INFORMATION SYSTEMS AUDIT

CAT 1

LEC LUCY NDUNG'U

BCISLMR194122

QUESTION ONE

Principle 4: Enable a Holistic Approach. This principle emphasizes the importance of taking a
comprehensive and integrated approach to IT governance. Company X can apply this principle by
ensuring that their IT governance framework is aligned with the overall business strategy and goals, and
that all stakeholders are involved in the governance process.

Principle 5: Separation of Governance and Management. This principle emphasizes the need for a clear
separation between governance and management responsibilities. Company X can apply this principle by
defining clear roles and responsibilities for their IT governance and management functions, and ensuring
that there is no overlap or conflict between these roles.

Principle 7: Enabling Information. This principle emphasizes the importance of having accurate, timely,
and relevant information to support decision-making. Company X can apply this principle by ensuring
that they have appropriate processes and systems in place to collect, analyze, and report on IT-related
data. This will enable them to make informed decisions and monitor their IT performance effectively.

QUESTION TWO

EDM (Evaluate, Direct, and Monitor) Domain: This domain provides a framework for governance and
includes processes for evaluating and monitoring the performance of the information system. Company
Y can leverage this domain by ensuring that their governance framework is aligned with the overall
business objectives and that the system is continuously monitored to ensure it is meeting its intended
purpose.

APO (Align, Plan, and Organize) Domain: This domain provides guidance on how to align IT objectives
with business goals and develop strategies to achieve them. Company Y can leverage this domain by
developing a comprehensive plan that outlines the scope, objectives, risks, and benefits of the new
information system. The plan should also include an organization structure that defines roles and
responsibilities for all stakeholders.
BAI (Build, Acquire, and Implement) Domain: This domain provides guidance on how to build and
implement the information system. Company Y can leverage this domain by ensuring that the system is
developed and implemented in accordance with recognized standards and industry best practices. This
includes developing and implementing test plans, conducting user acceptance testing, and training users
on how to use the system.

DSS (Deliver, Service, and Support) Domain: This domain provides guidance on how to deliver and
support the information system. Company Y can leverage this domain by ensuring that there are
processes in place to monitor and manage the system’s performance, including availability, capacity, and
security. This domain also includes processes for incident and problem management, change
management, and user support.

MEA (Monitor, Evaluate, and Assess) Domain: This domain provides guidance on how to monitor and
evaluate the performance of the information system. Company Y can leverage this domain by ensuring
that there are processes in place to measure and report on the system’s performance, including metrics
for availability, reliability, and user satisfaction. These metrics can be used to identify areas for
improvement and to make informed decisions about future investments in the system.

QUESTION THREE

Ad Hoc – No formal IT governance practices are in place

Repeatable but Intuitive – Some IT governance processes are in place, but are not consistently applied

Defined Process – IT governance processes are documented and consistently applied

Managed and Measurable – IT governance processes are monitored and measured for effectiveness

Optimized – Continuous improvement is achieved through ongoing monitoring and feedback

To assess its current level of IT governance maturity using COBIT 5, Company Z would need to conduct a
self-assessment or engage an external auditor. The assessment would involve evaluating the
organization’s processes and controls against the COBIT 5 framework to determine its current level of
maturity.

Once Company Z has identified its current level of IT governance maturity, the assessment process can
help the organization identify areas for improvement and prioritize their efforts. For example, if
Company Z identifies that it is currently at Level 1 (Ad Hoc), it may need to focus on implementing basic
IT governance policies and procedures to move to Level 2 (Repeatable but Intuitive). Alternatively, if
Company Z is already at Level 4 (Managed and Measurable), it may need to focus on refining its IT
governance processes to achieve Level 5 (Optimized).

Overall, the assessment process can help Company Z identify its strengths and weaknesses in IT
governance, determine where it needs to improve, and prioritize its efforts based on its current level of
maturity. This can ultimately lead to a more effective and efficient IT governance framework that
supports the organization’s goals and objectives.

QUESTION FOUR

Governance domains: The governance domains of COBIT 5 provide guidance on how to establish and
maintain an effective governance system for the organization. This includes defining the roles and
responsibilities of key stakeholders, establishing policies and procedures, and ensuring that the
organization’s objectives are aligned with the overall business strategy.

Risk management domain: The risk management domain of COBIT 5 provides guidance on how to
identify, assess, and manage risks to the organization. This includes conducting risk assessments,
defining risk management strategies, and implementing controls to mitigate risks.

Information security enablers: The information security enablers of COBIT 5 provide guidance on how to
establish and maintain an effective information security program. This includes developing security
policies and procedures, implementing security controls, and conducting security awareness training.

Incident management enabler: The incident management enabler of COBIT 5 provides guidance on how
to effectively respond to incidents, including data breaches. This includes defining incident response
procedures, establishing incident response teams, and conducting post-incident reviews to identify areas
for improvement.

Ethics enabler: The ethics enabler of COBIT 5 provides guidance on how to establish and maintain an
ethical culture within the organization. This includes defining ethical values and principles, establishing a
code of conduct, and conducting ethics training for employees
QUESTION FIVE

Identify regulatory requirements: COBIT 5 provides guidance on how to identify legal and regulatory
requirements applicable to the organization. This includes conducting compliance assessments,
identifying relevant laws and regulations, and mapping them to IT processes and controls.

Establish governance structure: COBIT 5 provides guidance on how to establish an effective governance
structure for the organization. This includes defining the roles and responsibilities of key stakeholders,
establishing policies and procedures, and ensuring that the organization’s objectives are aligned with the
overall business strategy.

Manage risks: COBIT 5 provides guidance on how to identify, assess, and manage risks to the
organization. This includes conducting risk assessments, defining risk management strategies, and
implementing controls to mitigate risks.

Ensure compliance with regulations: COBIT 5 provides guidance on how to design and implement
effective controls to ensure compliance with regulatory requirements. This includes implementing
security controls, establishing policies and procedures, and conducting audits to test the effectiveness of
controls.

Continuously monitor and improve: COBIT 5 provides guidance on how to continuously monitor and
improve the organization’s IT governance and compliance processes. This includes conducting regular
assessments, monitoring performance metrics, and identifying areas for improvement.

QUESTION SIX

The COBIT 5 enablers are a set of seven factors that contribute to the overall effectiveness of an
organization’s IT processes. These include:
Principles, policies, and frameworks: This enabler provides guidance on how to establish and maintain an
effective framework for IT security. For example, Company C can develop policies and procedures that
define security controls such as access controls, encryption, and incident response.

Processes: This enabler provides guidance on how to design and implement effective processes for IT
security. For example, Company C can establish processes for vulnerability management, patch
management, and security incident management.

Organizational structures: This enabler provides guidance on how to establish and maintain an
organizational structure that supports IT security. For example, Company C can establish a security team
responsible for developing and implementing security policies and procedures, as well as monitoring
compliance.

Culture, ethics, and behavior: This enabler provides guidance on how to establish and maintain an
ethical culture within the organization. For example, Company C can establish a security awareness
training program to educate employees about security risks and best practices.

Information: This enabler provides guidance on how to manage and secure enterprise information
effectively. For example, Company C can establish data classification policies and controls to ensure that
sensitive data is properly protected.

Services, infrastructure, and applications: This enabler provides guidance on how to design and
implement secure IT services, infrastructure, and applications. For example, Company C can implement
secure coding practices, configure firewalls, and monitor network traffic for anomalies.

People, skills, and competencies: This enabler provides guidance on how to develop and maintain the
skills and competencies of IT security personnel. For example, Company C can establish a training
program to ensure that security personnel have the necessary skills and knowledge to perform their
roles effectively.