EGIT

This study guide provides an in-depth analysis of COBIT and IT Governance, including the benefits of implementing COBIT, the seven key enablers, and the integration of IT-balanced scorecard concept into COBIT. It also covers IT audit and assurance, challenges in implementing COBIT 5, and the balanced scorecard for IT governance.

Running head: EGIT 1
EGIT
Name
Institution

EGIT 2
EGIT
Part A
Question 1
Based on information from the IT Governance Institute relating to the business outcomes
of Governance of Enterprise IT, organizations that have implemented COBIT have experienced
enhanced management of IT. The management relates to risk, enhanced communication, as well
as enhanced relationships between IT and the organization, reduced IT costs, enhanced
competitiveness, along with improved IT delivery of organizational objectives. COBIT also
provides a distinction between the management of IT and governance. Nonetheless, COBIT also
provides a complete view of the enterprise that encompasses the business and the IT from end-
to-end as well as allowing for effective management along with the governance of enterprise IT
assets. COBIT also enhances user satisfaction when engaging with IT to the business with the
aim of achieving business objectives.
Question 2
Enablers individually and collectively affect whether a particular thing works. In the case
of COBIT 5, these things include governance including the management over IT enterprise.
Enablers are affected by goals cascade, in which, higher-level IT goals define what is to be
achieved by the different enablers. COBIT 5 identifies seven key enablers. The first enabler is
the principles, frameworks as well as policies that translate to the desired behavior into the
practical guidance of daily management. Second, are processes that define a set of organized
activities and practices aimed at achieving specific objectives. Third is the organizational
structure that is an important decision-making entity in a business. Fourth is the culture,

EGIT 3
behavior, as well as ethics, of people and of the enterprise. Fifth is information which is
pervasive across the enterprise and comprises of every information produced and used by the
organization. The other enabler includes services, applications, including infrastructure that
provides the organization with information technology processing and services. The last enabler
includes people, competencies as well as skills which are linked to individuals, and which are
necessary for the successful completion of every activity.
Question 3
IT-balanced scorecard concept is integrated into COBIT in the following way. COBIT is
made up of five principles, whereby the first and most important principle is ‘Meeting
Stakeholder Needs’. In this principle, it is where the Goals Cascade are found. Ultimately, this
goal also comprises of the BSC. Based on this discussion, simplistically, the Goals Cascade
provide the mechanism whose key objective is translating the stakeholders’ needs into enterprise
goals, which are then translated into IT-related Goals. In COBIT Goals Cascade, the needs of the
stakeholders, which are affected by several drivers are translated into Enterprise Goals, aimed at
satisfying the stakeholder’s needs. At this level, the BSC comes into play and COBIT defines the
17 Enterprise Goals that are organized into four BSC dimensions: Financial, Customer, Internal,
Learning, and Growth. The Enterprise Goal then has several metrics that are defined and
measure the attainment of every goal.
Question 4
IT savviness is introduced through the principle of covering the Enterprise End-to-End.
Not only does COBIT 5 cover the IT function but it as well treats information along with other
related technologies as assets that require being dealt with the same way as other assets in an

EGIT 4
enterprise. The focus on enterprise end-to-end signifies an important shift in IT and business
management: it includes the move from the management of IT as a cost, to the management of
IT as an asset. The shift is an important element in the value creation of a business. COBIT 5
offers Responsible, Accountable, Consulted, and Informed (RACI) charts for each of its
processes.
Question 5
COBIT 5 fourth principle involves enabling a holistic approach that takes into account
many interacting factors that comprise of processes, people, including structures. COBIT 5 is a
holistic framework because it comprises of a thorough as well as a complete involvement of
business management in the process of IT governing and management. For instance, it includes
processes such as APO3 Manage Enterprise Architecture, APO4 Manage Innovation, as well as
BAI05 Manage Organizational Change. Nonetheless, COBIT 5 is a more holistic approach due
to its concept of “Enablers”. COBIT 5 identifies seven enablers whereby organizational culture
and structure, processes, ethics, culture as well as behavior are linked with the company’s
systems concept. Other essential enablers include policies, frameworks and principles, people,
skills, and competencies, information, infrastructure, and applications, as well as service.
Part B
An IT audit involves the examination as well as the evaluation of a company’s
information technology infrastructure, operations, along with its operations. The audit
determines whether IT controls secure corporate assets, make sure there is data integrity, as well
as ensure that they remain aligned to the overall objectives of on organization. The controls
evaluated include the physical security controls along with the business and financial controls

EGIT 5
which are related to information technology systems. However, IT assurance makes sure that
there is reliability, integrity as well as security of major IT systems. Basically, IT assurance
involves the steps taken to protect the information system such as computer systems and
networks with the main focus being integrity, authentication, nonrepudiation, availability, and
confidentiality.
Question 2
COBIT is useful in IT assurance assignment because it helps businesses optimize their IT
assurance approach. First, COBIT for Assurance gives assurance professionals an opportunity to
plan and perform assurance reviews. As a result, this unifies a company’s business, IT as well as
assurance professionals around a uniform framework, thus making it easier to come to a
consensus on any type of required control improvements. Nonetheless, the COBIT for Assurance
provides organizations with a roadmap that is developed from accepted assurance approaches
that provide the assurance professionals with an opportunity to plan, scope, as well as execute IT
assurance practices, signifies strategic value both to the IT as well as the business stakeholders
along with navigating technologies considered increasingly complex. In addition, COBIT 5 for
Assurance provides the audit function with COBIT’s scope and unmatched rigor, facilitating
them to improve on the current initiatives and make sure that they address all IT assurance
aspects.
Question 3
Testing Control Design
The testing control design is done at the specific management practice level such as the
service desk. The formulation of the assurance steps depends on professional judgment as well as

EGIT 6
on undertakings that are delineated in every COBIT management practice. Based on COBIT’s
RACI chart, the required individuals for interviewing are defined. The retrieved documentation
is found in the input-output tables. Later, these steps are interpreted into an organization-specific
and detailed assurance initiative, stating exactly activities that need to be carried out. After
executing the approach, findings and conclusions are then recorded. An example of this is as
shown.
Management
Practice
Activity Contact
person
Control
design
question
Documentation
required
Control
design
finding
Control
design
conclusion
Record,
classify and
prioritises
service
request and
incidents
Log all
service
requests
and
incidents
Service
desk
manager
Incident
manager
Review the
incident
managemen
t procedure
and verify
whether all
call are
recorded
Incident
management
procedure
The incident
managemen
t procedure
requires all
incidents to
be logged
PASS
Testing Control Objective Outcomes
In this case, considering the same process, steps are formulated and are verified against
COBIT management initiatives and practices. The steps are further amplified with RACI chart
information and the desired documentation. Later, they are interpreted into a distinct operating
approach, findings, and conclusions. An example is as shown below.
Managemen
t practice
Activity Contact
person
Operating
effectivenes
s question
Documentatio
n required
Operating
effectivenes
s finding
Operating
effectivenes
s conclusion

EGIT 7
Record,
classify and
prioritises
service
request and
incidents
Log all
service
requests
and
incident
s
Service
desk
manage
r
Incident
manage
r
Inspect a
sample of
incidents
and ensure
that they are
all logged
Incident
management
procedure
20 incidents
were
received, of
which only
five were
logged in an
appropriate
way
FAIL
Question 4
In executing IT assurance activities, the RACI charts ensures that processes and functions
are not overlooked and facilitates flexibility in matrix management. Goals and metrics help
develop attainable objectives by making use of current staff resources and skill set. In addition,
the inputs describe the approaches of quality assurance that may include procedures, processes,
tools, as well as methods that are to be used in implementing IT assurance activities. The outputs
determine the things that need to be changed such as policies, procedures, and process,
preventive and corrective actions.
Question 5
In the previous steps, if control weaknesses are identified, “Testing the impact of the
control weaknesses” includes the assurance steps necessary in documenting and reporting
possible business risks in case certain control intentions are not attained. In this case, the
assurance professional not only reports on the control weaknesses but also demonstrate the effect
of these weaknesses. The assurance professional aims at estimating likely loss of time, cost, or
business effects as a result of the control weaknesses. Afterward, the assurance person can then

EGIT 8
leverage COBIT’s goals and metrics tables, as well as risk and value drivers with the intention of
clarifying the business issues at risk. An example is as provided below:
Illustration
Description Detection
Not all changes have been logged in the required manner Inspection
Risk
Description Classification
There exists no clear overview of the number of incidents that are
Open in the service desk including the classifications that they High
Posses. Hence, this might lead to loss of incidents as well as wrong
Prioritization, hence un-satisfied business users.
Recommendation
Description Priority
Obtain tool for logging and managing incidents effectively. 1
Part C
Question 1
The key success factors include:
Senior management commitment: the executive leadership team should be strong and
capable of moving beyond problem awareness to understanding the cause of the problem and
knowing what needs to be done.

EGIT 9
Business engagement: it is necessary to have a “business-oriented” CIO which
demonstrates the commitment of the senior management and collaboration between IT and other
departments thus translating to enhanced engagement, partnership, and collaboration.
Transparent business drivers: clear and transparent business drivers make it possible to
prioritize on investments as well as make it possible to select the best things for an organization.
Transparent portfolio management Process: ensuring the process is transparent
establishes trust between all stakeholders and avoids a relationship-based decision-making
approach.
Evolutionary approach: it is important to make well-defined but at times small steps that
possess that have advantages.
Question 2
One of the challenges in implementing COBIT 5 is getting started and obtaining
management attention as well as dedication to improving IT enterprise governance. To support
this, it is critical identifying and clarifying critical pain points in a firm. Enterprise governance of
IT practices may act as a “burning platform” in getting management attention. Such triggers
include:
a. Business frustrations that have got failed initiatives. In turn, this raises costs
including a low business value perception.
b. Noteworthy incidents that have a close relationship to IT business perils which
include data loss as well as a project failure.

EGIT 10
c. Outsourcing service delivery failures that include not continuously meeting the
agreed-on service levels.
d. Negligence to adhere to regulatory as well as contractual requirements.
e. Regular audit findings regarding poor IT performance as well as the IT quality of the
service problems.
Question 3
Corporate Contribution: This dimension evaluates Enterprise Governance of IT process’s
performance. The process should enhance business profit by mitigating the risks that relate to IT.
The main objectives include strategic alignment, risk management, including value delivery.
Stakeholders: this perspective consists of stakeholders’ management, the satisfaction of
the needs of stakeholders as well as legal and ethical compliance.
Operational Excellence: this outlook recognizes the main IT Enterprise Governance
practices that are to be executed, including their correlated metrics.
Future orientation: this scorecard reports on developing foundations aimed at delivering
governance by focusing on relational mechanisms that include business/IT co-location, cross-
functional business/IT training, shared understanding of business/IT goals, incentives as well as
partnership rewards.

EGIT 11
Question 4
A balanced scorecard is a performance measurement system for IT governance that
enables initiatives for improvement, hence keeping in balance the four perspectives. The
perspectives and their metrics are as discussed.
Financial perspective: the scorecard makes use of financial metrics that include operating
income, sales growth, administrative expense, return on assets, as well as net income. The
metrics are used to provide a common language that can be used to analyze and compare
organizations. If properly designed, these metrics provide an aggregate view of the success of an
organization.
Customer perspective: the metrics involved include customer retention and satisfaction,
market share, new customer acquisition, on-time delivery, and time is taken to fill orders. In this
case, managers identify the customers as well as the market segments in which the business unit
is to operate including the measures of the business unit’s performance in the selected segments.
Internal-Business-Process Perspective: the metrics include material turnover, defect rate,
percent of practical activity, number of suppliers, including lead time. The perspective facilitates
an organization delivers a value proposition that is capable of attracting and retaining clients in
targeted market segments and satisfying the expectations of the shareholders of excellent
financial returns.
Learning and Growth Perspective: the metrics include the amount spent training staff,
employee retention, productivity and satisfaction, number of new products among other
measures. The perspective mainly focuses on individuals’ capabilities. Employee satisfaction
encompasses staff morale to improve productivity and quality.

EGIT 12
Question 5
The IT BSC is a management system that gives clarity on the strategy as well as the
vision of a company and then translates them into an action that can be tracked. In other terms,
an IT BSC refers to a mechanism of understanding how well a business unit or the entire
company is performing. However, an Enterprise Governance of IT BSC deals with elaborating
and fixing structures as well as processes across the organizations, enabling both IT people and
the business to execute their duties, while at the same time maximizing the value-created from
the IT-enabled investment.