ACC 6070 Module 4 Midterm Project: The COBIT Framework, Its Challenges and Sustainability Example

Governing Information and Technology with COBIT 2019: Fit, Challenges and Sustainability at a Mid-Sized Credit Union

Student Name

Master of Science in Accounting, Thomas Edison State University

ACC-6070: Accounting and Information Systems Design and Implementation

Mentor Name

Month Day, Year

Governing Information and Technology with COBIT 2019: Fit, Challenges and Sustainability at a Mid-Sized Credit Union

Introduction

Every organization that depends on information systems needs a way to decide who governs technology, what it should deliver and how its risks are controlled. Romney and Steinbart (2018) treat IT governance as part of the accountant's control responsibilities, and accountants meet this question in audits of IT general controls, in Sarbanes-Oxley assessments and in advising boards. COBIT, developed by ISACA, is the most widely used framework for the governance and management of enterprise information and technology. This paper explains what the current version, COBIT 2019, contains, how it fits with the COSO frameworks accountants already use, how a mid-sized financial institution would tailor it, what makes adoption difficult and whether the framework is sustainable.

Discussion: What COBIT Is

Origins

COBIT began in 1996 as Control Objectives for Information and Related Technology, a set of control objectives for IT auditors. Later versions widened it from audit to IT management and then to governance. COBIT 5, released in 2012, framed governance as a responsibility of the board, separate from management (De Haes et al., 2013). COBIT 2019 kept that idea but made the framework more flexible, replacing a single prescribed model with one that each enterprise tailors to its own situation (ISACA, 2018).

Principles and Components

COBIT 2019 rests on six principles for a governance system: it should provide stakeholder value, take a holistic approach, be dynamic, distinguish governance from management, be tailored to enterprise needs and cover the enterprise end to end. A governance system is built from seven components: processes; organizational structures; principles, policies and procedures; information; culture, ethics and behavior; people, skills and competencies; and services, infrastructure and applications. The point of listing components is that a process alone does not produce control. A change management process fails if no one has the authority to stop a release, if staff lack the skills to test it or if the culture rewards speed over care.

Objectives and Capability

The core model has 40 governance and management objectives grouped into five domains.

A goals cascade links stakeholder needs to enterprise goals, enterprise goals to alignment goals for information and technology and those to the objectives that matter most. Each process can be rated on a capability scale from 0 to 5, adapted from CMMI, so management can set target levels instead of aiming for the highest level everywhere.

Discussion: COBIT, COSO and Risk Management

Accountants usually meet internal control through COSO's Internal Control: Integrated Framework (Committee of Sponsoring Organizations of the Treadway Commission, 2013), with its five components of control environment, risk assessment, control activities, information and communication, and monitoring, and through COSO's enterprise risk management framework, which ties risk to strategy and performance. COBIT does not replace either. COSO describes control across the whole organization at a general level; COBIT supplies detailed objectives and practices for information and technology. Auditors testing IT general controls for financial reporting often map COSO's control activities to COBIT objectives such as managed changes, managed security services and managed operations. Debreceny and Gray (2013) found in a multinational field study that process maturity varied widely across COBIT processes, even within the same organization, which suggests that firms should assess each objective separately rather than assume one overall level of control.

Analysis: Tailoring COBIT at a Credit Union

The Organization

Pine Barrens Federal Credit Union serves 48,000 members from nine branches, with $780 million in assets and a staff of 210, including an IT team of 14. Its core banking system is hosted by a service provider, it offers mobile banking through a third-party application and its examiners have criticized weak vendor oversight and slow patching.

Applying the Design Factors

COBIT 2019 uses design factors to tailor the governance system. For Pine Barrens, the most important are its risk profile, dominated by cyber threats and vendor dependence; its compliance requirements, including federal examination and privacy rules; the role of IT, which is essential to every service; a sourcing model that relies heavily on outside providers; and its size. ISACA's small and medium enterprise focus area recognizes that an organization of this size should combine roles and keep documentation lean.

Setting most targets at level 3, a defined and consistently performed process, rather than 4 or 5, reflects the credit union's size and budget. The board's risk committee would own the governance objective, while the chief operating officer and IT manager would own management objectives.

The tailored system also needs a roadmap. In the first year, Pine Barrens would assess current capability for the six priority objectives, close the gaps examiners identified and report progress to the board's risk committee each quarter. In the second year, it would add objectives for data management and IT projects, using the same assessment method so that progress can be compared over time.

Analysis: Challenges of Adoption

Cost and Effort

COBIT is comprehensive, and the comprehensiveness is costly. Mapping current practices to 40 objectives, assessing capability and documenting improvements can take a mid-sized organization a year and require outside consultants. Pine Barrens would need to limit the initial scope to the six priority objectives and expand later.

Skills and Ownership

The framework assumes people who understand both governance and technology. Small IT teams rarely have staff trained in COBIT, and boards may lack members who can question technology risk. Training at least two staff members and adding technology expertise to the board are prerequisites, not options.

Culture

Frameworks fail when they are treated as paperwork. If staff see COBIT as a compliance exercise for examiners, processes will be documented but not followed. COBIT's own component of culture, ethics and behavior names the problem, but naming it does not solve it; leaders must reward people who follow the change process even when it slows a release.

Measurement

COBIT links objectives to metrics, but choosing meaningful ones is hard. Counting patches applied says less than measuring the time from release to installation for critical patches, which is what examiners criticized.

Integration With Existing Practices

Pine Barrens already follows parts of other frameworks: its examiners use the FFIEC handbooks, its security team uses the NIST Cybersecurity Framework and its service desk follows ITIL practices. Adopting COBIT without mapping these existing practices would duplicate effort and confuse staff. The practical approach is to use COBIT as the governance layer that sets objectives and ownership, and to treat the NIST and ITIL practices as the detailed means of meeting those objectives, documenting the mapping once so that examiners, auditors and staff see a single system.

Analysis: Is COBIT Sustainable?

Three features suggest the framework will remain useful. First, COBIT 2019 was designed to be updated continuously, with focus area guidance for topics such as cybersecurity, DevOps and small enterprises added without rewriting the core model. Second, its alignment with other standards, including COSO, ISO/IEC 27001 for security management, ITIL for service management and the NIST Cybersecurity Framework, lets organizations use it as an integrating structure rather than a competing one. Third, regulators and auditors continue to rely on it, which gives organizations a reason to maintain it.

The risks to its sustainability are complexity and pace. Cloud services, artificial intelligence and continuous software delivery change faster than a governance framework is revised, and organizations may turn to lighter, technology-specific guidance. COBIT's response, tailoring through design factors and focus areas, is sensible, but it places more judgment on users, which raises the skills challenge. For Pine Barrens, the framework is sustainable if it is used to set priorities and assign ownership, reviewed each year with the risk assessment, and not treated as a checklist to complete once.

Evidence from adopters supports this view. De Haes et al. (2013) describe COBIT's evolution as a response to criticism that earlier versions were too control-focused and too detailed for boards, and note that research on whether its use improves outcomes remains limited. That gap is itself a sustainability risk: a framework that cannot show results will lose support when budgets tighten. Pine Barrens can address it locally by measuring, before and after adoption, the examination findings, patching times and vendor issues that motivated the effort.

Conclusion

COBIT 2019 gives organizations a structured way to govern information and technology, linking stakeholder needs to specific objectives and capability targets. It complements COSO's frameworks by supplying the technology detail behind internal control and risk management. Tailored through its design factors, it fits a mid-sized credit union whose main risks are cyber threats and vendor dependence. Its challenges, cost, skills, culture and measurement, are manageable if adoption starts narrow and is owned by the board. Its sustainability depends less on ISACA's updates than on whether organizations treat it as a living governance system.

References

Committee of Sponsoring Organizations of the Treadway Commission. (2013). Internal control: Integrated framework.

De Haes, S., Van Grembergen, W., & Debreceny, R. S. (2013). COBIT 5 and enterprise governance of information technology: Building blocks and research opportunities. Journal of Information Systems, 27(1), 307-324. https://doi.org/10.2308/isys-50422

Debreceny, R. S., & Gray, G. L. (2013). IT governance and process maturity: A multinational field study. Journal of Information Systems, 27(1), 157-188. https://doi.org/10.2308/isys-50418

ISACA. (2018). COBIT 2019 framework: Introduction and methodology.

Romney, M. B., & Steinbart, P. J. (2018). Accounting information systems (14th ed.). Pearson.