Welcome ISACA Baton Rouge Chapter

Moving from COBIT 4.1 to COBIT 5

May 24, 2012

Agenda

• Differences between COBIT 4.1 and COBIT 5• Review of COBIT 5 Framework and Enabling

Processes• Incorporation of Application Level Controls• LA Legislative Auditor’s Office Implementation

of COBIT 5

COBIT 4.1 and COBIT 5Compare and Contrast

COBIT 5

• Created by the IT Governance Institute• How is COBIT different and why do we use it?

o Contains IT best practices that can be used by auditors and IT management

o Generally acceptable with third parties and regulators

o Fulfills the COSO requirements for the IT control environment

COBIT 5 Principles

1: Meeting Stakeholder Needs

• “The COBIT 5 Goals Cascade translates stakeholder needs into specific, actionable, and customized goals within the context of the enterprise, IT-related goals, and enabler goals.”

2: Covering the Enterprise End-to-End

COBIT 5:• Integrates governance of

enterprise IT into enterprise governance.

• Covers all functions and processes required to govern and manage enterprise information and related technologies wherever that information may be processed.

3: Applying a Single Integrated Framework

4: Enabling a Holistic Approach• Enablers are factors that, individually and collectively,

influence whether something will work.• COBIT 4.1 contained enablers, but more emphasis

has been placed on enablers in COBIT 5.

5: Separating Governance from Management

• Governance: ensures that stakeholder needs, conditions, and options are evaluated to determine balanced, agreed-on enterprise objectives to be achieved; setting direction through prioritization and decision making; and monitoring performance and compliance against agreed-on direction and objectives.

• Management: plans, builds, runs and monitors activities in alignment with the direction set by the governance body to achieve the enterprise objectives.

5: Separating Governance from Management

• These two disciplines encompass different types of activities, require different organizational structures, and serve different purposes.

COBIT 5 Framework and Enabling Processes

Notable Process MappingCOBIT 4.1 COBIT 5 Topic CoveredME4 EDM1, 2, 3, 4, 5 IT GovernanceAC 1, 2, 3, 4, 5, 6 BAI3 & DSS6 Manage Business Process ControlsPO1 APO2 Strategic PlanningPO4 APO1 Organization, Processes, and RelationshipsPO8 APO11 Manage QualityPO9 APO12 Manage RiskPO10 BAI1 Manage Programs and ProjectsAI4 BAI8 Manage KnowledgeAI5 & DS2 APO10 Manage SuppliersDS1 APO9 Manage Service AgreementsDS3 BAI4 Manage Availability and CapacityDS5 & DS12 DSS5 Manage Security ServicesDS5 APO13 Manage Security

Practices and Activities• COBIT 5 Practices and Activities are equivalent

to COBIT 4.1 Control Objectives and Val IT and Risk IT processes.

RACI Charts

Application Level Controls

Holistic Approach• The terms “general controls” and “application

controls” are still commonly used, COBIT 5 does not distinguish between the two as did COBIT 4.1.

• The holistic approach maps common enterprise goals and objectives to IT goals as “primary” or “secondary.”

• IT goals are mapped to processes and attributes as “primary” or “secondary” that enable an enterprise to achieve the IT goals.

Louisiana Legislative Auditor’s OfficeImplementation of COBIT 5 into Standard Auditing Procedures

LA Legislative Auditor

• Oversee 3500 audits of state and local governments, and conducts independent financial and performance audits of State agencies, colleges, and universities.

21

Our ApproachControl Matrix for Information Technology (CoMIT) Tool

We needed a tool based on CoBIT Criteria• Use of IT has grown and we are resource

challenged • Standardize our procedures and have a

common measuring tool

Confidentiality?!

Control Matrix for Information Technology (CoMIT)

• Governance Enterprise Management Matrixo “Primary Controls”o Organized according to the five domains

• Transaction and Application Level Matrixo Evaluates key controls at a more granular levelo Organized in accordance with the Confidentiality,

Integrity, and Availability (CIA) Triad

Transaction and Application Level

COBIT 5 Family

You Might Be An IT Auditor If…• You have more letters behind your name than a can of

alphabet soup• You have a gadget on your desk that you have fondly given a

name• Bean counter references make you mad• Balancing your checkbook is fun• When you have your computer repaired, you ask for all the

parts back, labeled, and itemized• Your idea of vacation is field work• You and your coworkers represent more nationalities than

anywhere else in the office