COBIT: The IT Governance Framework Explained

COBIT (Control Objectives for Information and Related Technologies) is a framework for the governance and management of enterprise IT, published by ISACA, the professional association for IT audit, risk and governance. It helps boards and executives make sure technology delivers value, risk is managed and resources are used well. COBIT 2019 is the current published version. ISACA has announced COBIT 7 for release in late 2026, and this guide will be updated once it is published.

What is COBIT?

COBIT separates governance (the board’s job: evaluate, direct and monitor) from management (executives’ job: plan, build, run and monitor). It provides:

• 40 governance and management objectives, each with a purpose, processes, practices, activities and metrics.
• Components that make up a governance system: processes; organisational structures; principles, policies and procedures; information; culture, ethics and behaviour; people, skills and competencies; and services, infrastructure and applications.
• Design factors to tailor the governance system to your organisation, such as enterprise strategy, risk profile, threat landscape, compliance requirements, IT’s role, sourcing model and implementation methods.
• Focus areas for specific topics, such as information security, risk, DevOps and small and medium enterprises.
• A performance management approach based on capability levels (0 to 5) for processes and maturity levels for focus areas.

COBIT is not a process manual like ITIL or a control catalogue like ISO 27002. It sits above them and tells you what needs to be governed and managed.

History and why it was introduced

COBIT grew from a tool for IT auditors into a governance framework because organisations needed a way for boards to oversee technology spending and risk, and because regulations such as SOX made IT controls part of financial accountability.

Main objectives:

1. Align IT with business strategy and create value.
2. Optimise risk and resources.
3. Give boards a structured way to oversee technology.
4. Provide a common language for auditors, IT and business leaders.

Who uses COBIT?

Is COBIT mandatory?

No. It is voluntary. In practice it is often expected:

• Financial regulators may reference COBIT or similar frameworks in IT governance guidance; for example, the RBI’s IT governance directions for Indian regulated entities set out IT governance expectations that COBIT helps meet.
• External auditors often use COBIT to structure IT general controls testing for financial audits.
• Contracts and tenders sometimes ask for evidence of an IT governance framework.

Key requirements: the 40 objectives

Capability levels

How to implement COBIT

COBIT 2019’s design guide describes four steps to design a tailored governance system, and its implementation guide describes a continual improvement cycle:

1. Understand the enterprise context and strategy: goals, strategy, risk profile and current IT issues.
2. Determine the initial scope of the governance system using the design factors.
3. Refine the scope: adjust priorities and target capability levels for each objective.
4. Conclude the design: agree priority objectives, target levels and components.
5. Implement in iterations: assess current capability, close gaps, embed changes, and measure benefits.
6. Monitor and improve: report to the board and revisit the design as the business changes.

For a mid-sized IT company, a practical start is to pick 8 to 12 priority objectives, such as EDM03 (risk), APO12 (risk), APO13 (security), BAI06 (change), DSS02 (incidents), DSS04 (continuity) and MEA03 (compliance), and raise them to capability level 2 or 3.

Documentation and policies

• IT governance charter and decision rights (who decides what)
• IT strategy aligned with business strategy
• Governance system design (priority objectives, target capability levels)
• Policies for risk, security, data, vendors, change and continuity
• RACI charts for priority processes
• Performance metrics and dashboards for the board
• Capability assessments and improvement plans
• Compliance register of external requirements
• Internal audit plans and reports

Audits and assessments

• No organisational certification. COBIT itself is not certifiable.
• Capability assessments of processes, internally or by consultants.
• IT audits that use COBIT as their reference framework.
• Personal certifications from ISACA, such as COBIT Foundation and COBIT Design and Implementation, are for individuals. ISACA has announced that COBIT 2019 certification programmes will be retired with the launch of COBIT 7.

Cost

Benefits

• Board-level visibility of IT value, risk and performance.
• Structure accepted by auditors and regulators.
• Integrates with ITIL, ISO standards and risk frameworks.
• Tailorable to company size and strategy through design factors.
• Clear decision rights reduce shadow IT and duplicated spend.

Risks of weak IT governance

• Technology spending that doesn’t support strategy.
• Audit findings on IT general controls.
• Regulatory criticism in financial services.
• Unmanaged technology and vendor risk.

Common mistakes

• Trying to implement all 40 objectives at once.
• Treating COBIT as a process manual rather than a governance framework.
• Aiming for level 5 everywhere, which is rarely worth the cost.
• Leaving the board out of governance objectives.
• Documentation without change in how decisions are actually made.

Challenges for IT companies

• Agile and DevOps teams resist heavy governance; COBIT’s DevOps focus area helps adapt it.
• Smaller companies may find the framework large; COBIT’s SME focus area offers a slimmer version.
• Linking engineering metrics to business outcomes.
• Keeping governance current as products and teams change quickly.

Best practices

• Use the design factors to justify a small set of priority objectives.
• Pair COBIT with ITIL for service processes and ISO 27001 for security.
• Report to the board with a short dashboard of metrics per objective.
• Assess capability yearly and track improvement.
• Plan for the move to COBIT 7 once ISACA publishes it and its transition guidance.

Tools that help

How COBIT relates to other frameworks

Real-world examples

• IT general controls. External auditors of listed companies commonly organise IT general controls testing (access, change, operations) using COBIT-based structures.
• Banking. Many banks map their IT governance and risk frameworks to COBIT to meet regulator expectations.
• Illustrative scenario, not a real company: a 400-person Indian IT services firm wins a banking client that asks for evidence of IT governance. It uses COBIT design factors to select ten priority objectives, sets target capability levels, and reports progress quarterly to its board.

Frequently asked questions

Is COBIT mandatory? No. It is voluntary, but auditors and regulators often expect a recognised governance framework.

What is the current version of COBIT? COBIT 2019. ISACA has announced COBIT 7 for late 2026.

How many objectives are in COBIT 2019? 40: 5 governance objectives and 35 management objectives.

What is the difference between COBIT and ITIL? COBIT covers governance and what must be managed across IT. ITIL gives detailed practices for managing IT services.

Can a company be COBIT certified? No. Individuals can earn COBIT certifications from ISACA; organisations can be assessed but not certified.

Is COBIT suitable for small companies? Yes, using the small and medium enterprise focus area and a short list of priority objectives.

What happens to COBIT 2019 when COBIT 7 is released? ISACA has said COBIT 2019 certifications and exams will be retired. Organisations using COBIT 2019 can keep using it while they plan a transition.

Next steps

• Agree with leadership who owns IT governance and decision rights.
• Use the design factors to choose priority objectives.
• Assess current capability for those objectives.
• Watch for COBIT 7 and its transition guidance.