CHAPTER 3: COBIT – FROM IT AUDIT TO GEIT

‘History is the version of past events that people have decided to agree upon.’

Napoleon Bonaparte
(1769-1821)

This brief chapter looks at the history of COBIT.

Accurate reporting on the early history of COBIT comes from Erik Guldentops, now Executive Professor at the University of Antwerp Management School (UAMS), who is recognised as the ‘grandfather of COBIT’. Guldentops told us⁵⁷ that it was in Paris in 1991 at a meeting of ISACA’s European Regional Council that he was invited to conduct research to devise a European IT audit initiative since IT audit knowledge at that time came only from the US. At that time, Guldentops was Chief Inspector at SWIFT, the international funds transfer body, where he went on to be Director Information Security. His article also lists the names of the group of 34 people led by himself who developed the first version of COBIT that was issued in 1996. He also points out that it was the Electronic Data Processing Auditors Association (EDPAA’s) Control Objectives that drove his research (probably, in my view, explaining why COBIT was originally called Control OBjectives for Information and related Technology). Today, COBIT is just a word, no longer an acronym, since COBIT 5 is a business framework for the governance and management of enterprise IT.

Figure 3.1: COBIT®: Audit to GEIT in 16 years

Figure 3.1 shows COBIT was initially developed as an IT audit framework and in today’s view of history⁵⁸ is seen as moving over 16 years from IT audit (COBIT 1) to IT control (COBIT 2) to IT management (COBIT 3) to IT governance (COBIT 4.0/4.1) to governance of enterprise IT (GEIT) (COBIT 5). Table 3.1 is a comparison of the versions of COBIT since 1996. Additional benefits could be obtained if COBIT 4.0 or COBIT 4.1 were enhanced by the implementation of other ISACA frameworks: Val IT™ 2.0, which had processes to aid delivery of value from IT, and Risk IT™, which had processes to aid risk management.

Table 3.1: Comparisons of Versions of COBIT® Since 1996

_______________

⁵⁷ www.isaca.org/Journal/Past-Issues/2011/Volume-4/Documents/jpdf11v4-Where-Have-All.pdf

⁵⁸ www.isaca.org/Knowledge-Center/cobit/Pages/Development.aspx