In brief:
- COBIT is the IT governance framework published by ISACA, distinct from operational management frameworks such as ITIL.
- Governance and management form two separate functions, carried out by different bodies within the enterprise.
- COBIT 2019 organizes its objectives around one governance domain, four management domains and six principles.
- A successful rollout starts from stakeholder needs and the enterprise’s own design factors, not a mechanical copy of the framework.
COBIT is the IT governance framework published by ISACA (Information Systems Audit and Control Association). It is aimed at IT departments, risk managers and auditors who need to show how technology decisions serve enterprise strategy. COBIT does not replace operational frameworks such as ITIL: it sits at a different level, that of steering and control.
What is COBIT?
COBIT, short for Control Objectives for Information and Related Technologies, has been published by ISACA since 1996 and regularly updated, with COBIT 2019 as the current version. The framework provides a governance structure to align information systems with overall strategy, create value, manage risk and ensure regulatory compliance.
It is not a set of processes to copy as is. COBIT describes governance and management objectives, not procedures: each enterprise adapts them to its size, sector and maturity level. This explains its popularity in large groups and the public sector, which are often subject to strict audit requirements.
Governance or Management: the Two Pillars of COBIT 2019
The framework draws a clear line between two functions that many organizations confuse. Governance evaluates stakeholder needs, sets direction through priorities and decisions, then monitors performance and compliance. It is the responsibility of the board or an executive committee.
Management plans, builds, runs and monitors activities in line with the direction set by governance, in order to meet enterprise objectives. It is the responsibility of operational management, IT leadership included. This separation is not a theoretical detail: a governance system blurs the two when the same bodies both set priorities and execute them, which dilutes accountability when something fails.
COBIT and ITIL: Two Complementary Frameworks
COBIT and ITIL answer different questions. COBIT helps leadership answer “are we making the right technology choices, and can we prove it?”. ITIL answers “how do we actually organize the delivery and support of IT services day to day?”. The former focuses on strategic steering and control, the latter on operational service management, with detailed practices for the service desk, incident management or change management, as covered in ITIL 4’s guiding principles.
The two frameworks complement each other more than they compete. An IT department can rely on COBIT to structure its governance and report to oversight bodies, while applying ITIL to organize the processes that actually deliver services. Combining both avoids a common pitfall: governance that sets objectives with no operational follow-through, or a mature ITIL organization with no strategic steering above it.
The Principles and Domains of COBIT 2019
The Governance and Management Domains
COBIT 2019 organizes its objectives into five domains, one governance domain and four management domains.
| Domain | Function | Scope |
|---|---|---|
| EDM (Evaluate, Direct, Monitor) | Governance | Evaluate options, set direction, monitor performance |
| APO (Align, Plan, Organize) | Management | Align IT strategy, plan, organize resources |
| BAI (Build, Acquire, Implement) | Management | Design, acquire and implement solutions |
| DSS (Deliver, Service, Support) | Management | Deliver and run services day to day |
| MEA (Monitor, Evaluate, Assess) | Management | Measure process compliance and performance |
Each domain groups several governance or management objectives, broken down into practices and activities that the enterprise adapts to its own context.
The Six Principles of the Governance System
COBIT 2019 rests on six principles that guide any implementation of the framework: meeting stakeholder needs, covering the enterprise end to end, relying on a single integrated framework, taking a holistic approach, clearly separating governance from management, and tailoring the system to the enterprise’s actual needs rather than a generic model.
Implementing COBIT in the Enterprise
A COBIT rollout rarely starts with a workshop dedicated to the framework itself. It begins with a clear business case: leadership agrees on what needs to improve, whether that is cybersecurity oversight, service reliability, transparency on IT investment, or audit readiness. This step avoids building a governance system that answers no identified need, a gap that Enterprise Service Management is precisely meant to close by connecting IT services to business expectations.
Next comes an assessment of the current situation, to define a small number of priorities that stakeholders recognize. The enterprise then selects the relevant governance and management objectives, breaks them down into concrete practices, and maintains the system over time despite changes in organization, technology or regulation.
Design Factors to Consider
COBIT 2019 introduced design factors, which allow the framework to be tailored rather than applied uniformly. They include enterprise strategy, risk profile, sector-specific IT issues, the threat landscape, compliance requirements, the role of IT in the business model, and the implementation methods chosen.
Who Uses COBIT and for What Purpose
COBIT is mainly used by IT departments, internal audit and risk management functions, in large enterprises and organizations facing strong regulatory obligations, including the public sector. These profiles use it to show that technology decisions are tracked, justified and controlled, a concern close to the one addressed in the comparison between ESM and ITSM.
In practice, COBIT is frequently paired with TOGAF for enterprise architecture and with ITIL for operational delivery, forming a coherent set that covers governance, architecture and service management.
Frequently Asked Questions
What is COBIT and what is it used for?
COBIT is the IT governance framework published by ISACA. It provides a structure for aligning information systems with enterprise strategy, creating value, managing risk and meeting compliance requirements. It does not describe how to run IT services day to day, but how leadership steers and controls IT.
What is the difference between COBIT and ITIL?
COBIT operates at the governance and control level: it helps leadership set objectives, measure performance and be accountable for outcomes. ITIL operates at the operational management level: it describes how to run the service desk, handle incidents or manage changes. The two frameworks are complementary and can be combined within the same organization.
What are the domains and principles of COBIT 2019?
COBIT 2019 organizes its objectives into one governance domain and four management domains. It rests on six principles, including the separation of governance from management, end to end coverage of the enterprise, and tailoring the system to each organization’s own needs.
Who uses COBIT in the enterprise?
COBIT is mainly used by IT departments, internal audit and risk management functions, and organizations facing strong regulatory requirements. It is frequently paired with TOGAF for enterprise architecture and with ITIL for operational delivery.
What changed with the 2019 version of COBIT?
COBIT 2019 introduced design factors, which let organizations tailor the framework to their actual context instead of applying it uniformly. It also updated the domains and control objectives and clarified the separation between governance and management.