COBIT: IT governance and control in SMEs

Introduction

In an increasingly digitalised world, companies of all sizes face the challenge not only of running their IT efficiently, but also of aligning it strategically and managing it in compliance with the law. This applies in particular to small and medium-sized enterprises (SMEs), which increasingly depend on IT-based processes, cloud services and data processing.

COBIT (Control Objectives for Information and Related Technology) is an internationally recognised framework for governing and controlling enterprise IT. Developed by ISACA, COBIT offers a set of best practices, principles and governance mechanisms – practical and scalable, including for SMEs.

What is COBIT?

COBIT is a framework for IT governance and IT management. It helps organisations strike a balance between the risks, benefits and resources of IT. COBIT 2019 is the current version and focuses on:

• governance systems with 40 governance and management objectives
• the link between business goals and IT goals
• a focus on value creation, risk management and compliance

"COBIT ensures that IT serves the business goals – and not the other way round."

Benefits of COBIT for SMEs

• Strategic alignment: IT measures are synchronised with the business processes.
• Control mechanisms: Transparent processes for security, quality and risk management.
• Compliance and auditing: IT controls are easier to demonstrate, e.g. in connection with the GDPR or the German Supply Chain Act (Lieferkettengesetz).
• Optimised use of resources: Clearly defined responsibilities and priorities.
• Improved communication: Greater mutual understanding between IT, management and business departments.

COBIT compared with other frameworks

• COBIT – focus on IT governance, a governance framework, very well suited to SMEs, can be combined with ITIL, ISO 27001, CMMI, TOGAF.
• ITIL 4 – focus on IT service management, an operations framework, very well suited to SMEs, can be combined with COBIT, DevOps.
• PRINCE2 – focus on project management, a methodology, well suited to SMEs, can be combined with ITIL, SCRUM.
• SCRUM – focus on agile development, a method, very well suited to SMEs, can be combined with SAFe, DevOps.
• SAFe – focus on agile scaling, a framework for growing organisations, can be combined with SCRUM, DevOps.
• CMMI – focus on process maturity, a maturity model, good for orientation, can be combined with COBIT, ISO 9001.

Practical example: getting started with COBIT in an SME

An IT service provider with 45 employees wants to improve the transparency of its project management and, at the same time, make its IT security auditable. With COBIT:

• responsibilities are documented (RACI matrix)
• critical processes are given key performance indicators (KPIs)
• IT goals are aligned with the business strategy
• an overview of existing policies and risks is created

Result: more clarity for management, the IT team and customers.

Conclusion

COBIT is not a theoretical paper but a strategic management instrument for IT organisations. SMEs in particular that are growing, need to meet compliance requirements or want to keep better control of their IT processes benefit enormously. Combining it with other frameworks such as ITIL, PRINCE2 or CMMI makes COBIT particularly effective.

Recommendation: Start with a maturity assessment based on the COBIT objectives and determine which processes are already working well – and where there is some catching up to do.