When assessing organizational structures, it is most helpful when subcriteria for each criterion are

defined and linked to capability levels. Organizational structures are the arrangements of roles and

responsibilities that enable the enterprise to achieve its objectives. Organizational structures can be

assessed using six criteria: clarity, comprehensiveness, integration, alignment, authority, and

accountability. Each criterion can be further divided into subcriteria that describe the specific aspects

or attributes of the criterion. Capability levels are the measures of how well a process or activity is

performed in terms of effectiveness, efficiency, completeness, reliability, etc. Capability levels can

range from 0 (incomplete) to 5 (optimizing). Defining and linking subcriteria to capability levels helps

to evaluate the current and desired state of organizational structures, as well as to identify gaps and

improvement opportunities.123 Reference: COBIT 2019 Framework: Introduction and

Methodology, COBIT 2019 Design Guide: Designing an Information and Technology Governance

Solution, COBIT 2019 Framework: Roles, Responsibilities & RACI Charts

To gain the greatest benefit from the COBIT framework, a stakeholder should have a certain level of

experience and a thorough understanding of the entire enterprise. A stakeholder is a person or group

that has an interest or concern in an enterprise’s activities or outcomes. Examples of stakeholders

are board members, executives, managers, employees, customers, suppliers, regulators, etc. To gain

the greatest benefit from the COBIT framework, a stakeholder should have a certain level of

experience in I&T governance or management practices, as well as a thorough understanding of the

entire enterprise’s vision, mission, values, goals, objectives, strategies, processes, culture, etc. This

would help them to apply the COBIT framework effectively and efficiently to their specific context

and needs.1 Reference: COBIT 2019 Framework: Introduction and Methodology, [COBIT 2019

Framework: Stakeholder Needs]

An IT implementation method design factor is a characteristic that influences how an enterprise

implements IT solutions and services. DevOps is an IT implementation method that focuses on

software building, deployment and operations, by integrating development and operations teams to

improve collaboration and productivity1, p. 31. Reference: 1: COBIT 2019 Framework: Introduction

and Methodology

The EGIT implementation life cycle consists of four stages: initiating an EGIT program, defining the

EGIT implementation road map, developing the EGIT implementation program plan, and executing

the EGIT implementation program plan. The third stage, developing the EGIT implementation

program plan, involves identifying and defining the success metrics for the EGIT continual

improvement program. These metrics should be aligned with the enterprise goals and objectives,

and should measure the performance and outcomes of the EGIT processes and practices. The success

metrics should also be SMART (specific, measurable, achievable, relevant, and time-bound), and

should be communicated to all stakeholders involved in the EGIT program. Reference: : COBIT 2019

Design Guide: Designing an Information & Technology Governance Solution, page 26 1 : COBIT 2019

Design Guide: Designing an Information & Technology Governance Solution, page 41

The management objective that would be given higher priority in an enterprise’s governance system

when the enterprise is very risk-averse is managed portfolio. This objective relates to ensuring that

IT-enabled investments are aligned with the enterprise’s risk appetite and tolerance levels, and that

they deliver optimal value and benefits. This objective also involves managing the portfolio of IT-

enabled investments throughout their life cycle, from initiation to retirement. The objective is based

on the COBIT 2019 Design Guide3, page 71. Reference: 3: COBIT 2019 Design Guide | Digital | English

Sharing the return on investment (ROI) analysis is the best way to address the concern of business

line managers who perceive the cost of governance-required improvements as too expensive. ROI is

a financial metric that measures the profitability or efficiency of an investment by comparing its

benefits and costs. ROI analysis is a process of calculating and presenting the ROI of a project or

program, as well as its assumptions, risks, and uncertainties. Sharing the ROI analysis with business

line managers can help to address their concern by showing them how the governance-required

improvements will generate value for the enterprise in terms of increased revenue, reduced costs,

enhanced performance, improved quality, etc., as well as how they will outweigh their initial and

ongoing costs.12 Reference: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019

Implementation Guide: Implementing an Information and Technology Governance Solution

The alignment goal titled “Delivery of IT services in line with business requirements” is most likely to

be associated with the metric “percent of IT services with defined operational costs and expected

benefits”. This metric measures the extent to which IT services are aligned with business needs and

expectations, and deliver value for money. The alignment goal is one of the 17 enterprise goals

defined in COBIT 2019, which describe the outcomes that an enterprise wants to achieve from its use

of information and technology. The alignment goal is based on the COBIT 2019 Framework4, page

36. Reference: 4: COBIT 2019 Framework | Digital | English

When tailoring the COBIT organization structure to organizational context and priorities, the next

step after mapping organizational structures with specific responsibility or accountability is to add

two levels of involvement for consulted and informed. This step helps to identify the stakeholders

who need to be involved in the decision-making process, either by providing input or feedback

(consulted), or by being notified of the outcomes or actions (informed). This step is based on the

COBIT 2019 Implementation Guide2, page 46. Reference: 2: COBIT 2019 Implementation Guide |

Digital | English

The strategy archetype is a design factor that describes how an enterprise uses information and

technology to achieve its goals and objectives. There are six strategy archetypes defined in COBIT

2019: customer intimacy, product leadership, operational excellence, compliance-driven, data-

driven, and innovation-driven. Each archetype has different implications for the governance and

management of information and technology in terms of focus areas, processes, practices, roles,

structures, and metrics. The best approach when determining which strategy archetype most closely

aligns with an enterprise’s own strategy is to select the one that reflects the enterprise’s information

and technology risk profile, which is another design factor that describes how an enterprise

identifies, assesses, responds to, monitors, and reports on information and technology risks. The risk

profile helps to determine the level of risk appetite and tolerance that an enterprise has for its

information and technology activities, as well as the level of control and assurance that is required

for its governance framework. By selecting the strategy archetype that matches the risk profile, an

enterprise can ensure that its governance framework is appropriate for its context and

objectives5 Reference: 5: COBIT 2019 Design Guide, page 35-39 : COBIT 2019 Design Guide, page 41-

43

The board is responsible for the oversight of structures and mechanisms that drive enterprise

governance of information and technology (EGIT). According to the ISACA Journal article, “the board

is ultimately accountable for EGIT and should oversee its establishment and monitor its

effectiveness” . The board should also ensure that EGIT aligns with the enterprise governance

framework and supports the achievement of enterprise objectives.