rational reasons for doing so. For example, enterprises may deviate from their initial priorities due to changes in the business environment, stakeholder feedback, new insights, or emerging issues. The deviation from previously identified priorities should be documented and communicated to all relevant stakeholders to ensure transparency and alignment. References: : COBIT 2019 Design Guide: Designing an Information & Technology Governance Solution, page 32 2 : COBIT 2019 Design Guide: Designing an Information & Technology Governance Solution, page 34

In COBIT 2019, DevOps is classified as a design factor and a hybrid method. Design factors influence the tailoring of a governance system. As a hybrid method, DevOps combines development and operations practices, emphasizing continuous delivery and integration. This concept aligns with COBIT’s adaptable framework, which accommodates various focus areas and methodologies to enhance agility and responsiveness in IT processes​.

A focus area within COBIT is a topic that is relevant to governance and management of enterprise information and technology, and that requires additional guidance to address specific challenges or priorities. Digital transformation is one of the focus areas that COBIT provides guidance on, as it involves the use of technology to create new or modify existing business processes, culture, and customer experiences to meet changing business and market requirements1, p. 23. References: 1: COBIT 2019 Framework: Introduction and Methodology

Time-to-market is a market factor that is directly related to the enterprise goal of portfolio of competitive products and services. Time-to-market is the measure of how quickly an enterprise can deliver new or improved products or services to its customers. It affects the competitiveness, profitability, and customer satisfaction of the enterprise. Portfolio of competitive products and services is one of the 17 generic enterprise goals defined by COBIT that describes the desired outcome of providing products or services that meet customer needs and expectations, and that are superior to those offered by competitors.13 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance and Management Objectives

 The accountable (A) role drives a given task or process within an organizational structure chart (RACI chart). A RACI chart is a tool that assigns different levels of responsibility, accountability, consultation, and information to roles and organizational structures for each governance and management objective. The accountable (A) role means being answerable for the outcome or result of a task or process. There should be only one accountable role for each task or process, as having more than one can lead to confusion or conflict. The accountable role drives a given task or process by ensuring that it is performed effectively and efficiently, by providing direction and guidance, by resolving issues or conflicts, by approving changes or exceptions, etc.13 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Roles, Responsibilities & RACI Charts

A guiding principle in the development of COBIT is that COBIT aligns with other related and relevant I&T standards, frameworks and regulations. This is based on the principle of integration, which states that “governance of enterprise I&T should ensure integration into enterprise governance; alignment with other related standards, frameworks and regulations; and provision of a common language for all stakeholders” . COBIT does not include or replace other standards, frameworks or regulations, but rather complements them by providing a holistic and comprehensive approach to governance of enterprise I&T. 

Conducting a capabilities assessment must be done before an enterprise can determine performance measures for a process improvement initiative. A capabilities assessment is a method of measuring and evaluating how well a process or activity is performed in terms of effectiveness, efficiency, completeness, reliability, etc. A capabilities assessment can be done using different models or frameworks, such as CMMI or ISO/IEC 15504. A capabilities assessment helps an enterprise to determine performance measures for a process improvement initiative by providing a baseline or benchmark for the current state of a process, as well as identifying its strengths, weaknesses, gaps, and improvement opportunities.13 References: COBIT 2019 Framework: Introduction and Methodology, COBIT Process Assessment Model (PAM): Using COBIT 5

 After IT department goals have been aligned with enterprise goals, the next step is to link the alignment goals with governance and management objectives. Alignment goals are the intermediate goals that link the enterprise goals with the governance and management objectives. Governance and management objectives are the desired outcomes of the governance system for information and technology. Alignment goals are derived from the enterprise goals, which reflect the stakeholder drivers and needs. Governance and management objectives are derived from the alignment goals, which reflect how information and technology can support the enterprise strategy and objectives.14 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System

 The transition from traditional waterfall to a more agile approach would impact the implementation method step in the design phase the most. The implementation method is the approach or strategy that is used to put the IT governance system into practice. The design phase is the stage in the IT governance life cycle that involves customizing and tailoring the IT governance system to the specific needs and context of the enterprise. The transition from traditional waterfall to a more agile approach would affect the implementation method step in the design phase because it would require a different way of planning, executing, monitoring, and controlling the IT governance system, as well as a different set of skills, tools, techniques, and practices.12 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution

The IT governance implementation approach that should be utilized in order to achieve maximum enterprise benefits is treating implementation as a program. A program is a coordinated set of projects and activities that are designed to achieve a specific set of objectives within a defined scope, time frame, and budget. Treating implementation as a program helps to ensure that IT governance is planned, executed, monitored, controlled, and evaluated in a systematic and consistent manner, following best practices and standards. The approach is based on the COBIT 2019 Implementation Guide5, page 29. References: 5: COBIT 2019 Implementation Guide | Digital | English

COBIT 2019 highlights the importance of detailed documentation of process activities to support governance and management practices. By mapping these activities, organizations can clearly understand how procedures align with governance objectives and regulatory requirements. Detailed process mapping aids in ensuring consistent performance, compliance, and alignment with enterprise goals, specifically within the framework’s governance system components​.

When assessing organizational structures, it is most helpful when subcriteria for each criterion are defined and linked to capability levels. Organizational structures are the arrangements of roles and responsibilities that enable the enterprise to achieve its objectives. Organizational structures can be assessed using six criteria: clarity, comprehensiveness, integration, alignment, authority, and accountability. Each criterion can be further divided into subcriteria that describe the specific aspects or attributes of the criterion. Capability levels are the measures of how well a process or activity is performed in terms of effectiveness, efficiency, completeness, reliability, etc. Capability levels can range from 0 (incomplete) to 5 (optimizing). Defining and linking subcriteria to capability levels helps to evaluate the current and desired state of organizational structures, as well as to identify gaps and improvement opportunities.123 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution, COBIT 2019 Framework: Roles, Responsibilities & RACI Charts

The process ‘Ensured Stakeholder Engagement’ (EDM04) is one of the governance processes in COBIT 2019 that involves establishing transparent communication with stakeholders about their needs and expectations from information and technology governance. This process also involves ensuring stakeholder involvement in governance decision making and monitoring stakeholder satisfaction with governance outcomes. One of the roles that is best suited for this responsibility is the board and executive management, who are the highest-level governance body and decision makers in an enterprise. The board and executive management have a duty to ensure that they understand the needs and expectations of various stakeholders such as shareholders, regulators, customers, employees, suppliers, etc., and that they communicate effectively with them about the enterprise’s strategy, objectives, performance, risks, issues, opportunities, etc., related to information and technology governance. The board and executive management also have a responsibility to involve stakeholders in governance decision making by soliciting their input, feedback, opinions, suggestions, etc., and by considering their interests and perspectives when making governance choices. The board and executive management also have a role in monitoring stakeholder satisfaction with governance outcomes by measuring stakeholder value realization from information and technology investments and initiatives.References: : COBIT 2019 Process Reference Guide: Governance and Management Objectives, page 25-27 : COBIT 2019 Framework: Governance and Management Objectives, page 19-20

 According to the COBIT 2019 Framework: Governance and Management Objectives, one of the good practices with regard to performance management of organizational structures is to ensure that organizational meeting reports/minutes are available and meaningful to ensure transparency. This means that the outcomes and decisions of the meetings are documented and communicated to relevant stakeholders in a timely manner, and that they provide sufficient information to support accountability and learning. Transparency is one of the key principles of effective governance of enterprise I&T.4, p. 32-33 References: 4: COBIT 2019 Framework: Governance and Management Objectives

The information security function within the IT corporate structure is responsible for classifying information using an agreed-upon classification scheme for a new data collection system. According to the COBIT 2019 Implementation Guide, information security is one of the key enablers of IT governance and management, and it includes the processes and practices for ensuring the confidentiality, integrity, and availability of information assets. One of the activities of information security is to define and implement an information classification scheme that categorizes information based on its sensitivity, criticality, and value to the enterprise. This scheme helps to determine the appropriate level of protection and controls for different types of information, especially for new data collection systems that may involve personal or sensitive data. References: : COBIT 2019 Implementation Guide: Implementing and Optimizing an Information and Technology Governance Solution, page 15 1 : COBIT 2019 Design Guide: Designing an Information & Technology Governance Solution, page 62 .

The focus of an enterprise that has a cost leadership strategy design factor is short-term cost minimization. A cost leadership strategy is a competitive strategy that aims to achieve lower costs than competitors by offering standardized products or services at low prices. A cost leadership strategy design factor affects how an enterprise designs its governance system, as it implies a focus on operational efficiency, process automation, economies of scale, outsourcing, etc. An enterprise that has a cost leadership strategy design factor would prioritize short-term cost minimization over long-term cost optimization or medium-term cost equalization.12 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution

The EGIT business case outline and details are documents that describe the rationale, objectives, scope, approach, benefits, costs, risks, and timeline of the EGIT implementation program. The EGIT business case outline and details provide the basis for obtaining approval, funding, resources, and support for the program from the stakeholders. The responsibility for developing an EGIT business case outline and details resides with the CIO and program steering committee. The CIO is the senior executive responsible for leading and managing the information and technology function in an enterprise. The CIO has a role in developing, reviewing, validating, and approving the EGIT business case outline and details, ensuring that they are aligned with the enterprise’s strategy, objectives, needs, and expectations. The CIO also has a role in communicating and presenting the EGIT business case outline and details to other stakeholders such as the board, executives, business managers, IT managers, etc., and obtaining their buy-in and commitment for the program. The program steering committee is a group of senior stakeholders who provide strategic direction, oversight, guidance, and approval for the EGIT implementation program. The program steering committee has a role in developing, reviewing, validating, and approving the EGIT business case outline and details, ensuring that they are consistent with the enterprise’s vision, mission, values, strategy goals,and objectives. The program steering committee also has a role in monitoring and controlling the execution of the EGIT implementation program plan against the EGIT business case outline and details34 References: 3: COBIT 2019 Implementation Guide: page 37-38 4: COBIT 2019 Implementation Guide: page 39-40

 A process can meet a higher capability level if all activities of that level are successfully performed, in addition to the activities of lower levels. The capability levels range from 0 (incomplete) to 5 (optimizing), and each level has a set of generic attributes that describe the expected performance of the process activities2, p. 30. References: 2: COBIT 2019 Framework: Introduction and Methodology

The capability levels are a measure of how well an enterprise performs its information and technology governance and management processes in terms of process attributes such as process performance, process definition, process deployment, process measurement, process control, process optimization etc. The capability levels range from 0 (incomplete) to 5 (optimizing), indicating the degree of maturity and effectiveness of an enterprise’s information and technology governance and management processes. The targeted capability levels are the desired levels of performance that an enterprise wants to achieve for its information and technology governance and management processes, based on its strategy, objectives, needs, and expectations. The targeted capability levels provide a basis for defining the improvement goals and objectives for the processes. The capability-level gap analysis is a process that involves comparing the current capability levels of an enterprise’s information and technology governance and management processes with the targeted capability levels, and identifying the gaps or differences between them. The capability-level gap analysis helps to determine the improvement actions and initiatives that are required to close the gaps and achieve the targeted capability levels. The primary benefit or output derived from setting targeted capability levels and performing a capability-level gap analysis for selected processes is identification of process improvement opportunities. This means that by setting targeted capability levels and performing a capability-level gap analysis for selected processes, an enterprise can identify the areas of weakness or inefficiency in its information and technology governance and management processes, and determine the potential solutions or enhancements that can improve its process performance, quality, value, etc. This will also help to align the information and technology governance system with the enterprise’s strategy and objectives.References: : COBIT 2019 Design Guide: page 53-54 : COBIT 2019 Process Assessment Model: page 11-13

 The COBIT principle that addresses the need to consider how changes in technology or strategy impact the enterprise governance system as a whole is that a governance system should be dynamic. This principle states that “a governance system should be responsive to changing stakeholder needs, conditions and options; adaptable to changing circumstances; able to learn from experience; and innovative in supporting continual improvement” 4. A dynamic governance system can anticipate and respond to changes in the internal and external environment, such as new technologies, business models, risks, or opportunities5. References: 4: COBIT 2019 Framework: Introduction and Methodology, page 23 5: COBIT 2019 Framework: Governance and Management Objectives, page 20

 The objectives of the Evaluate, Direct and Monitor (EDM) domain are best described by assessing strategic options and guiding senior management on the options chosen. This domain covers the governance activities related to setting direction, monitoring performance, ensuring compliance, and providing feedback to stakeholders. The domain consists of five governance objectives: EDM01 Ensure Governance Framework Setting and Maintenance, EDM02 Ensure Benefits Delivery, EDM03 Ensure Risk Optimization, EDM04 Ensure Resource Optimization, and EDM05 Ensure Stakeholder Transparency. The domain is based on the COBIT 2019 Framework2, page 30. References: 2: COBIT 2019 Framework | Digital | English

The principle that the governance framework should allow for flexibility in addressing new issues is an important principle of a proper governance framework. A governance framework is a conceptual model or structure that defines the key elements, relationships, and principles of a governance system. A proper governance framework should follow certain principles or guidelines that ensure its effectiveness, efficiency, and alignment with the enterprise goals and objectives. The principle that the governance framework should allow for flexibility in addressing new issues is an important principle of a proper governance framework because it helps to ensure that the governance system can adapt to changes in the internal or external environment, stakeholder needs, business objectives, etc.13 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution

The internal audit function is an independent and objective assurance and consulting activity that evaluates and improves the effectiveness of governance, risk management, and control processes in an enterprise. The internal audit function has a role in defining the EGIT target state, which is the desired state of information and technology governance in an enterprise that is aligned with its strategy, objectives, and stakeholder needs. The role of the internal audit function in this process is to provide advice and assist with target-state positioning and gap priorities. This means that the internal audit function can help to identify the current state of information and technology governance in an enterprise, assess the gaps and issues that need to be addressed, determine the target state of information and technology governance that is optimal for the enterprise, and prioritize the actions and initiatives that are required to achieve the target state. The internal audit function can also provide assurance on the design and implementation of the EGIT target state by evaluating its adequacy, effectiveness, efficiency, and compliance.References: : COBIT 2019 Implementation Guide, page 51-52 : COBIT 2019 Framework: Introduction and Methodology, page 30-31

The governance system in COBIT 2019 includes various components that support the effective management and control of enterprise IT. "Services, infrastructure, and applications" is one such component, encompassing the physical and virtual tools required for IT operations. This component ensures that the technology systems align with the enterprise's strategic objectives, as outlined in the COBIT core model (specifically in the framework sections on governance components). This is part of delivering and supporting IT services to meet business needs effectively​.

The CIO and the program steering committee are responsible for performing a stakeholder satisfaction survey and gathering feedback on lessons learned from the implementation of an EGIT program plan. According to the COBIT 2019 Implementation Guide, the CIO is the executive sponsor of the EGIT program, who provides strategic direction, leadership, and oversight for the program. The program steering committee is a group of senior stakeholders who support the CIO in governing and monitoring the program. One of their responsibilities is to conduct regular reviews of the program performance and outcomes, including stakeholder satisfaction and lessons learned. These reviews help to evaluate the effectiveness and efficiency of the EGIT program plan and identify areas for improvement. References: : COBIT 2019 Implementation Guide: Implementing and Optimizing an Information and Technology Governance Solution, page 23 1 : COBIT 2019 Implementation Guide: Implementing and Optimizing an Information and Technology Governance Solution, page 45 1

The planning for a new governance framework requires defining the inputs that will guide the design and implementation of the framework. One of the most important inputs is the enterprise goals, which are the high-level statements of what the enterprise wants to achieve in terms of its mission, vision, values, and strategy. The enterprise goals provide the direction and purpose for the governance framework, and help to align the governance objectives, enablers, principles, and practices with the enterprise’s needs and expectations. The enterprise goals also help to identify the relevant stakeholders, their roles and responsibilities, and their requirements and expectations from the governance framework34 References: 3: COBIT 2019 Framework: Introduction and Methodology, page 25-26 4: COBIT 2019 Design Guide, page 23-24

 Culture, ethics and behavior are the most likely components of a governance system to be underestimated as factors in the success of governance and management activities. Culture, ethics and behavior are the shared values, beliefs, norms, and attitudes that influence how people behave and interact within an enterprise. They affect the motivation, commitment, collaboration, and performance of people, as well as the trust and reputation of the enterprise. Culture, ethics and behavior are one of the seven enablers of a governance system, as defined by COBIT.12 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System

Innovation and differentiation are examples of enterprise objectives design factors. Design factors are the characteristics or aspects of an enterprise that influence the design and implementation of a governance system. They include factors such as enterprise size, industry sector, risk profile, regulatory environment, sourcing model, etc. Enterprise objectives are the specific goals or targets that an enterprise sets to achieve its vision and mission. They are derived from the stakeholder drivers and needs, and are influenced by the design factors. Innovation and differentiation are two possible design factors that affect how an enterprise defines its objectives.12 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution

Enterprise governance of information and technology (EGIT) is an integral part of corporate governance. Corporate governance is the system by which an enterprise is directed and controlled by its board, management, shareholders, and other stakeholders. Corporate governance aims to ensure that the enterprise achieves its goals and objectives, creates value for its stakeholders, complies with laws and regulations, operates ethically and responsibly, etc. EGIT is the subset of corporate governance that deals specifically with information and technology. EGIT aims to ensure that information and technology support the enterprise strategy and objectives, create value for the enterprise and its stakeholders, optimize risks and resources, etc.13 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System

IT-related issues should be considered as part of the design factors for a governance system in order to manage risks that have a high impact. Design factors are the characteristics of the enterprise that influence the design and operation of a governance system, such as size, industry, culture, strategy, etc. IT-related issues are one of the 11 design factors defined in COBIT 2019, and they refer to the specific challenges or opportunities that arise from the use of information and technology in the enterprise, such as cybersecurity, digital transformation, innovation, etc. These issues may pose significant risks to the enterprise’s objectives, performance, or reputation, and therefore need to be addressed by the governance system. The answer is based on the COBIT 2019 Design Guide1, page 15. References: 1: COBIT 2019 Design Guide | Digital | English.

The Skills Framework for the Information Age (SFIA) has been used as a basis for developing guidance for the COBIT governance component of people, skills and competencies. SFIA is a globally recognized framework that describes the skills required by professionals who work with information and technology2, p. 36. References: 2: COBIT 2019 Framework: Introduction and Methodology

The process activities component of governance and management objectives includes the expected capability level. A process activity is a specific task or action that contributes to achieving a process outcome or objective. A capability level is a measure of how well a process or activity is performed in terms of effectiveness, efficiency, completeness, reliability, etc. A capability level can range from 0 (incomplete) to 5 (optimizing). Each governance and management objective in COBIT defines a set of process activities that are required to achieve it, as well as an expected capability level for each activity.12 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance and Management Objectives

The pursuit of continuous improvement is the most essential attribute of the highest process capability level (Level 5). A process capability level is a measure of how well a process or activity is performed in terms of effectiveness, efficiency, completeness, reliability, etc. A process capability level can range from 0 (incomplete) to 5 (optimizing). Level 5 (optimizing) means that the process continuously improves its performance through both incremental and innovative improvements. The pursuit of continuous improvement is the most essential attribute of Level 5, as it implies that the process is constantly monitored, evaluated, learned from, and enhanced.14 References: CMMI for Development, Version 1.3, CMMI Institute - Capability Maturity Model Integration

The high involvement of IT-related roles in organizational structures is a critical requirement when the IT function is strategic and crucial to the success of the business. The IT function is the part of the enterprise that is responsible for planning, delivering, operating, and supporting information and technology services. The IT function can have different levels of strategic importance for the business, depending on the nature, scope, and objectives of the enterprise. When the IT function is strategic and crucial to the success of the business, it means that information and technology are essential for creating value, achieving competitive advantage, enabling innovation, etc. In this case, it is critical to have high involvement of IT-related roles in organizational structures, such as having IT representation at the board level, having clear IT leadership roles and responsibilities, having effective IT governance committees or forums, etc.13 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Roles, Responsibilities & RACI Charts

 The figure in option C best illustrates the context of an enterprise governance of information and technology (EGIT) system because it shows how the EGIT system is influenced by the enterprise’s internal and external environment, and how it influences the enterprise’s governance system and IT-related goals. The figure also shows the four EGIT domains: Evaluate, Direct and Monitor (EDM), Align, Plan and Organize (APO), Build, Acquire and Implement (BAI), and Deliver, Service and Support (DSS). The figure is based on the COBIT 2019 Framework1, page 23. References: 1: COBIT 2019 Framework | Digital | English

 COBIT defines stakeholder value creation as the realization of benefits at an optimal resource cost while optimizing risk. This is based on the principle of balance, which states that “governance of enterprise I&T should ensure that stakeholder needs, conditions and options are evaluated to determine balanced, agreed-on enterprise objectives to be achieved; setting direction through prioritization and decision making; and monitoring performance and compliance against agreed-on direction and objectives” . Value creation is not only about reducing costs or mitigating risks, but also about optimizing them in relation to the expected benefits. 

 The “managed innovation” management objective of the COBIT core model best describes the outcome of achieving competitive advantage, improving customer experience and improving operational effectiveness. A management objective is a desired outcome of the management processes for information and technology. Managed innovation is one of the 40 management objectives defined by COBIT that describes how to identify, prioritize, and execute innovation initiatives that support the enterprise strategy and objectives. Achieving competitive advantage, improving customer experience and improving operational effectiveness are some of the benefits of managed innovation.12 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance and Management Objectives

 The key program roles are the roles that are responsible for leading, directing, managing, supporting, and executing the EGIT implementation program. The nomination of these roles is a critical step in creating the appropriate governance environment for the program. One of the roles that should be involved in this nomination process is the board and executives, who are the highest-level governance body and decision makers in an enterprise. The board and executives provide strategic direction, oversight, guidance, and approval for the EGIT implementation program. They also ensure that the program is aligned with the enterprise’s vision, mission, values, strategy, goals, and objectives. The board and executives also appoint or endorse other key program roles such as the program sponsor, program manager, program steering committee, change champion network, etc.References: : COBIT 2019 Implementation Guide, page 37-38 : COBIT 2019 Framework: Governance and Management Objectives, page 19-20

The enterprise goal titled quality of management information is within the customer dimension of the IT balanced scorecard. The customer dimension focuses on how well the enterprise meets the needs and expectations of its customers and stakeholders. Quality of management information is one of the 17 generic enterprise goals defined by COBIT that supports the customer dimension. It describes the desired outcome of providing accurate, timely, relevant, and reliable information to support decision making and performance management.13 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance and Management Objectives

 One of the benefits derived from the use of COBIT is that it helps to ensure compliance with applicable rules and regulations. This benefit is primarily associated with an external stakeholder, such as a regulator, auditor, customer, or partner, who expects the enterprise to adhere to certain standards and requirements. COBIT provides guidance on how to align the governance and management of enterprise IT with relevant laws, regulations, and contractual obligations12. COBIT also helps to establish and maintain a compliance culture and program within the enterprise3. References: 1: COBIT 2019 Framework: Introduction and Methodology, page 17 2: COBIT 2019 Framework: Governance and Management Objectives, page 19 3: COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution, page 77

 The most critical factor to ensuring the objective of managed availability and capacity is to predict future IT resource requirements based on current and projected business needs, service levels, and performance targets. This factor enables the enterprise to plan, provision, and optimize IT resources in a timely and cost-effective manner, while ensuring that IT services are delivered with sufficient availability and capacity to meet business demands. The factor is based on the COBIT 2019 Design Guide2, page 77. References: 2: COBIT 2019 Design Guide | Digital | English

The function of a mapping table when determining the initial scope of a new governance system is to indicate the relevance of a governance or management objective with a particular design factor. A mapping table is a tool that helps to identify and prioritize the governance and management objectives that are most applicable and important for the enterprise, based on its specific characteristics and context. A design factor is one of the characteristics of the enterprise that influence the design and operation of a governance system, such as size, industry, culture, strategy, etc. A mapping table shows the degree of relevance of each governance and management objective with each design factor, using a scale from 0 (not relevant) to 5 (very relevant). The function is based on the COBIT 2019 Design Guide, page 23. References: : COBIT 2019 Design Guide | Digital | English

The best starting point when translating enterprise goals into actionable governance and management objectives is prioritized enterprise goals. The enterprise goals are the high-level statements of what an enterprise wants to achieve in terms of its mission, vision, values, strategy, etc. The enterprise goals are aligned with the stakeholder needs that reflect the expectations and requirements of various internal and external parties that have an interest or stake in the enterprise’s information and technology activities. The prioritized enterprise goals are the subset of enterprise goals that have been ranked according to their importance or urgency for the enterprise based on its context and needs. By starting with prioritized enterprise goals when translating them into actionable governance and management objectives, an enterprise can ensure that it focuses on the most critical aspects of its information and technology governance that support its strategy and objectives. This will also help to align its information and technology activities with its stakeholder needs34 References: 3: COBIT 2019 Framework: Introduction and Methodology: page 25-26 4: COBIT 2019 Design Guide: page 35-36