It Governance According To Cobit

IT GOVERNANCE
ACCORDING TO COBIT
How does the IT performance within one of
the largest investment banks in the world
compare to COBIT?
JOEL ETZLER
Master Thesis
Stockholm, Sweden
XR-EE-ICS 2007:14
ABSTRACT
To improve the governance of IT and comply with regulatory demands,
organizations are using best practice frameworks to facilitate the work. One of
these IT governance frameworks is COBIT (The Control Objectives for
Information and related Technology). COBIT provides guidance on what could be
done within an IT organization in terms of controls, activities, measuring and
documentation. This framework is however large and require specific knowledge in
order to enable full use of its potential. This project was initiated to use a
straightforward method of working with COBIT while assessing the maturity of an
organization. The method was developed by myself and my advisor at The Royal
Institute of Technology in Stockholm and describes one way of using COBIT. The
organization under evaluation is one of the largest, most well known investment
banks in the world, in this project referred to as The Firm.
A specific part of the IT organization within The Firm was evaluated with COBIT
as a starting point and the gap between the framework and the organization was
underlined. COBIT provides an incremental measurement scale, where the internal
processes are measured in terms of how defined and structured they are. The scale
expresses levels of maturity and The Firm reached a level 3.3 out of 5.
The strongest and weakest areas have been emphasized and improvements on the
weaker areas have been suggested. These improvement actions could enable
organizations to better govern IT and facilitate compliance to regulatory
requirements.
Keywords: IT Governance, IT Management, COBIT, ITIL, Align IT to business,

Sarbanes and Oxley.
PREFACE
This is my Master Thesis and it constitutes the final part in my Master of Science
education in Electrical Engineering at the Royal Institute of Technology in
Stockholm. Conducting this project has been a great experience for me. I have met
many, very kind and helpful people and would like to express my gratitude to all
involved. Above all I would like thank, my advisor at ICS, Mrten Simonsson and
key stakeholders at The Firm; Moss, Nikki, Andrew and Trevor. Thank you!
Joel Etzler
Stockholm, 16th of May, 2007
TABLE OF CONTENTS
1
INTRODUCTION ................................................................................................................... 5
1.1
BACKGROUND ....................................................................................................................... 5
1.2
PROBLEM............................................................................................................................... 7
1.3
PURPOSE................................................................................................................................ 7
1.4
DELIMITATIONS ..................................................................................................................... 7
1.5
THESIS DISPOSITION AND READING ADVICES ......................................................................... 7
METHODOLOGY .................................................................................................................. 9
2.1
INITIATION ............................................................................................................................ 9
2.2
CASE STUDY .......................................................................................................................... 9
2.3
THEORETICAL STUDY .......................................................................................................... 10
2.4
EVALUATION METHOD......................................................................................................... 11
THEORETICAL FRAMEWORK....................................................................................... 12
3.1
CORPORATE GOVERNANCE .................................................................................................. 12
3.2
IT GOVERNANCE.................................................................................................................. 18
3.3
IT GOVERNANCE FRAMEWORKS .......................................................................................... 20
3.4
COBIT ................................................................................................................................ 22
3.5
COBIT FACILITATES COMPLIANCE WITH SARBANES-OXLEY .............................................. 31
ANALYTICAL FRAMEWORK.......................................................................................... 33
4.1
DATA COLLECTION .............................................................................................................. 33
4.2
MODELING .......................................................................................................................... 37
4.3
ANALYSIS ............................................................................................................................ 38
EMPIRICAL STUDY ........................................................................................................... 39

5.1
PROCEDURE ......................................................................................................................... 39
5.2
THE FIRM ............................................................................................................................ 39
5.3
PROJECT DEFINITION ........................................................................................................... 40
5.4
CASE STUDY AT THE FIRM................................................................................................... 41
RESULTS ............................................................................................................................... 43
6.1
GENERAL RESULTS WITHIN THE MARKETS DIVISION ............................................................. 43
6.2
WEAKNESSES AT THE FIRM ................................................................................................. 47
DISCUSSION......................................................................................................................... 49
7.1
DISCUSSING THE RESULTS ................................................................................................... 49
7.2
HOW TO IMPROVE THE WEAKNESSES ................................................................................... 51
7.3
VALIDITY ............................................................................................................................ 53
7.4
RELIABILITY ........................................................................................................................ 53
CONCLUSION ...................................................................................................................... 54
LIST OF FIGURES
FIGURE 1 FRAMEWORK LINKING CORPORATE GOVERNANCE TO IT GOVERNANCE8 ............................ 13
FIGURE 2 POSITIONING OF IT GOVERNANCE AND IT MANAGEMENT. SOURCE: PETERSON, SEE
GREMBERGEN, 2004................................................................................................................................................ 19
FIGURE 3 COBIT, OVERLYING FRAMEWORK PRINCIPLES. SOURCE: IT GOVERNANCE INSTITUTE,
COBIT 4.0 ................................................................................................................................................................. 23
FIGURE 4 COBIT, STRUCTURE AND INTERRELATIONSHIP OF PROCESSES. SOURCE: IT GOVERNANCE
INSTITUTE, COBIT 4.0 ........................................................................................................................................... 24
FIGURE 5 COBIT, OVERALL FRAMEWORK. SOURCE: IT GOVERNANCE INSTITUTE, COBIT 4.0 ........ 25
FIGURE 6 METRICS. SOURCE: IT GOVERNANCE INSTITUTE, COBIT 4.0 ................................................. 28
FIGURE 7 RACI-CHART. SOURCE: IT GOVERNANCE INSTITUTE, COBIT 4.0 ......................................... 30
FIGURE 8 DOCUMENTS. SOURCE: IT GOVERNANCE INSTITUTE, COBIT 4.0 ......................................... 30
FIGURE 9 MAPPING TO PCAOB TO COBIT. SOURCE: ITGI (2006), IT CONTROL OBJECTIVES FOR
SARBANES-OXLEY, THE ROLE OF IT IN THE DESIGN AND IMPLEMENTATION OF INTERNAL CONTROL
OVER FINANCIAL REPORTING. ............................................................................................................................... 31
FIGURE 10 WEIGHTED RESULTS ON ALL COBIT PROCESSES...................................................................... 44

FIGURE 11 TOP AND BOTTOM PROCESSES EMPHASIZED .............................................................................. 45
FIGURE 12 THE STRONGEST AREAS .................................................................................................................. 45
FIGURE 13 THE WEAKEST AREAS ...................................................................................................................... 47
FIGURE 14 SUGGESTED IMPROVEMENTS, CONTROLS AND METRICS ......................................................... 51
INTRODUCTION
This chapter gives the reader an introduction to the subject of matter. I present
background to the research, a problem description, the purpose of my thesis where
I display my research question, then delimitations of this thesis and finally, my
thesis disposition.
1.1
BACKGROUND
Companies growing and merging with other businesses demand great changes to
their infrastructure. The equities market space is constantly evolving and the
implications to the IT systems and processes within the organizations are
substantial. Companies today depend to a great extent on the information stored
and managed through IT and many would not be able to operate without a
functional IT structure. The increasing regulatory demands also put a pressure on
the accounting, documenting and reporting through IT. The systems are required
not only to support the operations of the companies, but to report and store
financial and organizational data to meet external demands. It is no longer enough
to look at talented individuals to manage IT projects, the projects regularly need to
be structured as sustainable processes, where documentation and measuring is
standardized. Many companies acknowledge this need and put more effort into
standardizing the IT structure, policies and procedures and focus on aligning them
to the business objectives. This practice is called IT governance and will be further
explained and discussed throughout this report.
To facilitate the governing of IT there are several frameworks available on the
market. One of the most frequently used and chosen in this work is called COBIT1,
the Control Objectives for Information and Related Technology, further described
IT governance institute (2005), Control objectives for Sarbanes-Oxley
in section 3.4. COBIT gives guidance from best practices derived from major
global IT-related standards, practices and frameworks on processes and its
constituents to aid in the work of governing IT. The framework defines a set of
processes, to which there is a number of activities, suggested documentation and
measuring. It provides a high level view of an IT organization and what could be
done within it. COBIT also associates a maturity model that can be used to
benchmark the performance and level of definition to each process in a
standardized manner. The scale, which is obtained from the Capability Maturity
Model (CMM), described in section 3.3.3 spans from 0 to 5, with 5 being the
highest.
To many organizations, the help of external best practices is a cost efficient and
effective alternative to creating own frameworks and standards. This thesis will
highlight the work with one of these frameworks, namely COBIT and look at the
possibilities to improve the governance on a specific IT organization through the
help of that framework. The project has been performed at one of the largest
investment banks in the world at a global division on the IT side. The project has
followed the organizations desire to externally assess their IT performance with
COBIT as a frame for benchmarking.
The organization is in this thesis referred to as The Firm and the specific part of
The Firm that the project is focused on is called The Markets division. This is
further described in section 5.2. My advisor at the department of Industrial
Information and Control Systems (ICS) at the Royal Institute of Technology is PhD
student Mrten Simonsson. My advisor at The Firm is the European Head of
Technology Business Development. Key stakeholders at The Firm are the
European Head of Technology Business Development, the Head of Development at
The Markets Division and the people responsible for the scope and implementation
phase of the COBIT initiative at The Firm. The Head of Development did
participate in interviews, but when referred to as key personnel, they do not
represent a respondents view.
1.2
PROBLEM
How should IT be governed and how could COBIT be used as guidance? In this
project, there are two key issues I have addressed.
The framework itself does not say how it should be used; it merely states
guidance on its defined processes.
The Markets division wanted to know how it compared to industry

standards and see how the effectiveness and efficiency of the IT
organization could be improved.
1.3
PURPOSE
The purpose of the project was to do an assessment of The Markets division at The
Firm with COBIT serving as a starting point. The assessment could be resembled
by a gap analysis where the difference between the framework and the actual
organization is emphasized. Derived from that assessment is the information about
strengths and weaknesses within the IT organization, in comparison to COBIT. The
four strongest and weakest areas should be emphasized and suggestions on how to
improve the weaker areas should be presented. The question I tried to answer was:
How does the IT procedures and processes at The Markets division compare to
COBIT- how big are the gaps, what could be improved and how?
1.4
DELIMITATIONS
The project was decided to be a high level assessment and was limited to gathering
information on the COBIT processes from one person per process. The definition
of a process is described in section 3.4 COBIT.
This project covers what is being done in respect to COBIT, not processes outside
those borders. The project was also limited to The Markets division which is further
described in section 5.2.
1.5
THESIS DISPOSITION
1. Introduction
This chapter gives the reader an introduction to the subject of matter. I

present background to the research, a problem description, the purpose of
my thesis where I display my research question, then delimitations of this
thesis and finally, my thesis disposition
2. Methodology
This chapter provides the projects course of action and motivates why I
have chosen this approach to address the given problem. I describe the
initiation, the method of collecting data, required theoretical knowledge and
finally how I evaluated the data
3. Theoretical framework
This chapter provides the theoretical foundation of the thesis. Initially I will
discuss theory around corporate and IT governance, leading up to the ways
IT could be governed. Brief reviews of possible IT governance frameworks
are presented to facilitate the governing of IT and the framework used in
this study, COBIT, will be described closer.
4. Analytical framework In this chapter I explain the method of collecting data in detail, the analysis
of the collected data and the method I have chosen to derive my results.
5. Empirical study This chapter portrays the data collection specific for the assessment at The
Firm and a description of the organization.
6. Results In this chapter I reveal my results of the assessment beginning with general
results. I then explain the results for the stronger and weaker areas closer.
7. Discussion This chapter will discuss the results of the assessment and highlight relevant
and interesting findings throughout the project.
8. Conclusion This chapter describes the conclusions that can be drawn from this
assessment and answers the question posed in the purpose section.
METHODOLOGY
This chapter provides the projects course of action and motivates why I have
chosen this approach to address the given problem. I describe the initiation, the
method of collecting data, required theoretical knowledge and finally how I
evaluated the data.
2.1
INITIATION
The reason why the project was initiated relates to the research of PhD student
Mrten Simonsson and the department of Industrial Information and Control
Systems at the Royal Institute of Technology, previously described in section 1.1.
The purpose, also prior described, is evaluating a part of an IT organization with
COBIT as a starting point. The first problem of the thesis project was to find a
sponsoring company that would be willing to participate in this project. During a
previous employment, I came in contact with The Firm and proposed my project.
The Firm felt as a suitable sponsor where my project could be of value. This is
further described in section 5.2. The project was also further limited to The Markets
division, also described in section 5.2 as that area seemed to be just the right size
for my study.
2.2
CASE STUDY
The case study is but one of several ways of doing social
science research. Other ways include experiments, surveys,
histories, and the analysis of archival information (as in

economic studies).2
The way to fulfill the purpose of this project has mainly been through a case study.
A more quantitative method, like questionnaires would possibly have been
applicable to this project as well. According to Holme & Solvang3 the qualitative
and quantitative methods both have their advantages and disadvantages. As COBIT
was new to many of the participants in the study, explanations were in several
cases necessary.
In general, case studies are the preferred strategy when
how or why questions are being posed2
The study required the presence of someone with knowledge in COBIT to facilitate
the questions- and answering process. This is the reason why I chose to do
interviews. That way I could participate as an interviewer with specific knowledge
in the COBIT framework and easier get accurate answers from the respondents. I
used COBIT as a starting point and asked the respondent to evaluate the maturity
on each activity within one process. I also asked them to answer how many of the
suggested documents and metrics The Markets division was actually using. Finally
I asked how the role assignment suggested in the RACI-chart corresponded to the
structure at The Markets division. COBIT specifics can be found in section 3.4.
2.3
THEORETICAL STUDY
After determining the method of gathering information there were a few areas I
needed more theoretical knowledge in. This also constitute a part of the curriculum
of a master thesis and motivates chapter 3, Theoretical framework where the
research is presented as needed to understand the empirical study. The research is
partly about corporate governance and its constituents. This along with the
relationship to IT governance depicts the foundation for the thesis subject. The way
to govern IT is suggested with help and guidance from an assessment framework
and the currently available frameworks are presented briefly as a benchmark for
2
3
Yin, Robert K. (1994), Case study research, Design and methods, second edition.
Holme & Solvang (1997).
10
comparative analysis in respect to COBIT, the framework of choice in this project.

COBIT was chosen because it is considered
arguably the most appropriate control framework to help
an
organization
ensure
alignment
between
use
of
Information Technology (IT) and its business goals4
The analysis shows the competitive advantages of COBIT compared to its

alternatives. COBIT is then described in detail in section 3.4, COBIT, as it
constitutes a large portion of the required theoretical knowledge in this thesis. The
way COBIT can be useful to organizations will be presented and examined in terms
of what drives the implementation of the framework in general. It will be shown
that COBIT is an effective framework as to assure compliance to regulatory
requirements and provide a way to enhance efficiency within the IT organization
and for the company as a whole. Various regulatory requirements will be described
along with their relationship to COBIT.
2.4
EVALUATION METHOD
After collecting the data from the interviews I needed a way to aggregate them into
results. Discussions with my advisor from ICS lead to the evaluation method. We
decided to take all results from all parts of the data collection and add them
together. The mean value generated the maturity on each process, and the mean
value on all 34 COBIT processes gave the overall maturity level.
Ridley G. et al (2004), COBIT and its Utilization: A framework from the literature.
Proceedings of the 37th Hawaii International Conference on System Sciences, IEEE
11
THEORETICAL FRAMEWORK
This chapter provides the theoretical foundation of the thesis. Initially I will discuss
theory around corporate and IT governance and the regulatory demands in that
space. This leading up to the ways IT could be governed. Brief reviews of possible
IT governance frameworks are presented to facilitate the governing of IT and the
framework used in this study, COBIT, will be described closer.
3.1
CORPORATE GOVERNANCE
In order to understand the concept of IT governance one needs insight into the
principles of corporate governance and its constituents.
"Corporate Governance is concerned with holding the
balance between economic and social goals and between
individual and communal goals. The corporate governance
framework is there to encourage the efficient use of
resources and equally to require accountability for the
stewardship of those resources. The aim is to align as
nearly as possible the interests of individuals, corporations
and society"
The Organization for Economic Cooperation and Developments 1999 published

the OECD Principles for Corporate Governance which defines corporate
governance as providing the structure through which the objectives for the
company is set and the ways to align and achieve those objectives and monitor the
performance is determined. It also set the relationships between an organizations
Sir Adrian Cadbury (2000), in 'Global Corporate Governance Forum', World Bank.
12
board, management, shareholders and additional key stakeholders.6 IT governance

closely relates to corporate governance, the structure of the IT organization and its
objectives and alignment to the business objectives.
Corporate Governance issues cannot be addressed without
considering IT Governance issues7
Weill and Ross8 have created a framework for linking the corporate governance
and IT governance principles together, which can be seen in figure 1. The areas that
relates to IT governance are marked in grey.
Figure 1 Framework linking corporate governance to IT governance8
There are several ways of looking at the connection between corporate governance
and IT governance. Another is described by Van Grembergen, De Raes and
6
OECD (1999), Principles of Corporate Governance.
Van Grembergen, De Raes o Guldentops (2004), Structures, Processes and Relational

Mechanisms for IT Governance, Idea Group inc.
8
Weill & Ross (2004), IT Governance
8
13
Guldentops8. They use Shleifer, A. & Vishnys9 work and mention three key
questions that they say the management team should address to display the
connectivity between corporate governance and IT governance.
Corporate Governance Questions:

How do suppliers of finance get
managers to return some of the
profits to them?
How do suppliers of finance make sure
that managers do not steal the capital
they supply or invest it in bad
projects?
How do suppliers of finance control
management?
- IT Governance Questions:
- How does management get their CIO and
IT organization to return some business
value to them?
- How does top management make sure that
their CIO and IT organization does not steal
the capital they supply or invest in bad
projects?
- How does top management control their
CIO and IT organizations?
Table 1 Corporate and IT governance questions10
3.1.1
REGULATORY REQUIREMENTS ON CORPORATE GOVERNANCE

With the amount of effort still needed to address SarbanesOxley, Basel II, and the European 8th Directive---to name
but a few---compliance with regulations is expected to
maintain its position as the top driver for information
security going forward10
These regulatory requirements constitute a large portion of the need for structure
within organizations and the implications on IT are substantial. In coordination
with various financial and regulatory requirements, a new era of high level
corporate and IT thinking has emerged. A key driver for IT governance have the
last couple of years, been these external demands and the most significant one so
far has been the Sarbanes-Oxley act, described below. There are a few other
important regulations, like Basel II, the European 8th Directive and Mifid but they
will not be discussed in this study and their implications to IT will not be taken into
account.
Schleifer A. & Vishny (1997), A survey on corporate Governance. The Journal of Finance, 52(2)
Ernst &Young (2005), Global Information Security Survey
10
14
THE SARBANES-OXLEY ACT OF 2002

The Sarbanes-Oxley act of 2002, SOX, has changed the world of reporting
accountabilities as we know it. A number of corporate and accounting scandals,
most notably Enron, Tyco International and WorldCom reinvigorated the debate on
regulating corporate governance. The loss of trust in large corporations accounting
and reporting practices became apparent. To restore the lack of trust investors and
shareholders experienced, the Sarbanes-Oxley act was created. The act was passed
on as United States federal law on July 30, 2002 initiated by the naming sponsors,
Senator Paul Sarbanes and Representative Michael G. Oxley.
All companies, including subsidiaries, American or not, listed on American stock

exchanges like NYSE, the New York Stock Exchange, or NASDAQ are required to
comply with the Sarbanes-Oxley act. The act establishes standards for all such
companys boards, managements and public accounting firms. Containing eleven
titles, details in appendix 1, the act ranges from describing the increased corporate
board responsibilities to criminal penalties for corporate wrongdoing. It also
obligates the SEC, Securities and Exchange Commission, to implement rulings and
accounting standards for compliance. The titles or sections of the act can be seen
below and are of varying importance in regards to this thesis.
Title I Public Company Accounting Oversight Board

Title II Auditor Independence
Title III Corporate Responsibility
Title IV Enhanced Financial Disclosures
Title V Analyst Conflicts of Interest
Title VI Commission Resources and Authority
Title VII Studies and Reports
Title VIII Corporate and Criminal Fraud Accountability
Title IX White Collar Crime Penalty Enhancements
Title X Corporate Tax Returns
Title XI Corporate Fraud Accountability
Title III and IV are the titles that are closest related to this work.
15
The two sections that should concern IT executives the

most are 302 and 404(a) because they deal with the
internal controls that a company has in place to ensure the
accuracy of their data. This relates directly to the software
systems that a company uses to control, transmit and
calculate the data that is used in their financial reports.11
Section 302 is characterized mainly by the CEOs and CFOs responsibility of

internal control regarding the annual financial reporting.
Section 404 demands each annual report to contain an internal control report which
shall
(1)
state the responsibility of management for establishing and
maintaining an adequate internal control structure and procedures for

financial reporting; and
(2) contain an assessment, as of the end of the most recent fiscal year
of the issuer, of the effectiveness of the internal control structure and
procedures of the issuer for financial reporting.12
Even though the act is focused on accounting and financial reporting, the
importance of appropriate IT systems as an integral part in the reporting procedure
is evident. The systems ensure the validity of information and provide fundamental
structure to the reporting standards and assessments of financial data. Section 409
of the act expresses the real time accounting demands and is central to the IT
systems involved.
11
12
Dietrich, Robert (2004). Sarbanes-Oxley and the Need to Audit Your IT Processes, MKS
Sarbanes and Oxley act of 2002 Section 404. PUBLIC LAW 107204
16
REAL TIME ISSUER DISCLOSURES.Each issuer reporting

under section 13(a) or 15(d) shall disclose to the public on a
rapid and current basis such additional information
concerning material changes in the financial condition or
operations of the issuer, in plain English, which may
include trend and qualitative information and graphic
presentations, as the Commission determines, by rule, is
necessary or useful for the protection of investors and in the
public interest.]13
The relationship between IT systems and section 409 is described by Rob Smith,
Co-Chair of Industry Solutions SOX Committee and Michael Kuhbock, CoChairman and Founder of the Integration Consortium.
The only way for issuers to be aware of real time
information and trends on operations or the physical
activities of their organization is for the issuers systems to
report on anomalies and trends in real time and on an
exception basis. As well, the integration of any new system
into an organization will have to pass SOX compliancy
before it is either selected or plugged in. Failure of control
process, due to a systems failure will strictly fall under the
409 clause regarding material change.14
This could very well be the most grueling challenges in the compliance work and
one of the reasons corporations struggle to find easily adopted, implemented and
administered frameworks to facilitate the process of compliance. A framework is
required by the act; however the choice of version is free. One such framework is
provided by COBIT and another by COSO, described in section 3.4 and 3.3.2
respectively.
13
14
Smith R. Kuhbock M.. Sarbanes Oxley 404/409-Integration Organizations and SOX.
www.integrationconsortium.org
17
COSOs framework is the most frequently used when implementing compliance

procedures today.15 It is also recommended by the SEC to aid in such tasks. COSO,
does not provide a great deal of guidance to assist companies in the design and
implementation of IT controls.16 COBIT on the other hand has its main focus on
controls within the IT organization.
The auditing standards are set by the PCAOB, The Public Company Accounting
Oversight Board. The PCAOB is created by Sarbanes-Oxley and described in title I
of the act. The purpose is to supervise and regulate the work done by auditing
companies. It also sets the working principles for the auditing companies.
3.2
IT GOVERNANCE
IT Governance is the organisational capacity exercised by
the Board, executive management and IT management to
control the formulation and implementation of IT strategy
and in this way ensure the fusion of business and IT.17
These are the words of well renowned, IT governance theorist, Grembergen in

2002. There have been several different ways of defining IT governance, below are
a few additional of the more famous displayed.
IT governance is the responsibility of the board of directors
and executive management. It is an integral part of
enterprise governance and consists of the leadership and
organisational structures and processes that ensure that
the
organisations
IT
sustains
and
extends
the
organisations strategies and objectives.18
The organisational capacity to control the formulation and

implementation of IT strategy and guide to proper direction
15
IT Governance Institute (2005), IT Control objectives for Sarbanes-Oxley
16
IT governance institute (2006), IT control objectives for Sarbane-Oxley
17
Grembergen, (2002)
18
IT governance institute (2003)
18
for the purpose of achieving competitive advantages for the

corporation19
The theory of IT governance as mentioned before is partly driven by the external

regulatory demands. Besides that, an increasing number of companies acknowledge
that a well defined structure and high level of guidance truly can contribute to the
overall cost efficiency and performance of IT. One of the key focuses of IT
governance according to Grembergen, (2004) is to align IT to business objectives.
As an explanation it could be said that IT governance is the mix between corporate
governance and IT management. According to Peterson, figure 2 can be used to
describe the relationship between IT management and IT governance.
FIGURE 2 POSITIONING OF IT GOVERNANCE AND IT MANAGEMENT. SOURCE: PETERSON, SEE

GREMBERGEN, 2004.
The difference between them could help provide a better view of what IT
governance is, as confusion easily occurs. Weill and Ross (2004), says that
governance determines who should make decisions and management is the process
of making and implementing the decisions.
19
The Ministry of International Trade and Industry (1999)
19
3.3
IT GOVERNANCE FRAMEWORKS
3.3.1
ITIL
The IT Infrastructure Library, ITIL, was created by the British Office of

Government Commerce, OGC, to more effectively manage IT within British
authorities as well as public companies. The principles of the ITIL framework were
derived out of best practice with regards to observed companies within the IT
sector. It is now a fully documented set of best practice documents for IT service
management and the most widely accepted approach to IT service management in
the world.20 It consists of several books, hence the term library. At the moment
there are eight books:
1. Service Delivery
2. Service Support
3. ICT Infrastructure Management
4. Security Management
5. The business perspective
6. Application management
7. Software Asset Management
8. Planning to Implement Service Management
ITILs main objectives are to provide best practice definitions and criteria for
operations management within two key areas, namely Service Support and Service
Delivery2122. In these areas ITIL focuses on the operational, organizational and
functional attributes required for optimized operations management. These areas
also have a number of supporting subcategories. ITIL, however does not cover the
strategic impact of IT and the relation between IT and the business.2021
20
Office of Government Commerce, OGC. http://www.itil.co.uk/
21
Office of Government Commerce: IT Infrastructure Library Service Support. The

Stationery Office (2002)
22
Office of Government Commerce: IT Infrastructure Library Service Delivery. The
20
3.3.2
COSO
COSO or the Committee of Sponsoring Organizations of the Treadway

commission was established in 1985. In 1992 COSO released the Internal Control
Integrated framework. It was originally developed to cope with the fraudulent
financial reporting present in the world of corporate accounting.23 The framework
COSO consists of five interrelated Internal control components and three
Enterprise risk management components. The ERM components and the Enterprise
Risk Management Integrated Framework, were created in collaboration with
PriceWaterhouseCoopers in 2004. All components are shown below with risk
management components in bolded fonts.
Internal Environment
Objective Setting
Event Identification
Risk Assessment
Risk Response
Control Activities
Information and Communication
Monitoring
COSO is a voluntary private sector organization dedicated
to improving the quality of financial reporting through
business ethics, effective internal controls, and corporate
governance.23
The five components of internal control that COSO identifies can be resembled by
the guidance COBIT provides for IT.24
23
COSO-The Committee of Sponsoring Organizations of the Treadway commission, www.coso.org
24
Damianides, Marios (2005), SarbanesOxley and IT governance: New guidance on it control and
compliance http://www.infosectoday.com/SOX/Damianides.pdf
21
3.3.3
CMMI
Capability Maturity Model Integration (CMMI) is a process
improvement approach that provides organizations with the
essential elements of effective processes. It can be used to
guide process improvement across a project, a division, or
an entire organization.25
CMMI, (Capabilities Maturity Model Integration), previously CMM developed by

the Software Engineering Institute (SEI), provides a model to improve the
efficiency in processes across an organization. As the name implies, a key element
in the model is the evaluation of maturity through a maturity model. This maturity
model is further described in section 3.4.1.
3.4
COBIT
COBIT is short for the Control Objectives for Information and Related Technology
and was developed by the Information Systems Audit and Control Foundation,
ISACF in 1996. ISACF, founded 1969 later became ISACA, Information Systems
Audit and Control Association. ISACA, is now a global organization with over 50
000 members in more than 140 countries. The founders, a group of IT auditors,
recognized the increasing need for control within IT organizations and decided to
create a network for information and guidance in the field. In 1998 ISACA
established the IT Governance Institute, ITGI, who is now responsible for COBIT.
During the fall of 2005, ITGI released a version 4.0 of COBIT which constitutes
the framework of reference in this thesis.
COBIT was originally developed as a tool to control IT and reduce risk within IT
organizations, primarily in the banking and e-business industries. It has evolved to
become more business oriented and now gives a high level image on what to
accomplish within an organization rather than how. It is designed to provide
fundamental guidance to management and process owners to in best way possible
allocate the assets of the organization. Figure 3 shows the overlying framework
principles.
25
Software Engineering Institute (SEI) http://www.sei.cmu.edu/cmmi/general/general.html
22
FIGURE 3 COBIT, OVERLYING FRAMEWORK PRINCIPLES.

SOURCE: IT GOVERNANCE INSTITUTE, COBIT 4.0
The COBIT framework has the aspiration to be both responsive and practical in the
sense of the business needs, while at the same time being independent to the
technical and structural differences within various organizations.
COBIT uses ideas from all frameworks above and even more standards when
creating its definitions and controls.
For this COBIT update (COBIT 4.0), six of the major global ITrelated standards, frameworks and practices were focused
on as the major supporting references to ensure appropriate
coverage, consistency and alignment26
The standards, frameworks and practices mentioned in the quote above are:26
Committee of Sponsoring Organisations of the Treadway Commission (COSO):
Internal ControlIntegrated Framework, 1994
Enterprise Risk MangementIntegrated Framework, 2004
Office of Government Commerce (OGC):
IT Infrastructure Library (ITIL), 1999-2004
International Organisation for Standardisation:
ISO/IEC 17799:2005, Code of Practice for Information Security Management
Software Engineering Institute (SEI):
SEI Capability Maturity Model (CMM), 1993
SEI Capability Maturity Model Integration (CMMI), 2000
Project Management Institute (PMI):

26
IT Governance Institute (2005), COBIT 4.0
23
Project Management Body of Knowledge (PMBOK), 2000
Information Security Forum (ISF):
The Standard of Good Practice for Information Security, 2003
Originally the framework was based on three separate documents:

Control Objectives is the first of the documents that describes the 34 processes
and the control objectives to each process employed by COBIT. The maturity
levels are not regarded in this section.
Management Guidelines presents the maturity levels and the two measurable
indicators connected to each process type.
Audit Guidelines is based on Management Guidelines and provide advice on who
to interview and what kind of information is demanded to each process type.
THE COBIT FRAMEWORK
COBIT provides a detailed and easily used model to govern IT. The structure and
interrelationship of the processes that COBIT treats is shown in Figure 4. The
COBIT control objectives document is divided into four domains that describe the
risks and activities within IT that needs to be managed. The domains in turn are
divided, in all into 34 different high level control objectives or processes. The
processes each encompass detailed control objectives, activities, roles, different
metrics and an incremental measurement scale. The roles in turn have
responsibilities associated to the activities.
FIGURE 4 COBIT, STRUCTURE AND INTERRELATIONSHIP OF PROCESSES. SOURCE: IT

GOVERNANCE INSTITUTE, COBIT 4.0
24
The processes apply at different levels of the IT organization and each domain
could help to provide an understanding of the purpose of the processes. The names
of all the COBIT processes are displayed in Figure 5.
FIGURE 5 COBIT, OVERALL FRAMEWORK. SOURCE: IT GOVERNANCE INSTITUTE, COBIT 4.0
The four COBIT domains; Plan and Organise, Acquire and Implement, Deliver and
Support and Monitor and Evaluate as shown in figure 5, are clarified below.
Plan and Organise (PO) describes how the business

objectives are best reached through the use of IT. This
domain administrates the use of tactics and strategy to
25
plan, communicate and manage the different perspectives

throughout the organization.
Acquire and Implement (AI) depicts the identifying and

acquiring of IT solutions. Furthermore this domain
explains the solutions integration to the business processes
and how to manage and upkeep the existing systems.
Deliver and Support (DS) handles the actual delivery of

the information at hand and see to the management of
service levels, performance and capacity, configurations,
operations and the physical environment, to name a few.
This domain is also responsible for the identification and
allocation of costs and the training of users.
Monitor and Evaluate (ME) describes the monitoring

and evaluation of all the processes employed by the IT
organization. This domain also delivers the final statement
to provide IT governance
3.4.1
ASSESSMENT WITH THE COBIT FRAMEWORK
MATURITY MODEL
It is not easy to know how to benchmark an organization and to what grade of
accuracy the evaluation should be scaled. COBIT suggests an incremental
measurement scale of six maturity levels. Going from 0, Non-existent to 5,
Optimized, COBIT covers the entire spectrum of maturity in a process. The
structure and design of the scale is the same as the one used by Capability Maturity
Model, (CMM), described in section 3.3.3. These maturity levels are individually
explained for each of the 34 processes but the general structure could be seen in
table 2.
26
Non-Existent
Complete lack of any recognisable processes. The organisation has not even
recognised that there is an issue to be addressed.
Initial
There is evidence that the organisation has recognised that the issues exist
and need to be addressed. There are however no standardised processes but
instead there are ad hoc approaches that tend to be applied on an individual
or
Repeatable
Processes have developed to the stage where similar procedures are followed
by different people undertaking the same task. There is no formal training or
communication of standard procedures and responsibility is left to the
individual. There is a high degree of reliance on the knowledge of individuals
and therefore errors are likely.
Defined
Procedures have been standardised and documented, and communicated

through training. It is however left to the individual to follow these processes,
and it is unlikely that deviations will be detected. The procedures themselves
are not sophisticated but are the formalisation of existing practices.
Managed
It is possible to monitor and measure compliance with procedures and to take

action where processes appear not to be working effectively. Processes are
under constant improvement and provide good practice. Automation and tools
are used in a limited or fragmented way.
Optimised
Processes have been refined to a level of best practice, based on the results
of continuous improvement and maturity modelling with other organisations.
IT is used in an integrated way to automate the workflow, providing tools to
improve quality and effectiveness, making the enterprise quick to adapt.
TABLE 2 MATURITY MODEL. SOURCE: IT GOVERNANCE INSTITUTE, COBIT 4.0
ACTIVITIES
The activities are a significant part of the suggested guidance COBIT describes for
each process. They say what should be done and they are also associated to the
roles, further described under Roles and Responsibilities. An example of
activities is shown in figure 7, RACI-chart. As previously mentioned; COBIT also
describe detailed control objectives. The detailed control objectives often
correspond to the activities and their purpose is the same. COBIT is not entirely
consistent about this but in many cases, the activities are just simplified detailed
control objectives.
METRICS
To improve the efficiency and effectiveness of the processes, COBIT suggest a set
of metrics to use as measurement to each process. The metrics are different for
each process but some of the outlines are similar. The metrics are in the version
used in this study, COBIT 4.0, Key Performance Indicators, Process Key Goal
27
Indicators and IT Key Goal Indicators. For the process, Manage the IT
investment the metrics are shown in figure 6.
FIGURE 6 METRICS. SOURCE: IT GOVERNANCE INSTITUTE, COBIT 4.0
Just to clarify what is shown in the image, one metric COBIT suggests could be to
measure the percentage of projects with benefit defined upfront. That metric can
be seen in the upper left corner of the Key Performance Indicators box in figure 6.
According to Guldentops27 the primary purpose of the guidelines is to enable
corporate management to:
Measure Performance What are the indicators of good

performance?
Profile their IT control Whats important? What are the

critical success factors for control?
Enhance their awareness What are the risks of not

achieving our objectives?
Benchmark the organization What do others do? How do

we measure and compare?
The indicators are the key inputs in the benchmarking process. The Management
guidelines indicators are Key Goal Indicators (KGIs), Key Performance Indicators
(KPIs) and maturity models.
The Key Goal Indicators represents what has to be accomplished in order to

achieve the process goals. They define measures that tell if business objectives
27
Guldentops, E in Van Grembergen, W (2004). Strategies for Information Technology Governance.
Idea Group Inc. Chapter 11 Governing Information Technology through COBIT.
28
have been met for a specific process and are often defined as the target to achieve.
Business requirements are generally expressed in terms of information criteria:
Availability of information needed to support the business needs
Absence of integrity and confidentiality risks
Cost-efficiency of processes and operations
Confirmation of reliability, effectiveness and compliance
The Key Performance Indicators define measures to explain to what extent the
process is fulfilling its objectives, how well its performing. They are the most
important indicators in revealing whether or not a goal will be reached and are
often used to in an early stage tell if the KGIs will be difficult to achieve.
ROLES AND RESPONSIBILITIES

COBIT describes a number of different roles that an IT organization should use.
The roles suggested by COBIT can be seen below.
Chief executive officer (CEO)

Chief information officer (CIO)
Business executives
Chief financial officer (CFO)
Head operations
Chief Architect
Head development
Head IT administration
The project manager office (PMO)
Compliance, audit risk and security
To every process there are a number of activities with the responsible employee or
employees conveyed in a chart, called a RACI-chart, see figure 7. To be more
precise COBIT defines four different ways in which a person or role should be
connected to an activity. The different ways are Responsible, Accountable,
Consulted and Informed, hence the name RACI. The Responsible person is the one
responsible for the execution of an activity while Accountable is the one who
authorizes it. Consulted is someone who should be asked or consulted when an
29
activity is performed while the function of Informed is merely one who should
know about the activity. Figure 7 shows the roles as functions and their relationship
to the activities of the process Manage the IT investment. The activities extend
the understanding of the process and its purpose. To each activity there is either a
Responsible or an Accountable role to see to that the activity is executed in a proper
manner.
FIGURE 7 RACI-CHART. SOURCE: IT GOVERNANCE INSTITUTE, COBIT 4.0
DOCUMENTS
Relevant documentation renders repetition and effective feedback of the processes
possible. COBIT defines which documents should exist at the initiation stage and
which should be produced during the process. They are referred to as Inputs and
Outputs, shown in figure 8.
FIGURE 8 DOCUMENTS. SOURCE: IT GOVERNANCE INSTITUTE, COBIT 4.0
30
3.5
COBIT FACILITATES COMPLIANCE WITH SARBANES-OXLEY
As mentioned above, COBIT is one applicable assessment framework that could

help in the compliance of SOX. COBIT aligns 12 of the IT control objectives with
the PCAOB Auditing standards No 2, displayed in figure 9. COBIT focuses on IT
as opposed to COSO which is focused on controls for financial processes. This
means that COBITs guidance is centered on the IT processes which in reality are
the way through which financial auditing is conducted.
COBIT enables clear policy development and good practice
for IT control throughout organizations. ITGIs latest version
COBIT
4.0
emphasizes
regulatory
compliance,
helps
organizations to increase the value attained from IT,

enables alignment and simplifies implementation of the
COBIT framework.28
FIGURE 9 MAPPING TO PCAOB TO COBIT. SOURCE: ITGI (2006), IT

CONTROL OBJECTIVES FOR SARBANES-OXLEY, THE ROLE OF IT IN THE
DESIGN AND IMPLEMENTATION OF INTERNAL CONTROL OVER FINANCIAL
REPORTING.
Appendix 2 shows the IT Governance Institutes compliance to SOX, roadmap.
28
www.Isaca.org
31
While implementing procedures to comply with SOX regulations, many companies

choose to overlook the IT structure to see what else could be improved during the
reconstructuring. Ernst & Young have interviewed 1300 companies regarding
information security practice. They experienced a surprisingly low 41 percent of
the interviewees using the opportunity of restructuring IT while complying with
external regulatory requirements. According to Ernst & Young its the ideal time to
improve and streamline the business structure while a structural change still is
inevitable due to the external regulatory demands.29
29
Ernst&Young (2005), Global Information Security Survey
32
ANALYTICAL FRAMEWORK
In this chapter I explain the method of collecting data in detail, the analysis of the
collected data and the method I have chosen to derive my results.
4.1
DATA COLLECTION
There are no rules that govern the way to use COBIT and to what extent it is to be
implemented. Each organization may adopt the framework to meet their business
objectives in which way they see fit.
COBIT works as a helping hand, providing guidance to the management on how,
according to best practice to use the assets and people within the organization.
However, the complexity of COBIT could make the usage difficult and time
consuming. Furthermore it leaves room for interpretation, which means that two
interviewers could obtain incomparable results on the same assessment. It is not a
given that for instace the COBIT-defined activities, are interpreted the same way
by two separate people. While the purpose of COBIT is to provide guidance on IT
governance, it does require a substantial amount of expertise with regards to the
framework. This has led to the creation of a tool through which COBIT can be used
in a more formalized and straightforward way. This improves the validity and
makes the framework more usable. It was created by PhD student Mrten
Simonsson at the department of Industrial Information and Control Systems (ICS)
at the Royal Institute of Technology. I will here describe how the data can be
collected, the modeling tool used and how to analyze the results.
33
As presented in section 2.4 the interviews will provide the input information to the
project. The vast majority of the respondents should be executives with
management functions as their knowledge is most likely to correspond to the kind
of strategic information COBIT deals with. The descriptions below explains the
steps to take when working with COBIT and conducting the interviews.
1. Who to speak to about what

With key personnel, map each of the suggested roles in COBIT to
corresponding person at the organization under evaluation. From that
mapping, talk to the person with the highest responsibility on each
COBIT process. Through this method some individuals could easily
become potential respondents to many processes. To even out the
time spent with each individual, discuss together with key
stakeholders at the organization under evaluation and try to find other
people that could answer questions on some of those processes.
2. Short introduction to the project.
Send by email a short PowerPoint briefing about the project and also
information regarding the subject of the interview. This generally makes the
face-to-face introduction shorter. Many times the respondent will not have
time to review the material beforehand, which leads to the need of a
background description of the project and COBIT anyway.
3. Explanation of respondents role

Ask the respondent to explain his/hers role at the organization under
evaluation. This could make it easier to appreciate from where the answers
come.
4. Evaluation of a process
The respondents should be asked about the activities within each process he/she is
either Accountable or Responsible to, according to the RACI-chart. The question is
on what level of maturity in terms of the maturity model the respondent places that
activity, section 3.4.1.
34
The respondent should also be asked about the documents associated to the process
and the measured KPIs and KGIs. This will be yes or no questions, adding up to a
total which later in the analysis is compared to the maximum number of metrics
defined by COBIT. In more detail the interviews can be done as follows.
1. The respondents should be asked to assess the maturity on each activity

suggested by COBIT. Table 3 could be used to assign maturity for each
activity: (For help and guidance, the maturity model provided on each
process in the COBIT document can be used)
MATURITY
ACTIVITY EXECUTION
LEVEL
LEVEL 0
NO AWARENESS OF THE IMPORTANCE OF ISSUES RELATED TO THE ACTIVITY. NO MONITORING IS PERFORMED. NO

DOCUMENTATION EXISTS.
NO ACTIVITY IMPROVEMENT ACTIONS TAKE PLACE.

LEVEL 1
SOME AWARENESS OF THE IMPORTANCE OF ISSUES RELATED TO THE ACTIVITY. NO MONITORING IS PERFORMED. NO
DOCUMENTATION EXISTS. NO ACTIVITY IMPROVEMENT ACTIONS TAKE PLACE.
LEVEL 2
INDIVIDUALS HAVE KNOWLEDGE ABOUT ISSUES RELATED TO THE ACTIVITY AND TAKE ACTIONS ACCORDINGLY. NO
MONITORING IS PERFORMED. NO DOCUMENTATION EXISTS. NO ACTIVITY IMPROVEMENT ACTIONS TAKE PLACE.
LEVEL 3
AFFECTED PERSONNEL ARE TRAINED IN THE MEANS AND GOALS OF THE ACTIVITY. NO MONITORING IS PERFORMED.
DOCUMENTATION IS PRESENT. NO ACTIVITY IMPROVEMENT ACTIONS TAKE PLACE.
LEVEL 4
AFFECTED PERSONNEL ARE TRAINED IN THE MEANS AND GOALS OF THE ACTIVITY. MONITORING IS PERFORMED.
DOCUMENTATION IS PRESENT. THE ACTIVITY IS UNDER CONSTANT IMPROVEMENT. AUTOMATED TOOLS ARE
EMPLOYED IN A LIMITED AND FRAGMENTED WAY
LEVEL 5
AFFECTED PERSONNEL ARE TRAINED IN THE MEANS AND GOALS OF THE ACTIVITY. MONITORING IS PERFORMED.
DOCUMENTATION IS PRESENT. AUTOMATED TOOLS ARE EMPLOYED IN AN INTEGRATED WAY, TO IMPROVE QUALITY
AND EFFECTIVENESS OF THE ACTIVITY
TABLE 3 ACTIVITY ASSESSMENT
A mean value for all activities within a process, the average activity
maturity (AM), should then be calculated. The values are threshold values,
i.e. all criteria for level 3 have to be fulfilled in order to achieve level 3
maturity.
2. The RACI-chart should be discussed on each point to see how well it

corresponds to the role assignment of the organization under evaluation. It
is broadly visualized in table 4. For more details, see appendix 5, Role
assignment
35
3. The documents should be asked on one by one and the number of

documents that actually exists within the organization is to be compared to
those suggested by COBIT. The percentage of documents gives the
maturity value, according to table 4.
4. The same procedure for the metrics (Key Performance Indicators, Process
Key Goal Indicators, IT Key Goal Indicators) as with the documents. How
many of the suggested metrics they actually used as measurement should be
counted. This also shown in table 4.
MATURITY
DOCUMENTS IN PLACE
ASSIGNED RESPONSIBILITIES
LEVEL
METRICS
MONITORED
LEVEL 0
NO RELATIONS EXIST
0%
0%
LEVEL 1
LEVEL 2
AT LEAST 20 % OR RELATIONS IN LINE WITH COBIT.

20 %
40 %
20 %
40 %
LEVEL 3
60 %
60 %
LEVEL 4
AT LEAST 80 % OF RELATIONS IN LINE WITH COBIT.
80 %
80 %
LEVEL 5
100 % OF RELATIONS IN LINE WITH COBIT.
100 %
100 %
TABLE 4 METRIC, DOCUMENT AND METRIC ASSESSMENT.
The process maturity (PM) for the entire process is then calculated as the mean of
the average activity maturity (AM) , The assigned responsibilities maturity
(RM), the documents in place maturity (DM) , and the Metrics monitored
maturity (MM).
PM= (AM+RM+DM+MM)/4
The values are also threshold values, i.e. all criteria for level 3 have to be fulfilled
in order to achieve level 3 maturity. This means that it requires 100% usage of the
metrics suggested in COBIT in order to achieve level 5.
36
Regarding weights for separate metrics, the basic assumption is that all metrics
have the same weight. It is up to each organization to do their own weighting but a
guideline could be that activities should have the highest weight followed by the
metrics.
As an optional final step, the respondent should be asked to evaluate where he/she
thinks the entire organization or the suggested silo would land on the maturity
scale. This should not be used in the assessment but is interesting to collected for
future benchmarking and evaluation of the maturity assessment method.
4.2
MODELING
The modeling phase represents the aggregation of all the collected data and the
creation of a map showing all the COBIT processes and its relations to the
activities, metrics, roles and documents used by the organization. The reason for
creating an architectural map is to easier get an overview of the processes and their
relationships and to set definitions so that information about the model more easily
can be derived. The map in this case study was created with a modeling program
called Metis, a Troux technologies30 product. Metis is the software chosen by ICS,
which is why I used it for this study. User specific functionality in Metis is done
through an application Programming Interface (API) that supports Visual Basic and
Java script. At ICS an own Meta model that incorporates the definitions, rules and
restrictions of the model I used in this project has previously been created. That
Meta model describes what could be modeled, which processes, metrics,
documents and relations could be used in the model. It holds a reference model of
the complete COBIT framework to which the model of the organization under
evaluation could be compared. The gap between the reference model and the model
under evaluation generates the basis for the results and give the maturity to the
processes. The complete map can be seen in appendix 4, Model of The Firm. The
modeling in Metis is a method that is still under evaluation by ICS. It will be used
to a greater extent in future research as the benefit of using it increases the more
defined this method gets. One of the key beneficial aspects of the model, is that it
can be used to easier change relations to the processes.
30
Troux Technology, Metis http://www.troux.com
37
4.3
ANALYSIS
The analysis is where the results are reviewed from the modeling and which
conclusions could be drawn from the work. As one of the goals in the thesis was to
find areas or processes with lower and higher maturity level and suggest
improvements, the conclusion of the modeling was crucial in this study. The
processes with more and less mature nature have been examined in detail. This is
further described in chapter 6, Results. From the interviews I have tried to figure
out which are the key gaps or specific strengths within those areas. To find out
more about the current state and the reason for the strong or weak procedures and
policies within those areas, key personnel from The Firm was involved and
questioned.
38
EMPIRICAL STUDY
This chapter portrays the data collection specific for the assessment at The Firm
and a description of the organization.
5.1
PROCEDURE
This project will initially be described with a short introduction of the company
where the study was done. After that follows in chronological order the phases of
the project with the Initiation followed by Project definition and Case study at The
Firm.
5.2
THE FIRM
For security reasons the name of the company where the study took place will not
be revealed, it will instead be given a fictitious name, The Firm. The company I
have chosen to call The Firm is one of the largest and most well known investment
banks in the world. It operates on a global basis and house more than 50 000
employees. The Firm has taken a silo like approach to enterprise structure, which
means that each division functions almost as a separate organization. Each silo has
got roles equivalent to what a normal company would have, like CIO (Chief
Information Officer) and CFO (Chief Financial Officer). As this thesis mainly is
about IT governance and the structure around IT processes, the following
description is focused on the IT organization at The Firm.
Many roles are clearly defined within each silo. Their responsibilities are most
often tied to the area they are stationed in but their superior officers
responsibilities could vary from central isolated groups to officers controlling
39
several silos. As many separate groups perform functions that are of use to all areas
at The Firm, those groups are in a way a part of all the silos. As will be described in
section 1.5 the purpose of this project is to do an assessment of a specific division
or silo at The Firm called The Markets division. The silo I, together with key
stakeholders from The Firm, chose for this project is not really a silo but a mixture
of three silos. The reason for choosing The Markets division was a result of several
discussions with people who later became key stakeholders in the project.
Because many external auditors and regulators use COBIT, The Firms internal
audit section has chosen to use it. Thereby they talk the same language. COBIT
is also the basis for the structure of their new global IT policy program31, which is
why I found this company to be a suitable sponsor of this project.
5.3
PROJECT DEFINITION
As the need for structure and definition of the project was evident, many
introductory interviews contributed to the project layout. These interviews along
with discussions with my advisor at The Firm lead to the definition of the project.
The assessment really had two different possible ways of being performed. One
being a very high-level with the role mapping on European executives level. The
COBIT roles, CEO, CIO, and CFO would correspond to the level of The Firms
European CEO, CIO, and CFO and so on. As The Firms IT organization keeps a
silo like structure, each silo functions as a small organization with between 2001000 employees within IT. A proper high-level assessment would require
interviews with respondents within each silo and from those with responsibilities
spanning the entire organization. My advisor at The Firm and I agreed that this
project was too large within the given timeframe so we turned to the second
alternative, to focus on one division within The Firm. Discussions throughout the
organization resulted in a desire to assess The Markets division. It seemed to
present a reasonably sized IT organization, 33 employees globally, where this
relatively small, and short project could find interesting results and still deal with
complex systems and structures, much like the other silos.
31
Information from a global IT policy conference at The Firm the 24th of April, 2007
40
5.4
CASE STUDY AT THE FIRM
This project was performed at the companys European headquarter in London

between the 15th of January 2007 and the 27th of April 2007. The method I used in
this study is described in chapter 4, Analytical framework. As previously
mentioned, the case study was based on interviews with selected personnel at The
Firm. Every interview was conducted in the same way and the questions were
posed in a standardized manner, but to different subject areas. The areas were
represented by the COBIT processes. In most cases the interviewee was the most
responsible within that area. For instance I interviewed the European Head of
Operational Risk when talking about the Assess and manage IT risk process, the
CFO of The Markets division regarding the Manage the IT investment process
and the CIO of The Markets division regarding the Manage Operations process.
In this example the Assess and manage IT risk process was managed by a central
group and the maturity on that process would be the same for a different silo since
that work is done across the board. In some cases one individual answered
questions on several processes, which meant that we had to be clear that the role
had been change since the last interview and that this new process required a
different focus. On average, one process took around 30 minutes to go through,
which was good since I could often get a one hour meeting and do two interviews,
when it was necessary.
As COBIT has a way of describing processes that was not familiar to all
respondents, explanations were often required. The problem occurred most
frequently when discussing the maturity on the activities. COBIT describes detailed
control objectives to each process that often corresponds to the activities. The
framework does not provide a consistent approach to this. Some of the activities
cannot be explained by a corresponding detailed control objective. Below is an
example of when an activity can be further explained by a detailed control
objective associated to the same process. It is taken from process PO5 - Manage
the IT investment.
Activity:
Establish and maintain IT budgeting process
Detailed control objective:
IT budgeting process
41
Described by the detailed control objective as:

Establish a process to prepare and manage a budget reflecting the priorities established
by the enterprises portfolio of IT-enabled investment programmes, and including the
ongoing costs of operating and maintaining the current infrastructure. The process should
support development of an overall IT budget as well as development of budgets for
individual programmes, with specific emphasis on the IT components of those
programmes. The process should allow for ongoing review, refinement and approval of
the overall budget and the budgets for individual programmes.
Some interviewees suggested ways to improve the COBIT framework with ideas
that made sense to the work they were doing at The Firm. One suggestion was to
include a Quality Assurance role to the RACI-chart. This was motivated by the fact
that in all the work done at The Firm there is interaction from a Quality Assurance
function that makes sure that the quality policies are followed. There were also
numerous suggestions on metrics and documents that could be added to improve
the framework. One example could be to add a document called space planning
to the process Procure IT resources. That document would describe the
available space within each area of company so that there was adequate space for
the manpower and hardware.
The results of this assessment will be described in the next chapter in the way they
have been weighted in this study. Together with the group responsible for the
initiation phase of the COBIT initiative at The Firm, I decided to give more weight
to the activities and metrics. The activities received weight 4 and the metrics
weight 2, the documents and role assignment stayed at weight 1. This meaning that
the activities were four times as important as the documents to the results.
42
RESULTS
In this chapter I reveal my results of the assessment beginning with general results.
I then explain the results for the stronger and weaker areas closer.
6.1
GENERAL RESULTS WITHIN THE MARKETS DIVISION
As described in chapter 1.5 and 5.2, the assessment was done at a specific division
within The Firm, called The Markets division. There were however difficulties
keeping the assessment to only The Markets division since many of the areas or
functions are centrally governed and managed. In those cases where one of the
COBIT processes was managed at a central level, the interview was conducted with
personnel working in that group, i.e. outside The Markets Division. Table 5 shows
where each process belongs.
Central at The Firm

PO2
PO4
PO6
PO7
PO9
AI3
AI5
DS1
DS2
DS5
DS6
DS7
DS8
DS12
ME3
ME4
Both
PO1
PO3
AI2
AI6
ME1
ME2
Local within The Markets division

PO5
PO8
PO10
AI1
AI4
AI7
DS3
DS4
DS9
DS10
DS11
DS13
TABLE 5 PROCESS LOCATION AT THE FIRM
43
As shown in the table, almost half of the processes are managed on a central level
and operate across the board. Another relevant issue to consider, when revealing
the results, is the fact that The Markets division is a mix of three silos within The
Firm. That contributes to the rather high amount of centrally managed processes
which in some cases only stretches to the boundaries of these three silos and not the
entire company.
The complete results of this assessment can be seen in detail in appendix 4, where
the maturity level, (the result) is displayed and specified by activities, metrics,
documents and role assignment for each process. Since The Firm had desires to
weight the final results, the activities have weight 4, the metrics weight 2, the
documents and role assignment weight 1. The aggregated process maturity results
after weighting can be seen in figure 10. The average maturity across all processes
was 3.3 after weighting. The activity maturity was 3.1, metrics 2.9, documents 4.0
and role assignment 3.9. Since the activities and metrics were heavier weighted, the
result sank to 3.3, from an un-weighted result of 3.5.
Average maturity, 3.3.
FIGURE 10 WEIGHTED RESULTS ON ALL COBIT PROCESSES.
Figure 11 shows the maturity on all the processes, with the top and bottom four
highlighted. Their definition according to COBIT can be seen in appendix 6.
44
FIGURE 11 TOP AND BOTTOM PROCESSES EMPHASIZED
These processes will be described further in the following sections to clarify how
big the gaps to COBIT are in these areas, which was a part of the purpose of this
project. The results and information are based on the interviews.
As seen in figure 12, the most mature processes based on the results of this case
study are Manage quality, Procure IT resources, Identify and allocate costs and
Manage the physical environment.
FIGURE 12 THE STRONGEST AREAS
45
All of them have policies and procedures which are set from central groups, which
means, they cannot just be tracked back to the work within The Markets division.
Though some of the work is being done within The Markets division, the standards
and guidelines are set outside those borders.
The manage quality process has got strong procedures and a lot of work is being
done within that area. The Firm currently has various quality approaches and
systems for different groups and tasks. Methods like Six Sigma and Lean
Production is applied to improve processes by eliminating defects and waste within
them. According to the Head of Development at The Markets IT division, all
processes involved in their software development lifecycle interact with their
quality assurance function and align to the business objectives. All of those
processes are managed through a bug tracking tool called Jira32. Jira is an Atlassian
product that also supports measuring of the processes to improve the performance.
Jira can also be used for issue tracking and escalation procedures.
The identification and allocation of costs also follows a structured approach. Costs
of services provided are identified, verified, allocated and reported to management,
business process owners and users in a standardized manner. According to the
Business Manager at The Markets IT division there is a fair bit of documentation
and measuring being done as well. This work is primarily done by a group called
IT Finance, to which each group within IT reports. IT Finance holds the systems
that support the measuring and are responsible for optimizing the process
performance.
The procurement of IT resources has a well defined overlying IT procurement plan

and specific procurement policies for almost every vendor along with strong,
reviewed contractual policies33. The vendors are carefully selected for their
excellence and their offers are reviewed to the extent that the responsible personnel
at the IT procurement team requires. According to key personnel at the IT
procurement team, the contracts could be reviewed more frequently but it would be
32
Jira - http://www.atlassian.com/software/jira/
33
Information from interview with key personnel in the IT procurement team
46
important to find a balance between constantly reviewing contracts and rely on

vendor track record.
According to responsible personnel within the security team the Management of the
physical environment (offices, datacenters and sites), is clearly defined and set on a
global basis. The procedures and policies are strong and all sites are managed
centrally. This meaning that the responsible group has taken the entire companys
sites into consideration when determining the strategy. They have developed a
framework for the standard of the security on the sites and a level where they
would like to be. In comparison to COBIT they do all the measuring and
documentation suggested, and more. There is a lot of focus on improving the
security on the sites, partly driven by terrorist attacks like 9/11 in New York City
and the bombings in the London underground.
6.2
WEAKNESSES AT THE FIRM
The processes that showed to have the least defined procedures and the biggest gap
to COBIT, were Define and manage service levels, Define a strategic IT plan,
Manage the IT investment and Manage problems. The four processes with the
lowest maturity can be seen in figure 13.
FIGURE 13 THE WEAKEST AREAS
47
The define and manage service levels process has got a structured approach when
dealing with service levels between vendors and IT, but the organization lacks an
IT service catalogue to agree service levels with the business. According to the
global head of ITIL34 this fact is recognized by involved personnel. One of the
goals for 2007 is to build an IT service catalogue and go towards a more defined
framework with Service Level Agreements (SLAs) towards the business. This is
partly done through the current ITIL initiative, which involves a big change process
to address this issue35.
The process called definition of a strategic IT plan seems to be more focused on the
tactical IT planning which allows the organization to adapt to the fast changing
industry and the policies and procedures in long term planning can more easily be
changed36. The interaction with the business and alignment to the business
objectives are not as developed as COBIT suggests. They would like the IT
sourcing and acquisition strategy to be more evolved. At the moment it is more
tactical than strategic. 34
Manage the IT investment is a process with relatively low maturity as well. The
allocation of responsibility for IT investment and financial planning is done on an
ad hoc basis and the project portfolio is inconsistently used in that area37.
Identifying, classifying, fixing and recording problems resides in a process called

Manage problems. It follows a repeatable approach but it does no reach the level of
a defined process. There is tracking and recording of problems but the root cause
analysis does not follow a standardized method.
34
Information from interview with the Global Head of ITIL at The Firm the 23rd of April, 2007.
35
Information from interview with Account Managers at The Firms IT department, the 14th of
March, 2007
36
Information from interview with key personnel at The Markets divisions IT department, the 13th
of March, 2007
37
Information from interview with the CFO at The Markets divisions IT department, the 19th of
March, 2007
48
DISCUSSION
This chapter will discuss the results of the assessment and highlight relevant and
interesting findings throughout the project.
7.1
DISCUSSING THE RESULTS
In order to understand the maturity results and whether or not they are any good,
one needs to compare it to something. That benchmarking is crucial when drawing
the actual conclusions on comparative analysis. The average results of a 3.3,
average maturity can seem quite high, but how high are they really? Where would
other companies place on the scale? As this is one of the first studies made by ICS,
I really do not have any basis for benchmarking The Firm to other companies. My
results will however together with other assessments form the basis for
comparative benchmarking in future studies made by ICS.
The results of the assessment were initially un-weighted and the average maturity
was 3.5. The group responsible for the initiation phase of the COBIT initiative at
The Firm suggested putting a higher weight on activities and metrics. They also
considered the results to be very high.38 We agreed that a weight of 4 on activities
and 2 on metrics was adequate to form results that reasonably would reflect the
performance of the IT processes at The Markets division. The activities section is
the only input to the results where the respondent is able to grade the performance
on a measurable scale. That, in my opinion, makes the chosen weighting logical.
On metrics and documents it is either on or off. During the interviews the
discussions were slightly focused on the activities, which is another reason for
38
Information from discussion with key personnel for the initiation phase of the COBIT initiative at
The Firm, April 20th, 2007.
49
them to have a more significant weight. For future reference, the weighting method
could be improved by further analysis to reach a suitable state.
It is interesting to see that the documentation reaches a relatively high maturity

level; 4.0. I believe one reason for that could be that the pressures from external
regulatory demands like SOX and Basel II, to document financial data. It could
drive the overall documentation to a more standardized level. Documentation
procedures and systems that support documentation are likely to be in place. This
affects The Firm and other banks in particular because Basel II for instance is
focused on that industry.
The final results were discussed together with my advisor from ICS and key
stakeholders in the project at The Firm. We agreed that further analysis on the
processes with the highest and lowest maturity could be of interest. This due to the
fact that the least mature processes could possibly be improved and the most
mature processes could be reviewed to see if they are more defined than necessary.
By cutting down on the effort in those areas, the company could possibly achieve
cost savings. The results on these areas are described in section 6.2. These four
stronger and weaker areas actually gave one of the most notable acknowledgements
that I have received on my results. The processes I have highlighted as the least and
most mature seemed to correspond to the views of key personnel at The Firm. One
could imply that this increases the reliability of the results since the key personnel
did not have a subjective role in the assessment. Furthermore the results still
seemed accurate after aggregating the activities, metrics, documents and role
assignment, which is another sign that the results provide a true image.
An interesting observation when comparing the different processes and their

maturity results is that the centrally managed processes in general reached a higher
maturity. There are several functions or groups within The Firm that are
responsible for only one of the COBIT processes. This could be quality, risk or IT
procurement for instance. Those groups have clearly defined policies and
procedures. One reason for this, I believe could be that since their work needs to
correspond to all areas within the IT organization, with different objectives and
50
characteristic, those groups profit from standardization. Ad hoc solutions to support

operations would be time and money consuming.
As the goal of this project was to see how mature The Markets division at The Firm
was in respect to COBIT and suggest improvement actions to the least mature
areas, I will here give my suggestions and discuss the possible benefits of using
COBIT for improvement. The least mature processes were described in more detail
in the previous chapter.
7.2
HOW TO IMPROVE THE WEAKNESSES
What is important to notice is that a low maturity does not necessarily mean that
the company is performing badly. It could be a conscious choice to leave some
areas less defined, with less documentation and measuring in order to stay nimble,
agile and responsive to change. These suggestions below are more or less the gaps
on the four least mature processes to COBIT. If The Firm would like to use COBIT
as guidance, these suggestions could be useful. As previously mentioned, a few of
these suggestions have already been acknowledged and is something The Firm is
working on improving. What should be done within the process is suggested in the
top boxes in figure 14. The lower boxes show the suggested metrics.
51
FIGURE 14 SUGGESTED IMPROVEMENTS, CONTROLS AND METRICS
In order to work with these suggestions the company will need an action plan. It is
important to know where to start and evaluate what to focus on. Since there
currently is a large global IT policy program running at The Firm, it is important
that those procedures and standards are followed. In my opinion the first steps
would be to:
1. Make sure the above results are accurate by engaging more people in
interviews within the specific areas.
2. Focus on the processes with lower maturity, evaluate whether or not the gap
to COBIT is something that could really create value add to the
organization.
3. Figure out which are the most crucial processes to improve.
4. Begin by looking at the 10-50 most important activities or detailed control
objectives.
5. Look at the context and make an action plan for implementing those
controls.
6. After establishing procedures for the most important controls to fill the
gaps, look at what metrics and documentation are necessary to support the
work of those controls.
The goal of closing these gaps are to increase the maturity on the processes,
improve the IT governance and facilitate compliance to regulatory demands.
According to COBIT that is either to facilitate the management of IT risk or
resources, increase value delivery, align IT to business objectives or increase the
performance measurement of the IT processes.39 I would consider it important to
see if the benefit would justify the cost. Would it be economically viable to close
these gaps? In order to find that out, deeper financial analysis should be done to
selected areas.
39
52
7.3
VALIDITY
The validity assures that the assessed object was originally intended to be
assessed.40 The method is verified in this part to certify that the right measures
were chosen to assess this area. The area of investigation should be assessed with
COBIT as a basis for the method and as the benchmark for comparative analysis.
By using COBIT as benchmark in this study, which goal is to find the gaps
between an organization and COBIT, the validity is assured. This implies that what
is left to validate is the method through which COBIT has been used. The maturity
model associated to each process in COBIT provides a statement for every state on
the maturity scale. That eliminates some of the subjectivity since, the state is
already defined by COBIT and is not a measure for the respondent to single
handedly estimate.
7.4
RELIABILITY
The reliability of the answers given by the respondents is not as high as one would
wish. Each respondent has been chosen for their expertise in a specific area,
namely the area defined by that specific COBIT process. It has not been taken into
account that the respondent could have a partial opinion and that the maturity
derived from that interview could be overestimated. The method used in this
assessment has however as an objective focused on making the use of COBIT more
straightforward to deliver unbiased views. As opposed to asking the respondent to
evaluate the maturity on an entire process, the focus of the interviews in this study
has been to ask about smaller parts of the process. That way the respondent is
required to answer specific questions and even, in the documents and metrics case
answer yes-or-no questions. That way the generalization part of the answer is
eliminated and a great deal of the subjectivity as well. To improve the reliability of
the results, one could interview personnel from different parts of the process. One
suggestion could be to select respondents with both user and developer insight
to the process.
40
Yin, Robert K. (1994). Case study research, Design and methods, second edition
53
CONCLUSION
This chapter describes the conclusions that can be drawn from this assessment and
answers the question posed in the purpose section.
The IT procedures and processes at The Markets division reached a 3.3 maturity
level, out of 5. In order to get an average maturity of 5 in this assessment, an
organization would need to:
Perform each activity in an optimized manner, as described in
section 3.4.1.
Use all metrics suggested by COBIT.
Use all documents suggested by COBIT.
Have the same role assignment as the one suggested by the RACIchart for each process.
Due to the lack of comparative benchmarking data, the results cannot really be
compared to another organization, but these results will form the basis for future
studies at ICS and The Royal Institute of Technology. The results also show how
the 34 processes compare to each other. Those performance relations between the
processes seemed accurate to key stakeholders at The Firm. The areas that key
personnel considered as the strongest and weakest are the same as the areas that
have been highlighted in this study.
The four areas with the most defined structure and procedures were identified as;
Manage Quality, Procure IT resources, Identify and allocate costs and Manage the
Physical environment. These areas all have policies and procedures set from groups
operating on a central level at The Firm. The weaker areas are to a greater extent
managed on a local level, within The Markets division. This indicates some of the
54
prioritizations done within the IT organization. COBIT requires a lot of measuring

and documentation. The central groups have clearly defined policies and
procedures for both measuring and documentation. Since the central groups operate
across the board, many different functions will interact with them. The local
groups procedures are not required to match other areas, which is why the
measuring and documentation to a greater extent is done on an as-needed basis, to
support their own operations.
The weaker areas are; Define and manage service levels, Define a strategic IT
plan, Manage the IT investment and Manage problems, figure 13. Suggestions on
how to improve these areas can be seen in figure 14. Implementing these
improvement actions could increase the maturity on the processes, improve the IT
governance and facilitate compliance to regulatory demands. Improvements must
however be evaluated and weighed against the cost of improvement. Finding that
balance is vital.
55
LIST OF REFERENCES
PAPERS AND BOOKS
IT governance institute (2005), Control objectives for Sarbanes-Oxley
Yin, Robert K. (1994), Case study research, Design and methods, second edition.
Holme & Solvang (1997).

Ridley G. et al (2004), COBIT and its Utilization: A framework from the literature.
Proceedings of the 37th Hawaii International Conference on System Sciences, IEEE
OECD (1999), Principles of Corporate Governance.
Weill & Ross (2004), IT Governance

Schleifer A. & Vishny (1997), A survey on corporate Governance. The Journal of
Finance, 52(2)
IT governance institute (2006), IT control objectives for Sarbane-Oxley
Office of Government Commerce: IT Infrastructure Library Service Support. The

Office of Government Commerce: IT Infrastructure Library Service Delivery. The
Guldentops, E in Van Grembergen, W (2004). Strategies for Information Technology
Governance. Idea Group Inc. Chapter 11 Governing Information Technology through
COBIT
Dietrich, Robert (2004). Sarbanes-Oxley and the Need to Audit Your IT Processes, MKS
56
STATEMENTS
Sir Adrian Cadbury (2000), in 'Global Corporate Governance Forum', World Bank
Grembergen, (2002)
IT governance institute (2003)
The Ministry of International Trade and Industry (1999)
INTERVIEWS
Information from interview with the CFO at The Markets divisions IT department, the
19th of March, 2007
Information from discussion with key personnel for the initiation phase of the COBIT
initiative at The Firm, April 20th, 2007.
Information from a global IT policy conference at The Firm the 24th of April, 2007
Information from interview with key personnel in the IT procurement team
Information from interview with the Global Head of ITIL at The Firm the 23rd of April,
2007
Information from interview with Account Managers at The Firms IT department, the 14th
of March, 2007
57
Information from interview with key personnel at The Markets divisions IT department,
the 13th of March, 2007
INTERNET
www.Isaca.org.
Smith R. Kuhbock M.. Sarbanes Oxley 404/409-Integration Organizations and SOX.
www.integrationconsortium.org
Ernst&Young (2005), Global Information Security Survey http://www.ey.com/global/download.nsf/Sweden/GFISS_2005/$file/Global%20Informatio
n%20Security%20Survey%202005.pdf
Office of Government Commerce, OGC. http://www.itil.co.uk/

COSO-The Committee of Sponsoring Organizations of the Treadway commission,
www.coso.org
Damianides, Marios (2005), SarbanesOxley and IT governance: New guidance on it
control and compliance http://www.infosectoday.com/SOX/Damianides.pdf
Software Engineering Institute (SEI) http://www.sei.cmu.edu/cmmi/general/general.html

Troux Technology, Metis http://www.troux.com
Jira - http://www.atlassian.com/software/jira/
58
APPENDIX 1 SECTIONS OF SARBANES OXLEY

TITLE IPUBLIC COMPANY ACCOUNTING OVERSIGHT BOARD
Sec. 101. Establishment; administrative provisions.
Sec. 102. Registration with the Board.
Sec. 103. Auditing, quality control, and independence standards and rules.
Sec. 104. Inspections of registered public accounting firms.
Sec. 105. Investigations and disciplinary proceedings.
Sec. 106. Foreign public accounting firms.
Sec. 107. Commission oversight of the Board.
Sec. 108. Accounting standards.
Sec. 109. Funding.
TITLE IIAUDITOR INDEPENDENCE
Sec. 201. Services outside the scope of practice of auditors.
Sec. 202. Preapproval requirements.
Sec. 203. Audit partner rotation.
Sec. 204. Auditor reports to audit committees.
Sec. 205. Conforming amendments.
Sec. 206. Conflicts of interest.
Sec. 207. Study of mandatory rotation of registered public accounting firms.
Sec. 208. Commission authority.
Sec. 209. Considerations by appropriate State regulatory authorities.
TITLE IIICORPORATE RESPONSIBILITY
Sec. 301. Public company audit committees.
Sec. 302. Corporate responsibility for financial reports.
Sec. 303. Improper influence on conduct of audits.
Sec. 304. Forfeiture of certain bonuses and profits.
Sec. 305. Officer and director bars and penalties.
Sec. 306. Insider trades during pension fund blackout periods.
Sec. 307. Rules of professional responsibility for attorneys.
Sec. 308. Fair funds for investors.
TITLE IVENHANCED FINANCIAL DISCLOSURES
Sec. 401. Disclosures in periodic reports.
Sec. 402. Enhanced conflict of interest provisions.
Sec. 403. Disclosures of transactions involving management and principal stockholders.
Sec. 404. Management assessment of internal controls.
Sec. 405. Exemption.
Sec. 406. Code of ethics for senior financial officers.
Sec. 407. Disclosure of audit committee financial expert.
Sec. 408. Enhanced review of periodic disclosures by issuers.
Sec. 409. Real time issuer disclosures.
TITLE VANALYST CONFLICTS OF INTEREST
Sec. 501. Treatment of securities analysts by registered securities associations and
national securities exchanges.
TITLE VICOMMISSION RESOURCES AND AUTHORITY
Sec. 601. Authorization of appropriations.
Sec. 602. Appearance and practice before the Commission.
Sec. 603. Federal court authority to impose penny stock bars.
Sec. 604. Qualifications of associated persons of brokers and dealers.
59
TITLE VIISTUDIES AND REPORTS

Sec. 701. GAO study and report regarding consolidation of public accounting firms.
Sec. 702. Commission study and report regarding credit rating agencies.
Sec. 703. Study and report on violators and violations
Sec. 704. Study of enforcement actions.
Sec. 705. Study of investment banks.
TITLE VIIICORPORATE AND CRIMINAL FRAUD ACCOUNTABILITY
Sec. 801. Short title.
Sec. 802. Criminal penalties for altering documents.
Sec. 803. Debts nondischargeable if incurred in violation of securities fraud laws.
Sec. 804. Statute of limitations for securities fraud.
Sec. 805. Review of Federal Sentencing Guidelines for obstruction of justice and extensive
criminal fraud.
Sec. 806. Protection for employees of publicly traded companies who provide evidence
of fraud.
Sec. 807. Criminal penalties for defrauding shareholders of publicly traded companies.
TITLE IXWHITE-COLLAR CRIME PENALTY ENHANCEMENTS
Sec. 902. Attempts and conspiracies to commit criminal fraud offenses.
Sec. 903. Criminal penalties for mail and wire fraud.
Sec. 904. Criminal penalties for violations of the Employee Retirement Income Security
Act of 1974.
Sec. 905. Amendment to sentencing guidelines relating to certain white-collar offenses.
Sec. 906. Corporate responsibility for financial reports.
TITLE XCORPORATE TAX RETURNS
Sec. 1001. Sense of the Senate regarding the signing of corporate tax returns by
chief executive officers.
TITLE XICORPORATE FRAUD AND ACCOUNTABILITY
Sec. 1102. Tampering with a record or otherwise impeding an official proceeding.
Sec. 1103. Temporary freeze authority for the Securities and Exchange Commission.
Sec. 1104. Amendment to the Federal Sentencing Guidelines.
Sec. 1105. Authority of the Commission to prohibit persons from serving as officers
or directors.
Sec. 1106. Increased criminal penalties under Securities Exchange Act of 1934.
Sec. 1107. Retaliation against informants.
60
APPENDIX 2 IT COMPLIANCE ROADMAP
61
APPENDIX 3 MODEL OF THE FIRM
62
APPENDIX 4 ALL RESULTS
63
APPENDIX 5 ROLE ASSIGNMENT
Step 1.
Divide the role in the COBIT RACI-chart in to groups as follows.
Executives
The executives may not work directly with IT concerns, nor have a solid
understanding for its possibilities or limitations. They are however deeply involved
in the management of the entire enterprise and decides upon the overarching IT
strategy and the total IT budget to be distributed upon corporate IT functions and
projects.
COBIT roles: The board, Chief Executive Officer, Chief Financial Officer
Business
This role represents the need for IT systems and IT support functions in order to
conduct business effectively. If the enterprise is divided into several business
units, this role is then responsible for defining requirements for IT and financing
the IT needed.
COBIT roles: Business process owner, Business executive, Business senior
management
IT management
Given the requirements for IT to support business, the IT management role
formulates ITs own long-term goals, roadmaps and strategies. IT management
runs the portfolio of IT projects and assures that IT operations are executed
correctly. IT management is the link between IT and business and is typically
represented by CIO and a set of dedicated advisors or experts.
COBIT roles: Chief Information Officer, Chief Architect, Head Development,
Program Management Office
IT operations
64
IT operations represent the personnel that isnt just company overhead, but
actually operate and develop IT support systems. Several kinds of technical,
administrative, and support personnel reside in this group.
COBIT roles: Head operations, Deployment team, Head IT Administration,
Training
department,
Service
manager,
Service
desk/Incident
manager,
Configuration manager, Problem manager
Compliance, Audit, Risk and Security

This function keeps track of company IT systems and processes, mitigates
information security threats, conducts risk assessments and audits, and ensures
legislative compliance.
COBIT role: Compliance, Audit, Risk and Security
Step 2.
Choose the most frequently occurring assigned responsibility
in each group. If there is a doubt which one to choose, use this
as help. The goal is to find the average responsibility.
If for instance one group has different functions with
one R and the other A, select both as assigned.
If one group has got a few Cs and a few Is and a few
BLANKs choose the lower responsibility: I, sort of the
average.
If there are no or very few responsibilities, dont add
that as a role assignment.
Compare the role assignment of the organization to the responsibilities of the
groups. Calculate how large portion of the assigned responsibilities corresponds to
the groups responsibilities derived from the COBIT RACI-chart. Use table 4 in
chapter 4, Analytical framework to get the maturity contribution.
65
APPENDIX 6 STRONGEST AND WEAKEST

PROCESSES AS DEFINED BY COBIT
66

It Governance According To Cobit

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

It Governance According To Cobit

Uploaded by

Copyright:

Available Formats

IT GOVERNANCE

Keywords: IT Governance, IT Management, COBIT, ITIL, Align IT to business,

THESIS DISPOSITION AND READING ADVICES ......................................................................... 7

CASE STUDY .......................................................................................................................... 9

THEORETICAL STUDY .......................................................................................................... 10

CORPORATE GOVERNANCE .................................................................................................. 12

IT GOVERNANCE FRAMEWORKS .......................................................................................... 20

COBIT FACILITATES COMPLIANCE WITH SARBANES-OXLEY .............................................. 31

DATA COLLECTION .............................................................................................................. 33

EMPIRICAL STUDY ........................................................................................................... 39

THE FIRM ............................................................................................................................ 39

PROJECT DEFINITION ........................................................................................................... 40

CASE STUDY AT THE FIRM................................................................................................... 41

GENERAL RESULTS WITHIN THE MARKETS DIVISION ............................................................. 43

WEAKNESSES AT THE FIRM ................................................................................................. 47

DISCUSSING THE RESULTS ................................................................................................... 49

HOW TO IMPROVE THE WEAKNESSES ................................................................................... 51

FIGURE 10 WEIGHTED RESULTS ON ALL COBIT PROCESSES...................................................................... 44

IT governance institute (2005), Control objectives for Sarbanes-Oxley

The Markets division wanted to know how it compared to industry

This chapter gives the reader an introduction to the subject of matter. I

histories, and the analysis of archival information (as in

comparative analysis in respect to COBIT, the framework of choice in this project.

Information Technology (IT) and its business goals4

The analysis shows the competitive advantages of COBIT compared to its

The Organization for Economic Cooperation and Developments 1999 published

board, management, shareholders and additional key stakeholders.6 IT governance

Figure 1 Framework linking corporate governance to IT governance8

OECD (1999), Principles of Corporate Governance.

Van Grembergen, De Raes o Guldentops (2004), Structures, Processes and Relational

Van Grembergen, De Raes o Guldentops (2004), Structures, Processes and Relational

Mechanisms for IT Governance, Idea Group inc.

Corporate Governance Questions:

Table 1 Corporate and IT governance questions10

REGULATORY REQUIREMENTS ON CORPORATE GOVERNANCE

THE SARBANES-OXLEY ACT OF 2002

All companies, including subsidiaries, American or not, listed on American stock

Title I Public Company Accounting Oversight Board

The two sections that should concern IT executives the

Section 302 is characterized mainly by the CEOs and CFOs responsibility of

state the responsibility of management for establishing and

maintaining an adequate internal control structure and procedures for

REAL TIME ISSUER DISCLOSURES.Each issuer reporting

COSOs framework is the most frequently used when implementing compliance

These are the words of well renowned, IT governance theorist, Grembergen in

organisations strategies and objectives.18

The organisational capacity to control the formulation and

IT Governance Institute (2005), IT Control objectives for Sarbanes-Oxley

IT governance institute (2006), IT control objectives for Sarbane-Oxley

IT governance institute (2003)

for the purpose of achieving competitive advantages for the

The theory of IT governance as mentioned before is partly driven by the external

FIGURE 2 POSITIONING OF IT GOVERNANCE AND IT MANAGEMENT. SOURCE: PETERSON, SEE

The Ministry of International Trade and Industry (1999)

The IT Infrastructure Library, ITIL, was created by the British Office of

Office of Government Commerce, OGC. http://www.itil.co.uk/

Office of Government Commerce: IT Infrastructure Library Service Support. The

COSO or the Committee of Sponsoring Organizations of the Treadway

COSO-The Committee of Sponsoring Organizations of the Treadway commission, www.coso.org

CMMI, (Capabilities Maturity Model Integration), previously CMM developed by

Software Engineering Institute (SEI) http://www.sei.cmu.edu/cmmi/general/general.html

FIGURE 3 COBIT, OVERLYING FRAMEWORK PRINCIPLES.

Committee of Sponsoring Organisations of the Treadway Commission (COSO):