AN ISACA COBIT SERIES WHITE PAPER

COBIT 5

PRINCIPLES:
WHERE DID THEY COME FROM?

Governance and management of enterprise information and

related technology (GEIT) is ultimately the board of directors
(or other governing entitys) responsibility. The board sets the
direction for management to achieve the enterprise objectives
and is accountable to the enterprise stakeholders. COBIT 5 is
an internationally accepted business GEIT framework from
ISACA that was developed by, and for, practitioners and
includes insights from IT and general management literature.
This white paper helps practitioners to better understand the
COBIT 5 principles and, therefore, be more efficient and
effective in the application of the COBIT 5 GEIT framework to
their enterprises. This paper clearly explains how the principles
of COBIT 5 are built on sound, accepted IT and general
governance and management guidance and practices.

COBIT 5 Principles: Where Did They Come From?

3701 Algonquin Road, Suite 1010

Rolling Meadows, IL 60008 USA
Phone: +1.847.253.1545
Fax: +1.847.253.1443
Email: info@isaca.org

ISACA
With more than 115,000 constituents in 180 countries, ISACA (www.isaca.org) helps business
and IT leaders build trust in, and value from, information and information systems. Established in
1969, ISACA is the trusted source of knowledge, standards, networking, and career development

Web site: www.isaca.org

for information systems audit, assurance, security, risk, privacy and governance professionals.

Provide feedback:
www.isaca.org/COBIT5-Principles

professionals, and COBIT, a business framework that helps enterprises govern and manage

ISACA offers the Cybersecurity Nexus, a comprehensive set of resources for cybersecurity
their information and technology. ISACA also advances and validates business-critical skills

Participate in the ISACA

Knowledge Center:
www.isaca.org/knowledge-center

and knowledge through the globally respected Certified Information Systems Auditor (CISA),

Follow ISACA on Twitter:

https://twitter.com/ISACANews

association has more than 200 chapters worldwide.

Join ISACA on LinkedIn:

ISACA (Official),
http://linkd.in/ISACAOfficial
Like ISACA on Facebook:
www.facebook.com/ISACAHQ

Certified Information Security Manager (CISM ), Certified in the Governance of Enterprise IT

(CGEIT) and Certified in Risk and Information Systems Control (CRISC) credentials. The

DISCLAIMER
ISACA has designed and created COBIT 5 Principles: Where Did They Come From? white paper (the Work) primarily as
an educational resource for assurance, governance, risk and security professionals. ISACA makes no claim that use of any of
the Work will assure a successful outcome. The Work should not be considered inclusive of all proper information, procedures
and tests or exclusive of other information, procedures and tests that are reasonably directed to obtaining the same results. In
determining the propriety of any specific information, procedure or test, assurance, governance, risk and security professionals
should apply their own professional judgment to the specific circumstances presented by the particular systems or information
technology environment.

2014 ISACA. All rights reserved. For usage guidelines, see www.isaca.org/COBITuse.

COBIT 5 Principles: Where Did They Come From?

ACKNOWLEDGMENTS
Development Team

Steven De Haes Ph.D.

University of AntwerpAntwerp
Management School, Belgium

Roger Debreceny Ph.D.

CGEIT, FCPA,
University of Hawaii at Manoa, USA

Wim Van Grembergen Ph.D.

University of AntwerpAntwerp
Management School, Belgium

Expert Reviewers
Steven A. Babb

Ramses Gallego

CISM, CGEIT, CCSK, CISSP, SCPM,

Six Sigma Black Belt, Dell,
Spain, Vice President

Theresa Grafenstine

CISA, CGEIT, CRISC, CGAP, CGMA, CIA, CPA,

US House of Representatives,
USA, Vice President

Vittal R. Raj

CISA, CISM, CGEIT, CRISC, CFE, CIA, CISSP, FCA,

Kumar & Raj,
India, Vice President

Tony Hayes

CGEIT, CRISC, ITIL,

Vodafone, UK

CGEIT, AFCHSE, CHE, FACS, FCPA, FIIA,

Queensland Government,
Australia, Past International President

Sushil Chatterji

Gregory T. Grocholski

CGEIT,
Edutech Enterprises, Singapore

Joanne De Vito De Palma

CISM, BCMM Assessor

Konica Minolta Business Solutions,
All Covered Financial Services Division, USA

Jimmy Heschl

CISA, The Dow Chemical Co.,

USA, Past International President

Debbie A. Lew

CISA, CRISC, Ernst & Young LLP,

USA, Director

Frank K.M. Yam

CISA, CISM, CGEIT, ITIL Expert,

bwin.party digital entertainment plc, Austria

CISA, CIA, FHKCS, FHKIoD,

Focus Strategic Group Inc.,
Hong Kong, Director

Andre Pitkowski

Alexander Zapata Lenis

CGEIT, CRISC,
APIT Informatica, Brazil

Paras Kesharichand Shah

CISA, CGEIT, CRISC, CA,
Vital Interacts, Australia

ISACA Board of Directors

Robert E Stroud

CGEIT, CRISC, CA,

USA, International President

Steven A. Babb

CGEIT, CRISC, ITIL,

Vodafone, UK, Vice President

Garry J. Barnes

CISA, CISM, CGEIT, CRISC,

BAE Systems Detica,
Australia, Vice President

Robert A. Clyde

CISM, Adaptive Computing,

USA, Vice President

CISA, CGEIT, CRISC, ITIL, PMP,

Grupo Cynthus S.A. de C.V.,
Mexico, Director

Knowledge Board

Sushil Chatterji

CGEIT,
Edutech Enterprises, Singapore

Phil J. Lageschulte
CGEIT, CPA,
KPMG LLP, USA

Anthony P. Noble
CISA,
Viacom, USA

Jamie Pasfield

CGEIT, ITIL V3, MSP, PRINCE2,

Pfizer, UK

Ivan Sanchez Lopez

CISA, CISM, ISO 27001 LA, CISSP,

DHL Global Forwarding & Freight, Germany

Framework Committee
Sushil Chatterji

CGEIT,
Edutech Enterprises, Singapore, Chairman

David Cau

GRCP, ITIL V3, MSP,

Deloitte, Luxembourg

Joanne De Vito De Palma

CISM, BCMM Assessor,

Konica Minolta Business Solutions,
All Covered Financial Services Division, USA

Jimmy Heschl

CISA, CISM, CGEIT, ITIL Expert,

bwin.party digital entertainment plc, Austria

Katherine McIntosh

Steven A. Babb

CISA, CIA,
Central Hudson Gas & Electric Corp., USA

Rosemary M. Amato

CGEIT, CRISC, APIT,

Informatica, Brazil

Neil Patrick Barlow

CISA, CGEIT, CRISC, CA,

Vital Interacts, Australia

Charlie Blanchard

CGEIT, PMP,
Uruguay

CGEIT, CRISC, ITIL,

Vodafone, UK, Chairman
CISA, CMA, CPA,
Deloitte Touche Tohmatsu Ltd., The Netherlands
CISA, CISM, CRISC, CISSP,
IntercontinentalExchange, Inc. NYSE, UK
CISA, CISM, CRISC, CIPP/US,
CIPP/E, CISSP, FBCS, ACA,
Amgen Inc., USA

Andre Pitkowski

Paras Kesharichand Shah

Sylvia Tosar

Tichaona Zororo

CISA, CISM, CGEIT, CRISC, CIA, CRMA,

EGIT | Enterprise Governance of IT (PTY) LTD., South Africa

Steven A. Babb

CGEIT, CRISC, ITIL,

Vodafone, UK (2013-2014)

Frank J. Cindrich

CGEIT, CIPP, CIPP/G,

Deloitte & Touche LLP, USA (2013-1014)

2014 ISACA. All rights reserved.

COBIT 5 Principles: Where Did They Come From?

INTRODUCTION
COBIT 5 is an internationally accepted governance and
management of enterprise information and related technology
(GEIT) framework from ISACA that was developed by, and
for, practitioners and includes insights from IT and general
management literature. This white paper helps practitioners
to better understand the COBIT 5 principles (figure 1) and,
therefore, be more efficient and effective in the application of
the COBIT 5 GEIT framework to their enterprises. This paper
clearly explains how the principles of COBIT 5 are built on
sound, accepted IT and general governance and management
guidance and practices.

Figure 1The Five COBIT 5 Principles

Source: COBIT 5 (the framework), ISACA, USA, 2012, figure 2

2014 ISACA. All rights reserved.

COBIT 5 Principles: Where Did They Come From?

PRINCIPLE 1

MEETING STAKEHOLDER NEEDS

The first principle addresses the need to align individual and
departmental objectives and priorities with enterprise and
stakeholder needs. The main purpose of GEIT is to achieve
strategic alignment of information and related technology
with the goals of the enterprise. However, a continuing
challenge for enterprises is how to achieve and maintain this
alignment as stakeholder needs and enterprise goals change.
To assist enterprises with establishing and maintaining
strategic alignment, ISACA undertook research to provide
guidance for understanding how enterprise goals drive ITrelated goals and vice versa. From this research, developers
recorded generic enterprise goals and IT-related goals and
represented their interrelationships in the COBIT 5 goals
cascade (figure 2).

Figure 2COBIT 5 Goals Cascade

This cascade constitutes the top-down entry point to

COBIT 5 for enterprises that are considering the alignment
of their information and related technology assets and
resources. The goals cascade indicates that the first step
that enterprises should take to analyze their business/IT
strategic alignment is to define and link enterprise goals and
IT-related goals in support of stakeholder needs.
To facilitate a comprehensive approach to governing and
managing the alignment of IT performance with enterprise
goals, ISACA built on the balanced scorecard (BSC)
concepts.1,2,3 The BSC is an approach to strategic planning
and management that is accepted by many enterprises. The
COBIT 5 enterprise goals and IT-related goals are grouped
into the following BSC business perspectives:

Financial
Customer
Internal
Learning and Growth

COBIT 5 provides detailed mappings of enterprise goals to

IT-related goals and detailed mappings of IT-related goals to
IT-related processes, in addition to general outcome metrics
to measure each of those goals and to build a scorecard for
IT-related activities.

Source: COBIT 5 (the framework), ISACA, USA, 2012, figure 4

Kaplan, R.; D. Norton; The Balanced ScorecardMeasures That Drive Performance, Harvard Business Review, USA, 1992
Van Grembergen, W.; R. Saul; S. De Haes; Linking the IT Balanced Scorecard to the Business Objectives at a Major Canadian Financial Group, Journal for Information Technology Cases and
Applications, USA, 2003
3
Balanced Scorecard Institute, a Strategy Management Group company, USA, 1998-2014, https://balancedscorecard.org
1
2

2014 ISACA. All rights reserved.

COBIT 5 Principles: Where Did They Come From?

PRINCIPLE 2

COVERING THE ENTERPRISE END-TO-END

The governance system for enterprise IT (GEIT) proposed by
COBIT 5 integrates seamlessly in any enterprise governance
system. COBIT 5 aligns with the latest views on enterprise
governance.
COBIT 5 covers all functions and processes within the
enterprise, not only the IT function, as was sometimes
perceived to be the case with earlier COBIT versions. COBIT
5 considers information and related technologies to be assets
and resources and treats them the same as other assets
within the enterprisean approach termed IT savvy by
Weill and Ross.4 Business managers are required to take on
the accountability for governing and managing the IT-related
assets within their own organizational units and functionsin
the same way that they take on the accountability for other
assets such as physical plant, financial and human resource
assets. Business managers must take ownership of, and be
accountable for, governing the use of IT while creating value
from IT-enabled business investmentsbusiness managers
must become more IT savvy.5 COBIT provides a common,
nontechnical business language framework of guidance
for business managers to use when engaging with their IT
professional colleagues and advisors to make IT-related
business decisionssupporting IT savviness.

This principle implies a crucial shift in the minds of business

and IT management; it comprises a move from managing IT
as a cost to managing IT as an asset. This shift is an essential
element of business value creation. If senior managers do not
accept accountability for IT, the company will inevitably throw its
IT money to multiple tactical initiatives with no clear impact on
the organizational capabilities. IT becomes a liability instead of a
strategic asset.6
COBIT 5 covers both IT and IT-related business accountabilities
and responsibilities. Specifically, charts that show who is
responsible, accountable, consulted and informed (RACI) for
both business and IT function roles are provided in the COBIT 5:
Enabling Processes guide (figure 3). RACI charts indicate that, for
every COBIT 5 process, both business and IT function roles have
accountabilities and responsibilities.

The second principle recognizes that the need for business

managers to assume accountability for effectively governing
and managing their use of IT is increasingly critical to
enable the enterprise to achieve the goal of satisfying
stakeholder needs. Decisions on IT asset and resource
use (e.g., outsourced service selection and acquisition via
cloud solution providers and bring your own device [BYOD])
are being made increasingly by business managers. These
decisions must be made within the overall GEIT arrangements
of the enterprise, to create optimum value for stakeholders.

Weill, P.; J. Ross; IT Savvy: What Top Executives Must Know to Go From Pain to Gain, Harvard Business Press, USA, 2009
Ibid.
6
Ibid.
4
5

2014 ISACA. All rights reserved.

COBIT 5 Principles: Where Did They Come From?

PRINCIPLE 2
COVERING THE ENTERPRISE END-TO-END (CONT.)
Figure 3COBIT 5 RACI Chart Example
Business roles

IT Function roles

APO01.05
Optimise the placement of the
IT function.

APO01.06
Define information (data) and
system ownership.

APO01.07
Manage continual improvement
of processes.
APO01.08
Maintain compliance with
policies and procedures.

Chief Information Security Officer

Privacy Officer

Enterprise Risk Committee

Architecture Board

Chief Risk Officer

Business Continuity Manager

Information Security Manager

APO01.04
Communicate management
objectives and direction.

Service Manager

Head IT Administration

Head IT Operations

Head Development

Head Architect

Chief Information Officer

Audit

Compliance

APO01.03
Maintain the enablers of the
management system.

Head Human Resources

APO01.02
Establish roles and
responsibilities.

Value Management Office

Project Management Office

Steering (Programmes/Projects) Committee

Business Executives

Strategy Executive Committee

Chief Operating Officer

Business Process Owners

Chief Financial Officer

APO01.01
Define the organisational
structure.

Chief Executive Officer

Key Management Practice

Board

APO01 RACI Chart

Source: COBIT 5: Enabling Processes, ISACA, USA, 2012, page 52

2014 ISACA. All rights reserved.

COBIT 5 Principles: Where Did They Come From?

PRINCIPLE 3
APPLYING A SINGLE INTEGRATED FRAMEWORK
The third principle highlights the need to use an overall single,
integrated GEIT framework to deliver the optimum value from the
IT assets and resources used.
COBIT 5 aligns with other relevant standards and frameworks at
a high level and, thus, can serve as the overarching framework for
GEIT (figure 4). ISACA made a major investment over the years to
align COBIT with other standards and frameworks, including:

ISO/IEC 38500:20087
ISO/IEC 27001:20138
ISO/IEC 200009
ISO 31000 series10
ISO 9001:200811
Committee of Sponsoring Organizations of
the Treadway Commission (COSO) Internal
ControlIntegrated Framework12
IT Infrastructure Library (ITIL V3)13
Project Management Body of Knowledge (PMBOK)14
Data Management Body of Knowledge (DMBOK)15
The Open Group Architecture Framework (TOGAF 9)16
Projects in Controlled Environments (PRINCE2)17

Many of the processes in COBIT 5 are inspired by the guidance

in these standards and frameworks, which are used by IT
professionals worldwide. As such, many of the processes and
practices in COBIT 5 relate to, and align with, one or more
detailed standards or frameworks that are used by enterprises
to govern and manage their IT assets and resources. To
help enterprises to work effectively with COBIT 5 and other
standards and frameworks, COBIT 5: Enabling Processes and
the COBIT 5 professional guides contain high-level mappings
of COBIT 5 processes to the major related standards and
frameworks.
COBIT 5 also integrates and harmonizes the Risk IT and Val IT
framework guidance, which ISACA published previously, into
a single framework, making COBIT 5 a one-stop shop for
overall GEIT guidance. COBIT 5 includes in its scope previous
guidance from ISACA and guidance from other standards and
frameworks in the field.
Further, COBIT 5 provides a single overarching framework that
serves as a consistent and integrated source of guidance in
a nontechnical, technology-agnostic common language. This
source can be effectively used as the basis for more detailed
guidance on addressing specific GEIT aspects including
information security/cybersecurity, risk, assurance, vendor
management, configuration management, cloud controls, etc.,
in an effective way.

ISO, ISO/IEC 38500:2008 Corporate governance of information technology, Switzerland, 2008, www.iso.org
ISO, ISO/IEC:27001:2013 Information technologySecurity techniquesInformation security management systems Requirements, Switzerland, 2013, www.iso.org
ISO, ISO/IEC 20000-1:2011 Information technologyService managementPart 1: Service management system requirements, Switzerland, 2011, www.iso.org
10
ISO, ISO 31000:2009 Risk management Principles and guidelines, Switzerland, 2009, www.iso.org
11
ISO, ISO 9001:2008 Quality management systemsRequirements, Switzerland, 2008, www.iso.org
12
Committee of Sponsoring Organizations of the Treadway Commission (COSO), Internal ControlIntegrated Framework (2013), USA, 2013, www.coso.org/IC.htm
13
ITIL Home, Welcome to the Official ITIL Website, UK, www.itil-officialsite.com
14
Project Management Institute, A Guide to the Project Management Body of Knowledge (PMBOK), USA, 2008
15
Data Management Association International (DAMA), The DAMA Guide to the Data Management Body of Knowledge (DMBOK), USA, 2009
16
The Open Group, TOGAF 9, UK, 2009, www.opengroup.org/togaf
17
PRINCE2Projects In Controlled Environments Home, Welcome to the Official PRINCE2 Website, UK, www.prince-officialsite.com
7
8
9

2014 ISACA. All rights reserved.

COBIT 5 Principles: Where Did They Come From?

PRINCIPLE 3

APPLYING A SINGLE INTEGRATED FRAMEWORK (CONT.)

Figure 4COBIT 5 Coverage of Other Standards and Frameworks

Source: COBIT 5 (the framework), ISACA, USA, 2012, figure 25

2014 ISACA. All rights reserved.

COBIT 5 Principles: Where Did They Come From?

PRINCIPLE 4

ENABLING A HOLISTIC APPROACH

The fourth principle emphasizes that efficient and effective
implementation of GEIT requires a holistic approach that
takes into account several interacting components or
mechanismstermed enablers in COBITbecause they
interact to support governance and management of enterprise
activities and are interdependent.

Figure 5COBIT 5 Enablers

The challenge of implementing a holistic approach is related

to the need for an organizational system, which is described
in strategic management literature as the way a firm gets its
people to work together to carry out the business.18 Such
organizational systems require the definition and application,
in a holistic manner, of structures (e.g., organizational
units and functions) and processes (to ensure that tasks
are coordinated and integrated), and attention to people
and relational aspects (e.g., culture, values, joint beliefs).
Enterprises are applying this organizational system theory to
GEIT implementation by using a holistic mixture of structures,
processes and other components or mechanisms.19,20
COBIT 5 builds on these systemic insights with the concept of
enablers. Enablers are defined as factors that individually and
collectively influence whether something will workin this
case, governance and management over enterprise IT. The
COBIT 5 framework describes seven categories of enablers
(figure 5)of which Processes; Organisational Structures;
and Culture, Ethics and Behaviour are most closely related to
the organizational systems concept. COBIT 5 complements
these organizational systems enablers with other important
enablers: Principles, Policies and Frameworks; Information;
Services, Infrastructure and Applications; and People, Skills
and Competencies.

18
19
20

10

Source: COBIT 5 (the framework), ISACA, USA, 2012, figure 12

De Wit, B.; R. Meyer; Strategy Synthesis: Revolving Strategy Paradoxes to Create Competitive Advantage, Cengage Learning EMEA, USA, 2005
Peterson, R.; Crafting Information Technology Governance, Information Systems Management, USA, 2004
De Haes, S.; W. Van Grembergen; An Exploratory Study Into IT Governance Implementations and Its Impact on Business/IT Alignment, Information Systems Management, USA, 2009
2014 ISACA. All rights reserved.

COBIT 5 Principles: Where Did They Come From?

PRINCIPLE 5
SEPARATING GOVERNANCE FROM MANAGEMENT
Finally, COBIT 5 makes a distinction between governance
and management. This distinction aligns with the following
guidance in ISO/IEC 38500:2008:

Directors should govern IT through three main tasks:

a) Evaluate the current and future use of IT.

b) Direct preparation and implementation of

plans and policies to ensure that use of IT meets
business objectives.

c) Monitor conformance to policies, and performance

against the plans.21

In COBIT 5, ISACA states for the first time that GEIT processes
encompass different types of activities. The governance
processes are organized following the evaluate, direct and monitor
(EDM) model, as proposed by ISO/IEC 38500. IT governance
processes ensure that enterprise goals are achieved by evaluating
stakeholder needs; setting direction through prioritization and
decision making; and monitoring performance, compliance and
progress against plans. Based on the results, guidance and output
from these governance activities, business and IT management
plans, builds, runs and monitors activities (PBRM) to ensure
alignment with the direction that was set by the governance body
and, thus, achieve the enterprise objectives (figure 6).

Figure 6COBIT 5 Governance and Management Key Areas

Business Needs

Governance
Evaluate

Direct

Management Feedback

Monitor

Management
Plan
(APO)

Build
(BAI)

RUN
(DSS)

MONITOR
(MEA)

Source: COBIT 5 (the framework), ISACA, USA, 2012, figure 30

21

11

ISO, ISO/IEC 38500:2008 Corporate governance of information technology, Switzerland, 2008, www.iso.org
2014 ISACA. All rights reserved.

COBIT 5 Principles: Where Did They Come From?

CONCLUSION
GEIT is the boards accountability and responsibility, and the
execution of the set direction is managements accountability and
responsibility.22 COBIT 5 is primarily a business GEIT framework
made by, and for, practitioners and includes insights from IT and
general management literature, including concepts and models
such as strategic alignment, balanced scorecard, IT savviness
and organizational systems.
The core elements of COBIT 5 are built on these IT and general
management insights. Practitioners can use the insights in this
white paper and its references to apply COBIT 5 principles and
guidance in their enterprises.

22

12

Van Grembergen, W.; S. De Haes; Enterprise Governance of IT: Achieving Strategic Alignment and Value, Springer, USA, 2009
2014 ISACA. All rights reserved.