I&T-related issues, also called pain points:

The COBIT 2019 Design Guide defines I&T-related issues, or "pain points," as undesirable events or outcomes for the enterprise. They are often the trigger for initiating a governance improvement program. Examples include failed IT projects, service delivery problems, or findings from audits. These are tangible problems that have already occurred, which aligns with the definition of a risk that has materialized. Recognizing these pain points is a critical input for identifying relevant design factors and scoping the governance system.

A. Pain points can be external, such as regulatory non-compliance fines or negative customer feedback on digital services, not just internal issues.
C. A risk that has not yet materialized is simply a risk; a pain point is an issue that is currently being experienced by the enterprise.
D. Effective governance integrates risk and issue management. Pain points are key inputs to the risk management process and should not be tracked separately.

1. ISACA, COBIT® 2019 Design Guide: Designing an Information and Technology Governance Solution, USA, 2018, p. 18, Table 2.1. (Lists examples of common pain points, describing them as triggers for governance initiatives).

2. ISACA, COBIT® 2019 Design Guide: Designing an Information and Technology Governance Solution, USA, 2018, p. 31, Section 4.1. (Describes pain points as a design factor, stating they "are risk-related" and often represent "a risk that has materialized").

3. ISACA, COBIT® 2019 Framework: Governance and Management Objectives, USA, 2018, p. 13. (Discusses how risk management (APO12) includes identifying and responding to I&T-related events and issues).