COBIT 2019 for Auditors: A Quick Guide

Introduction

COBIT 2019 is a comprehensive framework for IT governance and management, widely used by auditors, risk managers, and compliance professionals. At the heart of the framework are 40 objectives, grouped into five domains, that provide control points across the IT lifecycle.

This guide explains each domain and objective, giving a short description and a detailed audit focus list of what should be checked.

Domain 1: Evaluate, Direct and Monitor (EDM)

Purpose: Ensure IT governance is directed by the board and aligned with enterprise goals.

EDM01 — Governance Framework Setting and Maintenance

Establish and maintain an effective IT governance system.

• Documented governance framework.
• RACI charts for IT responsibilities.
• Integration with enterprise governance.
• Board approval and periodic reviews.

EDM02 — Ensure Benefits Delivery

Confirm that IT delivers expected value to the business.

• Benefits realization plans.
• Post-implementation reviews (PIR).
• KPIs tracking value delivery.
• Reports to executives on benefits achieved.

EDM03 — Ensure Risk Optimization

Balance IT risks and opportunities within enterprise risk appetite.

• Defined risk appetite and tolerance.
• IT risks included in enterprise risk registers.
• Risk dashboards for board review.
• Documentation of risk treatment decisions.

EDM04 — Ensure Resource Optimization

Optimize use of people, technology, and financial resources.

• IT budget utilization reports.
• Workforce planning and skills gap analysis.
• Asset utilization metrics.
• Evidence of board oversight on major allocations.

EDM05 — Ensure Stakeholder Engagement

Engage stakeholders in IT governance processes.

• Stakeholder feedback collection mechanisms.
• Communication plans with regulators/customers.
• Records of stakeholder meetings.
• Evidence of issue escalation and resolution.

Domain 2: Align, Plan and Organize (APO)

Purpose: Translate enterprise goals into IT strategies, structures, and plans.

APO01 — Manage the IT Management Framework

Provide a consistent management system for IT processes.

• Policy library completeness.
• Alignment with standards (ISO, ITIL).
• Framework review frequency.
• Ownership defined via RACI.

APO02 — Manage Strategy

Ensure IT strategy aligns with business goals.

• Documented IT strategy.
• Roadmaps linking to business objectives.
• Evidence of executive approval.
• KPIs linking IT to enterprise outcomes.

APO03 — Manage Enterprise Architecture

Develop and maintain enterprise-wide architecture standards.

• Architecture principles repository.
• Integration and interoperability models.
• Approval of exceptions.
• Compliance checks for new projects.

APO04 — Manage Innovation

Enable adoption of beneficial innovations.

• Innovation pipeline documentation.
• Evaluation of emerging technologies.
• Risk assessments of pilots.
• Governance of adoption decisions.

APO05 — Manage Portfolio

Balance and prioritize IT-enabled investments.

• Portfolio dashboards.
• Prioritization and selection criteria.
• Investment governance approvals.
• Tracking of benefits from portfolio items.

APO06 — Manage Budget and Costs

Control IT financial resources.

• Budget vs. actual spend reports.
• Cost-benefit analyses.
• Variance explanations.
• Board approvals of major expenditures.

APO07 — Manage Human Resources

Ensure IT workforce is skilled and sufficient.

• Training and certification logs.
• Workforce and capacity planning.
• Retention and succession planning.
• Staff performance appraisals.

APO08 — Manage Relationships

Maintain effective IT-business partnerships.

• Steering committee meeting records.
• Stakeholder satisfaction surveys.
• Communication frameworks.
• Escalation procedures.

APO09 — Manage Service Agreements

Define and monitor SLAs and OLAs.

• SLA documentation.
• SLA monitoring dashboards.
• Penalty enforcement evidence.
• Periodic SLA reviews.

APO10 — Manage Vendors

Oversee third-party supplier relationships.

• Vendor risk assessments.
• Contract compliance evidence.
• Performance scorecards.
• Exit and offboarding strategies.

APO11 — Manage Quality

Ensure IT processes and outputs meet quality standards.

• QA frameworks and test plans.
• Defect logs and analysis.
• Continuous improvement initiatives.
• Audit trails of quality reviews.

APO12 — Manage Risk

Establish an enterprise IT risk management process.

• IT risk registers.
• Key Risk Indicators (KRIs).
• Evidence of mitigation actions.
• Risk escalation to senior management.

APO13 — Manage Security

Provide enterprise-wide information security.

• Security policies and standards.
• Incident response logs.
• Identity and access management controls.
• Security awareness training records.

APO14 — Manage Data

Ensure data is governed, protected, and compliant.

• Data governance committees.
• Data ownership assignments.
• Data quality metrics.
• GDPR and privacy compliance records.

Domain 3: Build, Acquire and Implement (BAI)

Purpose: Deliver IT solutions through structured projects and change management.

Get Tedislava Vasileva’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

BAI01 — Manage Programs and Projects

Govern IT projects for successful delivery.

• PMO records.
• Project charters and status reports.
• Risk/issue logs.
• Project closure reviews.

BAI02 — Manage Requirements Definition

Define and validate IT/business requirements.

• Requirements documentation.
• Approvals from stakeholders.
• Traceability from requirements to tests.
• Change control of requirements.

BAI03 — Manage Solutions Identification and Build

Develop or acquire IT solutions effectively.

• Build-vs-buy analyses.
• Secure coding standards.
• Vendor selection documentation.
• Test results.

BAI04 — Manage Availability and Capacity

Maintain system availability and performance.

• Capacity and availability planning.
• Monitoring dashboards.
• Incident history due to capacity issues.
• SLA performance reports.

BAI05 — Manage Organizational Change Enablement

Prepare the business for change.

• Training materials and records.
• Communication plans.
• Evidence of change champions.
• Adoption metrics.

BAI06 — Manage Changes

Control and authorize IT system changes.

• Change request forms.
• Approval workflows.
• Testing evidence.
• Segregation of duties in deployments.

BAI07 — Manage Change Acceptance and Transitioning

Validate and approve changes before release.

• UAT test results.
• Go-live approval records.
• Contingency/rollback plans.
• Transition handover documentation.

BAI08 — Manage Knowledge

Capture and share knowledge across IT.

• Knowledge base repositories.
• Lessons learned documentation.
• Problem resolution reuse.
• Evidence of knowledge transfer.

BAI09 — Manage Assets

Track and control IT assets.

• Asset register accuracy.
• License compliance checks.
• Asset disposal records.
• Lifecycle management processes.

BAI10 — Manage Configuration

Maintain control over IT configurations.

• CMDB records.
• Version and release control logs.
• Access restrictions for configuration changes.
• Periodic configuration audits.

Domain 4: Deliver, Service and Support (DSS)

Purpose: Ensure stable IT operations and support.

DSS01 — Manage Operations

Run daily IT operations reliably.

• Daily job schedules.
• System and operational logs.
• Backup and restore test evidence.
• Capacity/utilization metrics.

DSS02 — Manage Service Requests and Incidents

Handle incidents and requests efficiently.

• Incident and service request tickets.
• SLA compliance monitoring.
• Escalation procedures.
• Post-incident review reports.

DSS03 — Manage Problems

Identify and address root causes.

• Problem logs and registers.
• Root Cause Analysis (RCA) reports.
• Evidence of permanent fixes.
• Knowledge reuse documentation.

DSS04 — Manage Continuity

Ensure IT continuity and disaster recovery.

• BCP/DRP documentation.
• DR test results.
• Recovery Time Objective (RTO) adherence.
• Evidence of periodic testing.

DSS05 — Manage Security Services

Operate IT security services effectively.

• SOC monitoring reports.
• Vulnerability scan results.
• Patch management compliance.
• Incident response documentation.

DSS06 — Manage Business Process Controls

Embed IT controls in business processes.

• Application control evidence.
• Segregation of Duties (SoD) checks.
• Automated control testing results.
• Exception handling records.

Domain 5: Monitor, Evaluate and Assess (MEA)

Purpose: Continuously monitor performance, controls, and compliance.

MEA01 — Monitor, Evaluate and Assess Performance and Conformance

Measure IT performance against enterprise goals.

• KPI dashboards.
• Balanced scorecards.
• SLA monitoring evidence.
• Executive review minutes.

MEA02 — Monitor, Evaluate and Assess the System of Internal Control

Evaluate the design and effectiveness of controls.

• Internal audit reports.
• Control self-assessment results.
• Management remediation plans.
• Tracking of corrective actions.

MEA03 — Monitor, Evaluate and Assess Compliance With External Requirements

Ensure compliance with laws, regulations, and contracts.

• Compliance registers.
• Evidence of external audit results.
• Regulatory correspondence.
• Contractual compliance checks.

Conclusion

COBIT 2019’s 40 objectives form a practical roadmap for IT governance and audit. By pairing each objective with a clear focus, this framework becomes a powerful tool for auditors.

For auditors new to COBIT, the takeaway is simple:

• Domains tell you where to look.
• Objectives tell you what to look at.
• Audit focus tells you exactly what evidence to test.
• Create a checklist based on the job for organized and smooth work.

Author’s note: LinkedIn