How we work

COBIT 5 provides a comprehensive framework that assists enterprises in achieving their objectives for the governance and management of enterprise IT. Simply stated, it helps enterprises create optimal value from IT by maintaining a balance between realising benefits and optimising risk levels and resource use.

COBIT 5 enables IT to be governed and managed in a holistic manner for the entire enterprise, taking in the full end-to-end business and IT functional areas of responsibility, considering the IT-related interests of internal and external stakeholders. COBIT 5 is generic and useful for enterprises of all sizes, whether commercial, not-for-profit or in the public sector.

(COBIT was originally an acronym for Control Objectives for Information and related Technology. Now it is so well-known that just COBIT is used to identify the framework.)

Based on five principles and seven enablers (see below), COBIT 5 uses governance and management practices to describe actions that are examples of good practices to effect governance and management over enterprise IT.

COBIT 5 clearly differentiates between the key areas of governance and management. To align with ISO/IEC 38500, COBIT 5 presents governance in terms of Evaluate, Direct and Monitor. These come directly from the standard’s “Model for Corporate governance of IT.”

While no longer focusing on control objectives, COBIT does promote the use of a process assessment approach to determining an enterprises status. This differs from the CMMI (Capability Maturity Model Integration, or CMMI, is a process model that provides a clear definition of what an organisation should do to promote behaviours that lead to improved performance.) approach used in COBIT 4.1, which promoted a maturity model approach. The process assessment approach comes from ISO/IEC 15504 (Information technology – Process assessment).

• Principle 5: Separating Governance From Management — The COBIT 5 framework makes a clear distinction between governance and management. These two disciplines encompass different types of activities, require different organisational structures and serve different purposes. COBIT 5’s view on this key distinction between governance and management is:
  • Governance: Governance ensures that stakeholder needs, conditions and options are evaluated to determine balanced, agreed-on enterprise objectives to be achieved; setting direction through prioritisation and decision making; and monitoring performance and compliance against agreed-on direction and objectives. In most enterprises, overall governance is the responsibility of the board of directors under the leadership of the chairperson. Specific governance responsibilities may be delegated to special organisational structures at an appropriate level, particularly in larger, complex enterprises.
  • Management: Management plans, builds, runs and monitors activities in alignment with the direction set by the governance body to achieve the enterprise objectives. In most enterprises, management is the responsibility of the executive management under the leadership of the chief executive officer (CEO).

Together, these five principles enable the enterprise to build an effective governance and management framework that optimises information and technology investment and use for the benefit of stakeholders.