COBIT-2019 Practice Questions

Culture, ethics and behavior are the most likely components of a governance system to be

underestimated as factors in the success of governance and management activities. Culture, ethics

and behavior are the shared values, beliefs, norms, and attitudes that influence how people behave

and interact within an enterprise. They affect the motivation, commitment, collaboration, and

performance of people, as well as the trust and reputation of the enterprise. Culture, ethics and

behavior are one of the seven enablers of a governance system, as defined by

COBIT.12 Reference: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019

Framework: Governance System

The value that I&T delivers should be aligned directly with the values on which the business is

focused. This is based on the principle of alignment, which states that “governance of enterprise I&T

should ensure that I&T-enabled investments are aligned with the enterprise strategy and deliver the

expected benefits” . Value delivery is not only about maintaining or increasing value from existing

I&T investments, but also about ensuring that new investments support the strategic objectives and

stakeholder needs of the enterprise.

The risk profile is a design factor that describes how an enterprise identifies, assesses, responds to,

monitors, and reports on information and technology risks. The risk profile helps to determine the

level of risk appetite and tolerance that an enterprise has for its information and technology

activities, as well as the level of control and assurance that is required for its governance framework.

When tailoring COBIT 2019 to enterprise requirements, the primary objective of preparing a risk

profile is to identify areas of risk that exceed risk appetite. The risk appetite is the amount and type

of risk that an enterprise is willing to accept in pursuit of its objectives. The risk appetite provides a

basis for defining the risk criteria, thresholds, indicators, and responses that will be used in the risk

profile process. By identifying areas of risk that exceed risk appetite, an enterprise can prioritize its

governance objectives, processes, practices, roles, structures, and metrics according to the level of

risk exposure and impact. This will also help to align the governance framework with the enterprise’s

strategy and objectives.

Reference: : COBIT 2019 Design Guide: page 41-43 : COBIT 2019 Framework: Introduction and

Methodology: page 28-29

The IT implementation methods design factor describes how an enterprise develops, delivers, and

maintains its IT solutions. There are four IT implementation methods defined in COBIT 2019:

traditional, agile, DevOps, and hybrid. Each method has different implications for the governance

and management of information and technology in terms of focus areas, processes, practices, roles,

structures, and metrics. The IT implementation method that requires the highest level of

participation by users at multiple stages of software development is agile. Agile is an IT

implementation method that emphasizes flexibility, adaptability, collaboration, customer

satisfaction, and value delivery. One of the characteristics of agile is that it involves frequent and

direct interaction with users throughout the software development life cycle, from requirements

gathering to testing to deployment. Users are considered as key stakeholders who provide feedback,

input, validation, verification, acceptance, and evaluation of the IT solutions. Users are also involved

in prioritizing the features and functionalities of the IT solutions based on their needs and

expectations. Agile aims to deliver IT solutions that meet user requirements and expectations in a

timely and cost-effective manner.

Reference: : COBIT 2019 Design Guide, page 43-45 : COBIT 2019 Process Reference Guide:

Governance and Management Objectives, page 67-69

According to the COBIT 2019 Framework: Introduction and Methodology, one of the imperative

factors to the successful implementation of IT governance is that IT governance is sponsored by

executives. Executive sponsorship ensures that IT governance has sufficient authority, resources and

support from the top management of the organization. Executive sponsorship also demonstrates

commitment and leadership for IT governance, and fosters a culture of accountability and

collaboration among stakeholders.3, p. 33-34 Reference: 3: COBIT 2019 Framework: Introduction and

Methodology

According to the COBIT 2019 Implementation Guide: Implementing an Information and Technology

Governance Solution, one of the most significant drivers to be considered when refining the scope of

a new IT governance system during the design phase is cloud versus on-premises services. This driver

reflects the different delivery models of I&T services, such as software as a service (SaaS), platform as

a service (PaaS), infrastructure as a service (IaaS) or on-premises solutions. The choice of delivery

model has implications for governance objectives, roles, responsibilities, policies, processes,

controls, risks and performance measures.5, p. 40-41 Reference: 5: COBIT 2019 Implementation

Guide: Implementing an Information and Technology Governance Solution

The key program roles are the roles that are responsible for leading, directing, managing,

supporting, and executing the EGIT implementation program. The nomination of these roles is a

critical step in creating the appropriate governance environment for the program. One of the roles

that should be involved in this nomination process is the board and executives, who are the highest-

level governance body and decision makers in an enterprise. The board and executives provide

strategic direction, oversight, guidance, and approval for the EGIT implementation program. They

also ensure that the program is aligned with the enterprise’s vision, mission, values, strategy, goals,

and objectives. The board and executives also appoint or endorse other key program roles such as

the program sponsor, program manager, program steering committee, change champion network,

etc.

Reference: : COBIT 2019 Implementation Guide, page 37-38 : COBIT 2019 Framework: Governance

and Management Objectives, page 19-20

The management of the IT function is the function that leads and manages the information and

technology function in an enterprise, as well as supports and enables the information and

technology governance. The management of the IT function includes roles such as CIO, IT managers,

IT process owners, IT service owners, etc. The management of the IT function is responsible for

resolving conflicting priorities in order to finalize the governance system design. The governance

system design is the process of designing and implementing a governance system for an enterprise

using COBIT 2019. The governance system design involves tailoring the COBIT 2019 components such

as principles, enablers, goals, processes, practices, roles, structures, metrics etc., according to the

enterprise’s context and needs. The governance system design also involves considering various

design factors such as enterprise strategy archetype; enterprise goals; IT-related goals; risk profile; IT

deployment; threat landscape; compliance requirement; operating environment; size of enterprise;

culture; stakeholders; etc., that influence how an enterprise designs and implements its governance

system using COBIT 2019. By resolving conflicting priorities in order to finalize the governance

system design, the management of the IT function ensures that the governance system is

appropriate for the enterprise’s strategy objectives performance risks issues opportunities etc., that

it delivers value and benefits to the enterprise and its stakeholders that it aligns with the relevant

standards guidelines regulations best practices etc., that it meets stakeholder requirements and

expectations etc34 Reference: 3: COBIT 2019 Framework: Governance and Management Objectives:

page 20-21 4: COBIT 2019 Design Guide: page 33-48

The alignment goal titled “Knowledge, expertise and initiatives for business innovation” is aligned to

the Learning and Growth dimension of the IT balanced scorecard (BSC). The IT BSC is a tool that

translates the IT-related goals into a set of performance indicators that can be measured and

monitored. The Learning and Growth dimension focuses on the capabilities and skills of the IT staff,

as well as the culture and climate that foster innovation and learning. The alignment goal is based on

the COBIT 2019 Framework5, page 38. Reference: 5: COBIT 2019 Framework | Digital | English

The best way to determine whether IT governance is achieving intended outcomes one year after

implementation is to evaluate performance measurements identified in the business case. The

business case is a document that defines the objectives, benefits, costs, risks, and success factors of

IT governance implementation, and specifies the key performance indicators (KPIs) and target values

that will be used to measure and monitor the outcomes. By comparing the actual performance

results with the expected results, the enterprise can assess the effectiveness and efficiency of IT

governance and identify any gaps or issues that need to be addressed. The way is based on the COBIT

2019 Implementation Guide1, page 32. Reference: 1: COBIT 2019 Implementation Guide | Digital |

English