CyphrQ
Menu

COBIT 2019 Explained: Objectives, Design Factors and Audits

COBIT 2019 is ISACA's IT governance framework. What its 40 objectives and design factors are, whether you can be certified, and how auditors use it.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

9 min read

COBIT 2019 is ISACA's framework for governing and managing enterprise information and technology. It is guidance, not a certifiable standard. It gives you 40 governance and management objectives to pick from, plus a method for tailoring them to your organisation. Auditors use it as a yardstick for how well IT is run, and boards use it to ask better questions of IT.

This article is part of the Frameworks subtopic.

What is COBIT 2019 and who publishes it?

ISACA, the professional association for audit, governance and security practitioners, publishes it. The organisation's COBIT page describes it as a framework for the governance and management of enterprise information and technology, often shortened to I&T, and says it is built to work alongside other standards and regulations.

ISACA's press release of 11 December 2018 says COBIT 2019 launched the month before, so November 2018. It replaced COBIT 5.

Two terms are worth defining first. Governance is how the board and senior leaders decide what IT should achieve and check that it does. Management is how the IT organisation plans, builds and runs things to deliver that. COBIT covers both, and keeps them separate on purpose.

ISACA's published core set is a small library:

  • the framework introduction and methodology;
  • the governance and management objectives volume;
  • the Design Guide and the Implementation Guide;
  • focus-area guides on DevOps, information and technology risk, information security, and implementing the NIST Cybersecurity Framework;
  • a version for small and medium enterprises.

The guidance itself is ISACA's copyrighted work. I describe it in my own words and do not reproduce its text.

What does COBIT 2019 cover?

It covers the full span of how an organisation directs and runs technology: strategy, risk, delivery, operations, security and assurance. The core model groups its 40 objectives into five domains. ISACA's white paper on AI system governance names them.

Domain Plain-language question Example objective
Evaluate, Direct and Monitor (EDM) Is the board setting direction and checking results? EDM03, risk optimisation
Align, Plan and Organize (APO) Is IT planned, organised and resourced to fit the business? APO12, managed risk
Build, Acquire and Implement (BAI) Are solutions built, bought and changed in a controlled way? BAI06, managed IT changes
Deliver, Service and Support (DSS) Do services run, and are they secure? DSS05, managed security services
Monitor, Evaluate and Assess (MEA) Is performance, internal control and compliance checked? MEA02, managed system of internal control

EDM is the governance domain. The other four are management. Each objective is linked to related processes and to goals: ISACA's page says the core model matches each objective to alignment goals and enterprise goals, so you can trace from "what the business wants" to "which objectives matter most".

Where did the 40 come from? ISACA's COBIT 2019 and COBIT 5 comparison says the number of processes rose from 37 to 40. Three were added: APO14 (managed data), BAI11 (managed projects) and MEA04 (managed assurance).

What are COBIT 2019 design factors?

Design factors are the characteristics of your organisation that change which objectives deserve the most effort. They are the biggest change from COBIT 5. The same comparison page says COBIT 5 had none and COBIT 2019 introduced 11.

ISACA's materials mention factors such as enterprise strategy, enterprise goals, risk profile, I&T-related issues, threat landscape, compliance requirements, the role of IT, the sourcing model, IT implementation methods, technology adoption strategy and enterprise size. I have not read the Design Guide itself, so treat that as a flavour, not the official list.

The Design Guide turns this into four steps, according to ISACA's release:

  1. Understand the context and strategy.
  2. Determine the initial scope.
  3. Refine that scope.
  4. Resolve conflicts and conclude the design.

The point is stated in an ISACA article on custom COBIT design: "there is no such thing as a one-size-fits-all governance system for enterprise I&T." A bank with heavy regulation and a small software firm should not end up with the same priorities.

Who uses COBIT 2019, and can you be certified?

You cannot certify an organisation against COBIT 2019 in the way you can against ISO/IEC 27001. I found only individual credentials on ISACA's credentialing page: a COBIT Foundation Certificate and a COBIT Design & Implementation Certificate Program, plus a network of accredited training partners. No organisation-level certificate is listed there. If a supplier says it is "COBIT certified", ask whether they mean that staff hold the certificate.

Users are mostly organisations that want a common language between the board, IT, risk and audit teams. ISACA's COBIT case studies list central banks, utilities, government bodies and commercial firms, including the Central Bank of Nigeria and Generali Group.

In practice, the National Bank of Angola shows what adoption looks like. The ISACA Journal account, by Bruno Horta Soares, published on 24 May 2023, says the bank began in 2019. Regional guidelines from the Southern African Development Community (SADC) mainly drove the programme. The bank's executive board chose COBIT 2019 over COBIT 5.

Reported results include:

  • about 60 employees completed COBIT 2019 Foundation training;
  • capability was assessed for 17 processes;
  • nearly 300 improvement opportunities were identified, grouped into 15 initiatives.

The article refers to 16 SADC objectives in one place and 17 processes in scope in another, and does not explain the difference. I report both as written.

How does COBIT 2019 relate to other frameworks and standards?

  • ITIL and ISO/IEC 20000-1: these focus on IT service management, a narrower slice that sits mostly inside the DSS domain. See the ISO/IEC 20000-1 explainer.
  • ISO/IEC 27001: a certifiable management system standard for information security. COBIT is wider than security but has a focus-area guide for it. See ISO/IEC 27001 explained.
  • NIST Cybersecurity Framework: ISACA publishes a focus-area guide on implementing it with COBIT, which shows the two are meant to be combined.
  • IT general controls: the control areas auditors test sit under several COBIT objectives. See IT general controls explained.

How does a COBIT 2019 audit or adoption work in practice?

There is no COBIT certification audit. Instead, COBIT gets used in two ways.

As an adoption project. The Implementation Guide, which ISACA says updates the COBIT 5 guide and incorporates the design factors, lays out a roadmap for continuous improvement. A typical pattern, visible in the Angola case, is: train a core team, design the governance system, assess how mature each chosen process is, set a target, and plan initiatives to close the gap.

As audit criteria. An internal or external auditor picks the objectives relevant to the audit and tests whether your practices achieve them. ISACA also lists related products, including a COBIT for DevOps Audit Program and IT Control Objectives for Sarbanes-Oxley, 4th Edition. The result is a finding against a named objective, not a pass or fail certificate.

Going deeper: for security and IT teams

This section assumes you have seen audit work and want to use COBIT without turning it into paperwork.

Scope with the design factors, not all 40 objectives. The usual failure is adopting every objective at the same depth. Use the Design Guide's four steps to rank objectives by your context, and record why lower-ranked ones are deprioritised. Keep that scoping record, because an auditor will ask how your scope was decided.

Objective IDs and practice IDs. Objectives carry a domain code and number (BAI06). Practices beneath them add a suffix, such as BAI03.06 or MEA04.06, which appear in ISACA's AI governance white paper. Cite the practice ID in your control register so each control traces to something a reviewer can look up.

A starter mapping for security and audit teams. This is my own working map, not an ISACA crosswalk.

Audit concern Objectives to start from
Change management BAI06, managed IT changes
Security operations and access DSS05, managed security services
Risk management EDM03 and APO12
Data governance APO14, managed data
Internal control and compliance monitoring MEA02 and MEA03
Independent assurance MEA04, managed assurance

For the control tests behind several of these rows, see IT general controls explained and auditing user access reviews.

Capability levels. ISACA's comparison page says COBIT 2019 measures capability on a 0 to 5 scale and bases performance management on the CMMI Performance Management Scheme, replacing the ISO/IEC 33000-based scale of COBIT 5. Assess each in-scope process, set a target level tied to a business goal, and record the gap. Angola's team logged each missing COBIT practice as an improvement opportunity, which gave them a countable backlog.

Evidence an auditor will ask for.

  • The scoping record: which design factor values you chose and who agreed them.
  • A mapping from each in-scope objective to your policies, procedures and owners.
  • Operating evidence per control, such as change tickets, access review sign-offs, risk register entries and monitoring reports.
  • Capability assessment working papers, not just the summary score.
  • Evidence that findings led to tracked actions, with owners and dates.

Common weaknesses, described generally. Controls mapped on a spreadsheet but never evidenced; target capability levels chosen without a business reason; governance objectives (EDM) owned by IT management instead of the board; and a one-off assessment never repeated, so the scores cannot show change over time. These are patterns I would expect, not figures from a report.

Questions to ask.

  • Which objectives are in scope, and which design factor values drove that?
  • Who is the owner of each objective, and is it a role at the right level?
  • How does the framework map to the certifiable standards we already hold?
  • When did we last reassess capability, and what changed?

Learn more

  • ISACA COBIT credentialing: ISACA's own page for the COBIT Foundation certificate, the Design & Implementation certificate program and accredited training partners.
  • ISACA's COBIT page: the official overview of the core model and the guides.

Key takeaways

  • COBIT 2019 is ISACA's guidance for governing and managing enterprise I&T. It is not certifiable at the organisation level; individuals can take ISACA certificates.
  • The core model has 40 objectives in five domains: EDM, APO, BAI, DSS and MEA.
  • Design factors, introduced in 2019, tell you which objectives matter most for your context. ISACA says there are 11.
  • Auditors use COBIT as criteria and report against named objectives, not a pass or fail certificate.
  • The National Bank of Angola example shows the usual path: train, design, assess capability, set targets, plan initiatives.
  • Start with a short list of objectives and keep the evidence for why you chose them.

Sources