Cobit 4.1

4.1

Framework Control Objectives Management Guidelines Maturity Models

COBIT 4.1
The IT Governance Institute® The IT Governance Institute (ITGITM) (www.itgi.org) was established in 1998 to advance international thinking and standards in directing and controlling an enterprise’s information technology. Effective IT governance helps ensure that IT supports business goals, optimises businessinvestment in IT, and appropriately manages IT-related risks and opportunities. ITGI offers original research, electronic resources and case studies to assist enterprise leaders and boards of directors in their IT governance responsibilities. Disclaimer ITGI (the “Owner”) has designed and created this publication, titled COBIT® 4.1 (the “Work”), primarily as an educational resource for chiefinformation officers (CIOs), senior management, IT management and control professionals. The Owner makes no claim that use of any of the Work will assure a successful outcome. The Work should not be considered inclusive of any proper information, procedures and tests or exclusive of other information, procedures and tests that are reasonably directed to obtaining the same results. In determining thepropriety of any specific information, procedure or test, CIOs, senior management, IT management and control professionals should apply their own professional judgement to the specific circumstances presented by the particular systems or IT environment. Disclosure Copyright © 2007 by the IT Governance Institute. All rights reserved. No part of this publication may be used, copied, reproduced,modified, distributed, displayed, stored in a retrieval system, or transmitted in any form by any means (electronic, mechanical, photocopying, recording or otherwise), without the prior written authorisation of ITGI. Reproduction of selections of this publication, for internal and non-commercial or academic use only, is permitted and must include full attribution of the material’s source. No otherright or permission is granted with respect to this work. IT Governance Institute 3701 Algonquin Road, Suite 1010 Rolling Meadows, IL 60008 USA Phone: +1.847.590.7491 Fax: +1.847.253.1443 E-mail: info@itgi.org Web site: www.itgi.org

ISBN 1-933284-72-2 COBIT® 4.1 Printed in the United States of America

© 2007 IT Governance Institute. All rights reserved. www.itgi.org

COBIT 4.1ACKNOWLEDGEMENTS
IT Governance Institute wishes to recognise:
Expert Developers and Reviewers Mark Adler, CISA, CISM, CIA, CISSP, Allstate Ins. Co., USA Peter Andrews, CISA, CITP, MCMI, PJA Consulting, UK Georges Ataya, CISA, CISM, CISSP, MSCS, PBA, Solvay Business School, Belgium Gary Austin, CISA, CIA, CISSP, CGFM, KPMG LLP, USA Gary S. Baker, CA, Deloitte & Touche, Canada David H. Barnett, CISM, CISSP,Applera Corp., USA Christine Bellino, CPA, CITP, Jefferson Wells, USA John W. Beveridge, CISA, CISM, CFE, CGFM, CQA, Massachusetts Office of the State Auditor, USA Alan Boardman, CISA, CISM, CA, CISSP, Fox IT, UK David Bonewell, CISA, CISSP-ISSEP, Accomac Consulting LLC, USA Dirk Bruyndonckx, CISA, CISM, KPMG Advisory, Belgium Don Canilglia, CISA, CISM, USA Luis A. Capua, CISM, Sindicatura General dela Nación, Argentina Boyd Carter, PMP, Elegantsolutions.ca, Canada Dan Casciano, CISA, Ernst & Young LLP, USA Sean V. Casey, CISA, CPA, USA Sushil Chatterji, Edutech, Singapore Ed Chavennes, Ernst & Young LLP, USA Christina Cheng, CISA, CISSP, SSCP, Deloitte & Touche LLP, USA Dharmesh Choksey, CISA, CPA, CISSP, PMP, KPMG LLP, USA Jeffrey D. Custer, CISA, CPA, CIA, Ernst & Young LLP, USA BeverlyG. Davis, CISA, Federal Home Loan Bank of San Francisco, USA Peter De Bruyne, CISA, Banksys, Belgium Steven De Haes, University of Antwerp Management School, Belgium Peter De Koninck, CISA, CFSA, CIA, SWIFT SC, Belgium Philip De Picker, CISA, MCA, National Bank of Belgium, Belgium Kimberly de Vries, CISA, PMP, Zurich Financial Services, USA Roger S. Debreceny, Ph.D., FCPA, University of Hawaii,...