An assessment of the gaps in capability should result in a list of:

A capability gap assessment compares the current state ("as-is") of a process or function against a desired future state ("to-be"). The direct output of identifying these gaps is a clear understanding of what needs to change. This naturally leads to the formulation of a list of potential improvements or initiatives designed to close those gaps and elevate the capability to the target level. This list becomes the primary input for the planning and implementation phases of a governance improvement program.

A. Performance measures are tools used to conduct the assessment and monitor progress, not the resulting list of actions to be taken.
B. Unmitigated residual risks may be a consequence of capability gaps, but the gap analysis itself identifies the capability shortfall, not the risk.
C. Implementation costs are calculated for the proposed improvements after they have been identified and prioritized, as part of building a business case.

1. ISACA, COBIT® 2019 Implementation Guide: Implementing and Optimizing an Information and Technology Governance Solution, 2018, Phase 3 "Where are we now?" and Phase 4 "What needs to be done?", pp. 24-25.

2. ISACA, COBIT® 2019 Implementation Guide: Implementing and Optimizing an Information and Technology Governance Solution, 2018, Figure 3.1 "The implementation life cycle," shows that gap analysis leads to defining a portfolio of programs.