Frameworks and standards

COBIT: a framework for governing and managing information and technology

COBIT helps boards and leaders make sure technology supports the organisation’s goals, manages risk sensibly and delivers value for money. Here is what it is, who owns it and how it is used.

In brief

What is COBIT?

COBIT is a framework for the governance and management of enterprise information and technology. Put simply, it helps an organisation decide who should make which decisions about IT, and how to check that IT is delivering what the business needs.

The name originally stood for Control Objectives for Information and Related Technologies. It began as a tool for IT auditors and has grown into a complete governance framework used by boards, executives, risk and audit teams, and IT leaders.

A key idea in COBIT is the difference between governance and management. Governance evaluates options, sets direction and monitors performance. Management plans, builds, runs and monitors the activities that follow that direction. Keeping the two clear avoids both micromanagement and blind spots.

COBIT 7, the latest version, launches on 19 November 2026 and replaces COBIT 2019. It brings a digital-first platform, stronger guidance on AI, new design factors and new assessment tools.

Key facts

Type: Governance and management framework
Owner: ISACA
Current version: COBIT 7, launching 19 November 2026 (replacing COBIT 2019)
Certification for people: Yes, including COBIT 7 Foundation
Certification for organisations: No, but COBIT supports assessments and audits
Official site: isaca.org

Governance and management

Governance and management: two different jobs

Governance makes sure the organisation is doing the right things. Management makes sure those things are done right.

Governance belongs to the board or governing body, supported by senior executives. It evaluates the options and stakeholder needs, directs by setting priorities, policies and risk appetite, and monitors whether the organisation is on track. It sets direction and holds people to account; it does not run the day-to-day work.

Management belongs to the executive team, the CIO and IT managers. It plans, builds, runs and monitors the activities needed to deliver what governance has asked for: strategies, projects, services, controls and reports.

A simple way to think about it: governance chooses the destination and checks the journey; management plans the route and drives.

COBIT 2019, the version most organisations know, builds this into its structure. The Evaluate, Direct and Monitor (EDM) domain holds the governance objectives. Four domains hold the management objectives: Align, Plan and Organise (APO), Build, Acquire and Implement (BAI), Deliver, Service and Support (DSS), and Monitor, Evaluate and Assess (MEA).

At a glance

Governance asks: Are we doing the right things, and getting value from them?
Management asks: Are we doing things right, on time and within budget?
Governance is done by: The board, governing body and senior executives
Management is done by: The executive team, the CIO, IT managers and process owners
Governance activities: Evaluate, direct, monitor
Management activities: Plan, build, run, monitor

Using COBIT for governance

Use this when the board or leadership need confidence that IT is well directed, even if day-to-day practices come from ITIL or elsewhere.

Agree who decides what about IT, and how decisions are escalated
Link business goals to IT priorities, so investment can be justified
Set the risk appetite for technology and information, and how risk is reported
Decide how resources are prioritised and how benefits are tracked
Give the board a small set of measures to monitor IT performance and conformance

Using COBIT for management

Use this when IT leaders want a complete, structured view of how IT is planned, delivered and controlled.

Use the management objectives as a checklist to find gaps in how IT works
Assess the capability of priority areas, such as change, security or suppliers, and plan improvements
Define clear roles and responsibilities for each area
Design controls and evidence that stand up to audit
Map existing ITIL, ISO/IEC 20000 and ISO/IEC 27001 practices to COBIT to show coverage and avoid duplication

You do not have to do both at once. Some organisations start with a governance review for the board; others use the management objectives for an audit-readiness check and add governance later. Used together, they connect board-level decisions to the work that delivers them.

Core ideas

The key ideas in COBIT

Governance and managementSeparates setting direction and oversight (governance) from planning and running the work (management).

Stakeholder valueIT exists to meet stakeholder needs: realising benefits, optimising risk and optimising resources.

A governance systemEffective governance relies on several components working together: processes, organisational structures, information, people and skills, policies, culture, and technology.

Tailored, not one size fits allDesign factors, such as strategy, risk profile, size and sourcing model, help shape a governance system that fits the organisation.

Objectives and goalsClear governance and management objectives link business goals to IT activity, so priorities can be traced and justified.

Measuring capabilityCapability and performance can be assessed, giving a baseline and a way to show progress over time.

Ownership and history

Who owns COBIT, and where did it come from?

COBIT is owned and published by ISACA, a global professional association for IT governance, audit, risk and security, best known for certifications such as CISA, CISM, CRISC and CGEIT.

ISACA first released COBIT in 1996 as a set of control objectives for IT auditors. Later versions broadened it into a full governance framework, including COBIT 5 (2012) and COBIT 2019, which was released in late 2018. COBIT 7, launching in November 2026, is the latest step in that evolution.

Certifications

COBIT certifications for individuals

COBIT certificates are awarded by ISACA and taken as online, remotely proctored exams. Organisations are not certified against COBIT, although it is often used as the basis for governance reviews and audits.

CurrentCOBIT 7 FoundationThe entry-level certificate for COBIT 7, available from 19 November 2026. The exam has 75 multiple-choice questions over two hours, a 65% pass mark, and no prerequisites.

RetiringCOBIT 2019 FoundationStill valid for people who hold it. The exam can be bought until 30 June 2027 and must be taken by 31 December 2027, with no extensions.

RelatedCGEIT and other ISACA credentialsFor experienced professionals, ISACA’s Certified in the Governance of Enterprise IT (CGEIT) builds on COBIT concepts, alongside CISA for audit and CRISC for risk.

ISACA plans a COBIT 7 Design & Implementation certificate in 2027. Dates have changed before, so please check ISACA’s website for the latest options before booking.

Benefits

Why organisations adopt COBIT

IT aligned with business goalsClear links between business objectives and IT priorities make it easier to decide what to fund and what to stop.

Clear accountabilityEveryone knows who decides, who is consulted and who is responsible, from the board to delivery teams.

Risk managed in proportionTechnology and information risks are identified and managed at the right level, without excessive controls.

Stronger audit and complianceCOBIT is widely recognised by auditors and regulators, which simplifies evidence gathering and reporting.

One umbrella for many frameworksCOBIT provides the overall structure into which ITIL, ISO standards, security and project methods can fit.

Measurable improvementCapability assessments give a clear baseline and a credible way to show the board that governance is improving.

Who it is for

Who should use COBIT?

COBIT suits any organisation where technology is important to success and where leaders need confidence that it is well directed and controlled. That is most organisations today.

It is particularly valuable in regulated sectors such as financial services, healthcare and the public sector, in organisations facing audit findings, and where IT spending or risk needs to be explained clearly to a board.

COBIT does not need to be heavy. Smaller organisations can focus on a few priority objectives and keep governance light. Our article on using COBIT without adding bureaucracy explains how.

Roles that benefit most

Board members and non-executive directors
CIOs, CTOs and heads of IT
Risk, compliance and internal audit teams
IT governance and portfolio managers
External and IT auditors
Consultants advising on IT strategy

How it fits

How COBIT works with other frameworks

COBIT is an umbrella framework. It sets out what needs to be governed and managed, and points to more detailed frameworks and standards for how to do it.

ITIL provides detailed practice guidance for the service management objectives in COBIT.
ISO/IEC 27001 provides the security management system behind COBIT’s security objectives.
ISO/IEC 20000 provides certifiable service management requirements.
PRINCE2 and Agile methods support COBIT’s objectives for managing programmes and projects.

How Northera helps

Practical IT governance reviews

We use COBIT to review how IT decisions, controls and performance are governed, and set out clear, prioritised improvements that link IT governance to business goals. Our aim is better decisions, not more paperwork. Find out more on our services page.

Need clearer IT governance?

Book a free scoping call to talk through your governance challenges and where COBIT could help.

Book a free scoping call