COBIT

What is COBIT?

COBIT is a framework published by ISACA for the governance and management of enterprise information and technology, defining objectives, processes and practices to align technology with business goals and control risk.

Updated November 2026 · 5 min read

COBIT gives organizations a structured way to govern and manage their technology. It is used by organizations of every size and sector, from banks and hospitals to government agencies. It describes what good governance and management look like, through a set of objectives covering areas such as strategy, risk, security, change, operations and performance. Each objective comes with practices, activities and measures that organizations can use to design their own processes and assess how well they are working.

The framework was first published by ISACA, a professional association for IT governance, audit and security, in 1996, originally as Control Objectives for Information and Related Technologies. It has since broadened from an audit tool into a full governance framework, with COBIT 2019 the current major version. For enterprise architecture and IT finance, COBIT provides a recognized reference for how technology decisions should be governed, which is particularly valuable in regulated industries and for organizations that need to demonstrate control to auditors.

Definition of COBIT

COBIT is a framework for the governance and management of enterprise information and technology. It is used to design governance systems, assess process capability and provide a common language between business leaders, IT and auditors.

It supports IT governance by clearly separating governance, which evaluates, directs and monitors, from management, which plans, builds, runs and monitors.

Structure of COBIT 2019

COBIT 2019 defines 40 governance and management objectives, grouped into five domains.

The governance domain, Evaluate, Direct and Monitor, covers how boards and executives set direction and oversee technology. It includes objectives for ensuring benefits delivery, risk optimization and resource optimization.

Four management domains cover Align, Plan and Organize; Build, Acquire and Implement; Deliver, Service and Support; and Monitor, Evaluate and Assess. Objectives within these domains address topics such as managing the portfolio, managing architecture, managing changes, managing security and managing performance.

Each objective is supported by components such as processes, organizational structures, information flows, skills and culture. This reflects the view that good governance depends on people and behavior as well as documented processes.

Design Factors and Capability Levels

COBIT 2019 introduced design factors, such as enterprise strategy, risk profile, regulatory requirements and sourcing model, that help organizations tailor the framework to their circumstances. A growth-focused company and a heavily regulated one will emphasize different objectives.

It also uses capability levels to assess how well processes are performing, from basic and incomplete to optimized.

These features help organizations focus on the objectives most relevant to them, rather than applying all 40 equally. In practice, most organizations prioritize a subset.

Importance of COBIT in Enterprise Architecture

COBIT provides a recognized reference for governance. Boards, auditors and regulators often accept it as evidence that technology is governed according to good practice. Many internal and external auditors use it as the basis for technology audits.

It covers enterprise architecture directly, through an objective focused on managing architecture, and connects architecture to related areas such as portfolio management, risk and change. This helps architects explain their role in terms that boards and auditors recognize, and links architecture decisions to the IT portfolio management process.

It also gives a common vocabulary for discussions between business, IT, risk and audit functions. Shared terms reduce misunderstandings when findings are discussed and improvement plans are agreed.

COBIT and Value for Money

Several COBIT objectives address the financial side of technology, including managing budgets and costs, managing the portfolio and managing benefits.

These objectives encourage practices such as cost transparency, business cases and benefits tracking, which link closely to IT financial management.

Organizations that use COBIT alongside cost frameworks such as technology business management can show auditors both how decisions are governed and what they cost.

Assessments based on COBIT can also highlight weak processes, such as poor vendor management, that lead to avoidable costs.

COBIT and Other Frameworks

COBIT is often used alongside other frameworks. ITIL provides detailed guidance on IT service management, while COBIT sets the governance context around it. COBIT explains what needs to be governed and why, while other frameworks often explain how to carry out the work.

TOGAF provides the method for developing architectures, while COBIT covers how architecture management fits into overall governance.

Security standards and risk frameworks provide detailed controls that COBIT's security and risk objectives reference. Mapping these frameworks to COBIT objectives helps avoid duplicated controls and audits.

How to Use COBIT

Using COBIT involves tailoring it to the organization, assessing current capability, prioritizing improvements and integrating it into governance processes.

The framework is most useful as a reference and diagnostic tool, not as a rulebook to be applied in full.

Tailoring and Assessing

Use the design factors to identify which governance and management objectives matter most, given the organization's strategy, risks and regulatory environment. Involving business and risk leaders in this step ensures the priorities reflect more than IT's view.

Assess current capability for the priority objectives, using COBIT's capability levels and evidence from existing processes. Evidence matters more than opinion, so assessments should review documents, records and outcomes.

Identify gaps between current and target capability, and estimate the effort and benefit of closing each one. Not every gap needs closing, since the target level should match the organization's needs.

Improving and Embedding

Plan improvements in stages, focusing first on objectives with the greatest risk or value. Trying to improve every objective at once spreads effort thinly and rarely succeeds.

Assign owners for each objective and integrate improvements into existing structures, such as investment committees, risk forums and architecture reviews. Building on existing structures avoids creating a separate governance layer that duplicates work.

Reassess capability periodically and report progress to leadership and audit committees. Regular reporting keeps attention on governance after the initial improvement program ends.

Examples of COBIT in Enterprise Architecture

The examples below show COBIT used to improve governance.

Both use illustrative figures. The first responds to audit findings, and the second strengthens portfolio governance.

In each, the framework helped focus effort on the most important gaps.

Responding to Audit Findings

A regional bank receives 14 audit findings related to technology governance, including weak change management and unclear architecture decision rights.

It uses COBIT to assess the relevant objectives and finds that change management and architecture management are at the lowest capability levels.

A focused improvement program addresses these first, and the next audit closes 12 of the 14 findings.

Strengthening Portfolio Governance

A healthcare network uses COBIT's portfolio and benefits objectives to review how technology investments are approved and tracked.

The assessment shows that benefits are rarely measured after projects close. The network introduces benefits reviews six and twelve months after go-live. Project sponsors are accountable for reporting results.

Within two years, it has data on actual returns for 30 projects and uses it to improve future business cases.

Conclusion

COBIT is ISACA's framework for the governance and management of enterprise information and technology. COBIT 2019 defines 40 objectives in five domains, with design factors and capability levels to tailor and assess them.

In enterprise architecture, COBIT provides a recognized governance reference, covers architecture management and connects it with portfolio, risk and financial objectives. Tailoring the framework, assessing priority objectives, closing the most important gaps first, integrating improvements into existing governance and reassessing regularly help organizations use COBIT effectively.

IT Governance

IT governance is the system of structures, processes and decision rights that ensures an organization's technology investments and operations support its strategy, deliver value, manage risk and comply with obligations.

IT Portfolio Management

IT portfolio management is the practice of managing an organization's technology investments, including projects, applications and infrastructure, as a single portfolio balanced against strategy, value, cost and risk.

TOGAF

TOGAF, The Open Group Architecture Framework, is a widely used enterprise architecture framework that provides a method, called the ADM, along with guidance and standard deliverables for developing and managing architectures.

Enterprise Architecture Roadmap

An enterprise architecture roadmap is a sequenced plan of the work packages and transition states that move an organization from its current architecture to its target architecture over time.