COBIT5 Foundation

A process activity identifies work that must be carried out, so it must support the establishment of distinct roles and responsibilities for that work. This connects execution to accountability by clarifying who participates and what responsibility attaches to the activity, rather than merely describing a broad benefit or general alignment.

The information flow and items component identifies the information artifacts used or produced by governance and management practices. By linking those artifacts to the relevant practices, it shows how information supports and moves between activities. Policies and procedures prescribe direction or methods, while organizational structures identify decision-making entities and assigned roles.

A governance framework should align with related and relevant I&T standards, frameworks and regulations so that its concepts can operate coherently with the wider environment. Alignment preserves compatibility without requiring COBIT to reproduce all external content or function as an isolated, comprehensive substitute for every other body of guidance.

Enterprise governance of information and technology is part of the enterprise's overall direction and oversight, so it belongs within corporate governance. I&T decisions affect value, risk and resources across the organization. Risk and financial governance address important dimensions, but neither encompasses the full governance relationship described.

A good policy should achieve its purpose, be implemented efficiently, and avoid unnecessary intrusion into normal work. Those qualities govern whether the policy is effective and proportionate. Being limited in number is not an inherent quality requirement: the necessary policy set depends on the enterprise's obligations, objectives, and operating context.

Evaluate, Direct and Monitor is the governance domain. It evaluates stakeholder needs and strategic options, directs management through prioritized choices, and monitors resulting performance and conformance. Assessing options and guiding senior management therefore reflects EDM's governance purpose. Operational service delivery and organizational planning belong to management domains instead.

Managed business process controls concern controls embedded in the operation and support of business processes. That work belongs within Deliver, Service and Support, the management domain concerned with operational delivery and ongoing support. In COBIT, the related managed objective is DSS06, which places business process controls directly in the DSS domain.

Defining a target state requires a clear description of the intended future condition and the results the change should produce. Communicating the outcome makes that destination understood by the affected participants and supports alignment around it. Forming a team and identifying role players prepare the change effort, while operating new approaches occurs after the target has been established.

When IT is strategic to business success, IT-related roles must participate strongly in the enterprise's organizational structures. That involvement embeds I&T knowledge in direction, coordination and decision making instead of treating technology as a support-only concern. Security capability and documentation address narrower needs and cannot alone provide enterprise-wide strategic participation.

A flexible and open governance framework can incorporate new issues, but additions must not damage the coherence of the existing model. Maintaining integrity and consistency ensures that new content fits established concepts and relationships. Industry standards and internal policies may inform an issue, but preserving the framework's structure is the primary consideration.