Volume 10 | Issue 4 | 2021
h ps://doi.o g/10.18267/j.ceb .264
CENTRAL EUROPEAN BUSINESS REVIEW
63
ANALYSIS OF PROCESSES INFORMATION FLOWS AND
ITEMS AS ADDITIONAL DESIGN FACTOR IN COBIT
FRAMEWORK
———————————————————————————————————————
Rozehnal, P., No ák, V.
———————————————————————————————————————
Pe Rozehnal / VSB - Technical Uni e si y o Os a a, Facul y o Economics, Depa men o Applied
In o ma ics, Sokolská ř. 33, Os a a, 702 00, Czech Republic. Email: pe . ozehnal@ sb.cz
Ví ězsla No ák / VSB - Technical Uni e si y o Os a a, Facul y o Economics, Depa men o Applied
In o ma ics, Sokolská ř. 33, Os a a, 702 00, Czech Republic. Email: i ezsla .no ak@ sb.cz
Abs ac
COBIT is a p ocess-o ien ed IT go e nance amewo k. In he 2019 e sion, he amewo k
o e s a signi ican ly edesigned app oach o p io i ise p ocesses and se p ocess a ge
capabili y le els. The design phase is e y impo an o achie e a go e nance sys em in
u u e. Al hough he e a e se e al design ac o s de ined in he design phase o COBIT
2019, hese ac o s do no assess p ocess sui abili y and alue o he go e nance sys em.
Thus, connec ions and con inui y among p ocesses a e no aken in o conside a ion
enough. The e o e, he aim o he a icle is o sugges ano he design ac o based on he
in e ela ionships o p ocesses in he COBIT amewo k ep esen ed by i s in o ma ion
lows. The na u e o he p oposed inno a ion is desc ibed, and he analysis o p ocess
in o ma ion lows and i ems is pe o med. The a icle also publishes se e al inconsis encies
in COBIT 2019 documen a ion ha ha e been iden i ied in he p ocess o esea ch. The
applica ion o p ocess in o ma ion lows and i ems analysis has been illus a ed in wo case
s udies. We ha e iden i ied new in o ma ion ha can be ele an o decision making in he
design phase and discussed hei impo ance o he planned go e nance sys em. The
esul s could help o imp o e he quali y o he design phase by p o iding addi ional
in o ma ion abou he con ex o he p ocesses designed o ensu e he go e nance sys em.
Implica ions o Cen al Eu opean audience: The implica ions o senio manage s in he
Cen al Eu opean egion will be bene icial. Op imisa ion and e ec i e use o in o ma ion
echnologies is a p e equisi e o achie ing long- e m compe i i eness. COBIT is a bes
p ac ice amewo k, and i s implemen a ion in companies is la gely based on he speci ics
o each o ganisa ion. The e o e, i is impo an o pay close a en ion o he implemen a ion
phase o he applica ion o COBIT. F amewo k applica ion posi i ely suppo s he holis ic
app oach o managemen , esou ce op imisa ion, managemen based on esponsibili y and
measu abili y. Today, hese a ibu es o he o ganisa ion’s managemen a e emphasised
no only in Cen al Eu ope bu in de eloped coun ies in gene al.
Keywo ds: IT; go e nance; COBIT; amewo k; analysis; p ocess
JEL Classi ica ion: M15, O33, O38
Volume 10 | Issue 4 | 2021
h ps://doi.o g/10.18267/j.ceb .264
64
CENTRAL EUROPEAN BUSINESS REVIEW
In oduc ion
The ans o ma ion o en e p ises owa ds he use o digi al echnologies as well as he
massi e use o da a equi es a comp ehensi e managemen app oach based on he
holis ic p inciple. As C ows on (2003) s a es, in e dependency and coo dina ion a e
impo an opics in o ganisa ion s udies. In o ma ion echnologies (IT) a e pe asi e and
c ea e a dynamic en i onmen ull o possibili ies and challenges. I is s ill mo e impo an o
achie e IT/business alignmen in o ganisa ions (A ison e al., 2004; Chan & Reich, 2007;
Schlosse e al., 2012; Valo in a, 2011), which is a undamen al objec i e o in o ma ion
echnology go e nance/managemen . The alue deli e ing is c i ically dependen on an
abili y o c ea e a managemen sys em whe e he p ocesses a e linked and suppo each
o he . I is ob ious ha IT in luence p ocesses and ice e sa (Lu man e al., 2013; Rahimi
e al., 2016; Ta a da & Go don, 2007).
IT go e nance, as a pa o co po a e go e nance, should ensu e consis ency among
aspec s ha a e impo an o s a egic business managemen . Te minologically, IT
go e nance has unde gone many changes, bo h in e ms o managemen le els and
con en (ITGI, 2007; ISO, 2008; ISO, 2015; ISACA, 2012). En e p ise go e nance o IT
(EGIT), see (De Haes e al., 2016; ISACA, 2018c) in his a icle is used.
COBIT (ISACA, 2018c) is he wo ldwide known amewo k o EGIT. I should assis in he
p ocess o implemen a ion and ealisa ion o he EGIT sys em. COBIT is p ocess-o ien ed.
The key componen is he objec i e. The e a e 40 objec i es desc ibed in COBIT 2019 (37
p ocesses in COBIT 5). Each objec i e is e e ed o as one p ocess. The p ocess is
cha ac e ised as ollows: “a collec ion o p ac ices in luenced by he en e p ise’s policies
and p ocedu es ha akes inpu s om a numbe o sou ces (including o he p ocesses),
manipula es he inpu s and p oduces ou pu s (e.g. p oduc s, se ices).” (ISACA, 2012, p.
92). The p ocess is u he desc ibed in he p ac ices, which a e speci ied in he ac i i ies.
The p ocess and o he COBIT componen s (o ganisa ional s uc u es; p inciples, policies
and amewo ks; in o ma ion; cul u e, e hics and beha iou ; people, skills and
compe encies; se ices, in as uc u es and applica ions) in luence he go e nance sys em
and help o es ablish he anspa en en i onmen wi hin he o ganisa ion.
Big a en ion should be paid o he ques ion o how o apply he amewo k o achie e be e
esul s in he planned EGIT sys em (Abu-Musa, 2009; Anind a e al., 2018). One o he
mos impo an issues o he new COBIT 2019 amewo k is a change in design and
cus omisa ion (ISACA, 2018b). Due o EGIT complexi y (Ba ens e al., 2015), he
challenge o he design phase is how o cus omise COBIT o a gi en en e p ise.
In COBIT 5 e sion, p ocesses o he EGIT sys em we e selec ed by goals cascading wi h
suppo o mapping ables ha exp ess ela ionships p io i ies. Such a p ocedu e is a he a
guideline o p ocess p io i isa ion.
In COBIT 2019, he phase o p ocess p io i y a ing has been signi ican ly changed (ISACA,
2018b). Ele en design ac o s, oge he wi h he ecommended design p ocess on how o
ailo he go e nance sys em, a e desc ibed o imp o e p ocess p io i isa ion. A di e en
ocus a ea should be aken in o conside a ion, as well. All hese aspec s in luence he
selec ion o p ocesses wi hin he con ex o he cu en /speci ic si ua ion in he o ganisa ion
and he de e mina ion o p ocess capabili y le els.
Volume 10 | Issue 4 | 2021
h ps://doi.o g/10.18267/j.ceb .264
CENTRAL EUROPEAN BUSINESS REVIEW
65
The design phase o EGIT sys em implemen a ion suppo s p io i isa ion o managemen
objec i es (p ocesses), componen s a ia ion and es ablishes ecommended capabili y
le el. Da enpo and Sho (1990) men ioned he exhaus i e app oach based on da a o
iden i ica ion o impo an p ocesses o al e na i e one based on he gene al sense o which
p ocesses a e c ucial. Ou app oach ollows Da enpo in bo h ways. The e is no one ideal
way how o apply he COBIT amewo k and hus achie e he EGIT sys em. P ocess
p io i isa ion and decision o EGIT sys em implemen a ion a e based on he combina ion o
expe s’ expe iences, knowledge o company si ua ion, knowledge o COBIT me hodology.
Thus, i is a mix o objec i e and subjec i e in o ma ion, opinions and a i udes. Du ing he
design phase, COBIT uses pa ly mechanical calcula ion based on subjec i e/objec i e
alues and opinions, and pa ly i is ollowed by a quali a i e e alua ion (al hough subjec i e
again because i is done by expe s esponsible o EGIT sys em implemen a ion). Finally,
he e a e selec ed p ocesses so ed by ele ance ( hei use ulness) o he assessed ac o s
(i.e. cu en si ua ion and o ganisa ion goals) and o he componen s impo an o achie ing
he EGIT sys em. P ocess capabili y le el is also ecommended.
ISACA p o ides a so wa e oolki o suppo he design p ocess. As s a ed abo e, pa o
he design phase is calcula ed, based on ma ices, desc ibed in (ISACA, 2018b), in Chap e
6, and cus ome inpu s.
Despi e he publica ion o he COBIT amewo k, many ac o s ecommended du ing he
design phase su e om a lack o documen a ion. Mo eo e , i is e y di icul o measu e
hei in luence and po en ial impac on he EGIT sys em. In one sense, his may no be
su p ising because COBIT is p ac ically o ien ed. Howe e , he abili y o implemen he
EGIT sys em is c i ically impo an , so all discussion and esea ch ha can help imp o e he
quali y o he design phase a e aluable. The w ong composi ion o p ocesses in he EGIT
sys em may cause a gap in he o e all concep which should be holis ic acco ding o
ISACA. In he a icle, we sugges a new design ac o ha is based on he p ocess
cha ac e o COBIT. Ou app oach conside s p ocess con ex by p o iding p ocess
in o ma ion lows inpu /ou pu analysis as ano he design ac o o suppo p ocess
p io i isa ion.
The design phase is an impo an a ea in he EGIT sys em li e cycle. The highe he quali y
o ailo ing he go e nance sys em is, he highe he p obabili y o ob aining a high-quali y
EGIT sys em is. The impac o design ac o s is desc ibed in (ISACA, 2018b). Assuming
EGIT sys em cons uc ion ollows COBIT documen a ion, design ac o s play a c ucial ole
in he design phase. Ou concep hus suppo s one o he key p inciples o he COBIT
amewo k - he holis ic app oach.
The emainde o his a icle is o ganised as ollows: he nex chap e desc ibes bo h
phases o he me hodology concep . Chap e 2 p o ides a b ie heo e ical backg ound.
Chap e s 3 and 4 desc ibe case s udies whe e ou app oach is applied. Chap e 5
discusses gene al assessmen , limi a ions and u u e esea ch implica ions. Conclusion and
lis o e e ences inalise ou a icle.
1 Me hodology app oach
The concep o he pape is based on p ocess managemen heo y and analysis o
p ocesses ela ionships. In he con ex o he COBIT amewo k, we ex end he design
phase and cus omisa ion o go e nance solu ion published in (ISACA, 2018b).
Volume 10 | Issue 4 | 2021
h ps://doi.o g/10.18267/j.ceb .264
66
CENTRAL EUROPEAN BUSINESS REVIEW
The me hodology is quan i a i e as well as quali a i e. Quan i a i e analysis was pe o med
using a so wa e ool de eloped by he au ho s. Fo he analysis, his ool used da a
ep esen ing ela ionships be ween p ocesses desc ibed in COBIT 2019 (ISACA, 2018a).
The quan i a i e pa o he analysis in ol es p ocess in o ma ion lows and i ems analysis
(No e: COBIT 5 e sion used e m p ocess inpu s/ou pu s). The sou ce o in o ma ion is he
o iginal COBIT documen a ion (ISACA, 2018a). We analyse he ela ionships be ween
p ocesses o assess he ole and impo ance o he gi en p ocess in he con ex o selec ed
p ocesses.
The quali a i e analysis ollows he quan i a i e analysis. The eason o apply a quali a i e
app oach is ha COBIT canno be mechanically implemen ed. I is necessa y o ailo he
EGIT sys em o i o ganisa ion speci ica ions. COBIT ecommends concluding he design
o he EGIT sys em wi h he inal human e alua ion o discuss he si ua ion, esol e
con lic s and achie e conclusions.
Ou analysis consis s o h ee s ages. Fi s , he p ocess en i y is analysed. This s age
desc ibes he p ocess iew, which encapsula es issues om he nex s ages. Second, he
p ac ices analysis s age, whe e p ac ices o p ocesses a e analysed. Thi d, he in o ma ion
lows s age, whe e inpu s and ou pu s a e conside ed ( he app oach is illus a ed in Figu e
1).
The posi ion in go e nance sys em design wo k low is be ween s eps 3.7 and 4.1 (ISACA,
2018b), Figu e 4.1. I should suppo he inal e alua ion o he design phase. One
supplemen design ac o is he inpu /ou pu analysis o in o ma ion lows. I can be used as
ollows:
1) In luenced managemen objec i e p io i y (in o he wo ds, p ocesses) and a ge
capabili y le els.
2) In luenced componen a ia ion, speci ically in o ma ion lows and i ems (ISACA,
2018b), Figu e 3.1).
2 P ocess in o ma ion lows and i ems as an addi ional
design ac o
The heo e ical backg ound o ou app oach is based on he business p ocess managemen
concep . P ac ical deploymen o quan i a i e analysis is based on a so wa e ool ha is
able o analyse ela ionships be ween p ocesses.
2.1 Business p ocess managemen
Business p ocess managemen (BPM) is an app oach ha co e s concep s, me hods and
echniques o suppo he design, adminis a ion and o he ac i i ies ela ed o business
p ocesses (Weske, 2012). Jes on and Nelis (2014) s a e ha BPM is a signi ican
con ibu o o achie ing an o ganisa ion’s objec i es. The e is a eason o ealise
p ocesses, achie e alue and mee objec i es. This is done by p ocess ou comes o
p oduc s ha a e in ended o cus ome s (Da enpo & Sho , 1990). Rahimi e al. (2016)
s a e ha business p ocess links business s a egy o an o ganisa ion’s IT capabili ies. In
ac , BPM desc ibes how p ocess wo ks and echnology plays a c ucial ole by deli e ing an
in as uc u e (Molle e al., 2007). The lis o BPM de ini ions is p esen ed and discussed in
(Rosing e al., 2015).
Volume 10 | Issue 4 | 2021
h ps://doi.o g/10.18267/j.ceb .264
CENTRAL EUROPEAN BUSINESS REVIEW
67
Hamme (2002) unde s ands he p ocess as an o ganised g oup o ac i i ies ha wo k
oge he and c ea e a esul wi h alue o he cus ome . Hamme unde lines ha ac i i ies
mus wo k oge he and be aligned. The p ocess is he way how o achie e he goal. F oge
e al. (2019) poin ou he BPM challenge in he a ea o alignmen be ween human ac o s
and in o ma ion sys ems. The p ocess is he link among business s a egy, people and
echnology. Thus, i suppo s inno a ion and agili y (Ki chme , 2015).
The desc ip ion o he p ocess may be ealised in di e en le els o de ail (Řepa & S a oš,
2016). Acco ding o he le el o de ail, a p ocess may con ain subsec ions (ac i i ies,
p ac ices, s eps). The p ocess is in ela ionships wi h o he p ocesses and plays a ole
wi hin an o ganisa ion. COBIT p ocess dependencies a e shown in Figu e 1. The
go e nance o p ocesses means end- o-end managing o p ocesses (Jes on & Nelis, 2014).
BPM manages all ele an p ocesses wi hin he o ganisa ion because o a holis ic
app oach. In a p ocess chain, p ocesses a e in luenced by hei p edecesso s
(ch onologically, hey occu be o e and p oduce ou pu s) and a ec successo s
(ch onologically, hey happen a e and accep inpu s).
COBIT is a p ocess-o ien ed amewo k. Each p ocess is desc ibed in ex o m. The
amewo k does no con ain a model o p ocess low. Al hough such a desc ip ion is he
mos used (Figl & Recke , 2016), i has limi a ions o p ac ical implemen a ion. Each
p ocess desc ip ion con ains inpu and ou pu in o ma ion lows om and o o he
p ocesses. In o ma ion lows and i ems ep esen p ocess ou comes o he nex p ocesses
( hei cus ome s). Examples o such ou comes, acco ding o Da enpo and Sho (1990)
ma ke ing plan, con ac as well as p oduc o goods. While C ows on (2003) discusses
dependencies heo e ically in o ganisa ional s uc u es, COBIT de ines exac ela ionships
be ween p ocesses. Rega ding he numbe o inpu s and ou pu s (we iden i ied nea ly 500
ela ionships, see below), i is di icul o exp ess a complex p ocess model o all COBIT
p ocesses. Howe e , i is possible o use he inpu s/ou pu s analysis o ge knowledge
abou he pa ial p ocess con ex . In he a icle, we analyse p edecesso s and successo s
up o he hi d gene a ions (L1 means 1s le el, L2 means 2nd le el and L3 means 3 d
le el).
COBIT applica ion equi es inding a sui able combina ion o p ocesses and hei le el o
capabili y o c ea e an EGIT sys em. Ou app oach complemen s he implemen a ion
p ocess wi h he elemen o p ocess con inui y, one o he undamen al p inciples in BPM.
The decision-making p ocess in he design phase, whose objec i e is a se o key
p ocesses o building he EGIT sys em, is enhanced by he knowledge o he p ocess
con ex .

Volume 10 | Issue 4 | 2021
h ps://doi.o g/10.18267/j.ceb .264
68
CENTRAL EUROPEAN BUSINESS REVIEW
Figu e 1 | P ocess dependencies applied in COBIT
Sou ce: au ho s
2.2 In o ma ion lows and i ems as inpu s/ou pu s
The basis o quan i a i e analysis is a so wa e ool ha uses and e alua es he mapping o
ela ionships be ween p ocesses p esen ed in COBIT. Fo he pu pose o he a icle, a
da abase managemen sys em and a sp eadshee we e used. The eason is simplici y,
a ailabili y and mu ual compa ibili y o bo h ools ( he o icial ISACA oolki is also based on
he sp eadshee ).
I is no necessa y o esea ch p ocess dependency s uc u es, as shown in (C ows on,
2003). In COBIT, each p ocess has assigned i s di ec inpu and ou pu p ocesses.
Howe e , hese ela ionships a e a ailable only in PDF o ma . Rela ionships we e
he e o e ans o med semi-manually in o wo ables ep esen ing wo possible ela ionships
be ween wo p ocesses: (1) p ocess – p edecesso , (2) p ocess – successo . Du ing his
ans o ma ion, 479 ela ionships we e iden i ied.
Fo example, p ac ice APO07.01 has i s p edecesso APO01.05, as APO01.05 p oduces
in o ma ion low named De ini ion o supe iso y p ac ices, which is lis ed as inpu o
APO07.01.
The e o e, i is logical o conclude ha he p ocess ela ionships ables p ocess-
p edecesso and p ocess-successo men ioned abo e a e iden ical. In o ma ion s o ed in
bo h ables essen ially desc ibes he same ela ionships be ween p ocesses. Fo he
pu pose o inpu s/ou pu s analysis, he able o p ocess ela ionships was c ea ed (Figu e
2).
Figu e 2 | Example o ela ionships be ween p ocesses in he da abase managemen sys em
Sou ce: au ho s
Volume 10 | Issue 4 | 2021
h ps://doi.o g/10.18267/j.ceb .264
CENTRAL EUROPEAN BUSINESS REVIEW
69
No e: Mul iple inpu s/ou pu s as used in (ISACA, 2018a, p. 23) a e no included in hese
ables. The in luence o mul iple inpu s/ou pu s is assessed sepa a ely in he quali a i e
analysis phase.
Du ing he compa ison o p ocess-p edecesso and p ocess-successo ables, se e al
inconsis encies (de ails below) we e iden i ied. Since he au ho s o he a icle a e no
en i led o es ablish a co ec e sion o ela ionships, hese ela ionships showing
inconsis encies we e excluded om he analysis.
The aim o he quan i a i e phase (suppo ed by so wa e solu ion) was o iden i y he mos
equen ly occu ing p ocesses as p edecesso o successo s (up o 3 d le el) o he
selec ed se o p ocesses (shown in Figu e 1).
Fo his pu pose, he iews we e c ea ed ha simula e he sequence o indi idual
p ocesses h ough se e al le els wi h he help o sel -join ope a ions on a single p ocess
sequences able. A he same ime, he equencies o p ocesses o each le el a e
compu ed o indi idual p ocesses a gi en le els and he selec ed combina ion o inpu
p ocesses. Subsequen ly, ob ained equencies we e used o de e mining which p ocesses
a e he mos o en used and, he e o e, should be conside ed as impo an du ing
implemen a ion.
The in o ma ion low be ween p ac ices is also a pa o he p edecesso -successo
ela ionship. In he subsequen phases o he e alua ion, i is hus possible o iden i y be e
he impo ance o ela ionships acco ding o he ansmi ed in o ma ion.
I is necessa y o iden i y he mos in luen ial ac o s o u he analyse he esul s o
quan i a i e e alua ion. Following ac o s we e conside ed du ing he analysis:
• Inpu s a e mo e impo an han ou pu s. Inpu s a e impo an as p edecesso s o
ealise p ocesses o he EGIT sys em. Ou pu s a e impo an o successo s; in
o he wo ds, o he nex de elopmen o he EGIT sys em ou side he scope o
de ined goals.
• Th ee le els o p edecesso s and successo s a e used. The mos impo an is he
L1 le el, nex is L2, and inally L3.
• E alua ion o impo an p ocesses, p ac ices and in o ma ion lows based on hei
equencies o occu ence.
• The impo ance o selec ed p ocesses is de i ed om he numbe o p ac ices
used in EGIT sys em cons uc ion. Fo example, i he p ocess con ains ou
p ac ices, and hey a e all used in he cons uc ion o he sys em, hen he p ocess
is conside ed e y impo an . Simila ly, he low numbe o used p ac ices leads he
p ocess o be conside ed unimpo an o he cons uc ion o he sys em. The
same s ands ue o in o ma ion lows. Resul s o he p esen ed analysis,
he e o e, iden i y he impo ance o he whole p ocess o one o i s p ac ices o
in o ma ion lows. I should be no ed ha COBIT assigns each ac i i y o
ecommended capabili y le el and con ains in o ma ion abou i s in o ma ion lows.
Usually, he de e mina ion o capabili y le els is one o he ou pu s o he design
phase. The e o e, ou app oach allows o a mo e de ailed analysis and e alua ion
o he design phase.
Volume 10 | Issue 4 | 2021
h ps://doi.o g/10.18267/j.ceb .264
70
CENTRAL EUROPEAN BUSINESS REVIEW
2.3 P ocess inpu s/ou pu s inconsis encies in COBIT 2019
amewo k
A e he da a ans o ma ion phase, bo h inpu s and ou pu s we e used, and ela ionships
we e compa ed. The ollowing inconsis encies in inpu s/ou pu s among p ocess p ac ices
we e ound in (ISACA, 2018a) in he ollowing in o ma ion lows:
• Da a classi ica ion guidelines, APO14.01 e sus APO01.06 and APO01.07.
• Da a in eg i y p ocedu es, APO14.04 e sus APO01.06 and APO01.07.
• Da a secu i y and con ol guidelines, APO14.08 e sus APO01.07.
• Cus ome equi emen s o quali y managemen , BAI11.05 and BAI11.06 e sus
APO11.02.
• Roo causes o p oblems, DSS03.05 e sus DSS03.04.
• Plan o igh -size I&T landscape including missing I&T capabili ies, se ices and
applica ions, APO02.02 and APO02.03 e sus APO01.10.
• Inciden esolu ions, DSS03.05 e sus DSS02.05.
• Roo causes o p oblems, DSS03.05 and DSS03.02.
3 Case s udy 1
This case s udy is desc ibed by ISACA (ISACA, 2018b), see p. 67. Acco ding o esul s in
his documen , chap e 7.2.4., we ha e used p ocesses ha seem o be likely impo an o
he EGIT sys em o analysis (wi hou co ec ion a e quali a i e e alua ion, see no e a he
end o he case s udy 1). The e a e only p ocesses wi h he g ea es p io i y a ing ( ela i e
impo ance 75 and mo e on a scale om -100 o +100) in inpu /ou pu analysis.
• DSS02 Managed se ice eques s and inciden s (75),
• APO13 Managed secu i y (80),
• DSS04 Managed con inui y (80),
• DSS03 Managed p oblems (75),
• BAI09 Managed asse s (75),
• BAI10 Managed con igu a ion (75).
Case s udy 1 Quan i a i e pa o he e alua ion
The quan i a i e pa o he e alua ion is shown in Figu es 3, 4, 5. No e: in he esul s
below, p ocesses selec ed wi hin he ini ial design phase a e included in he ables and a e
highligh ed wi h g ey colou .
Figu e 3 shows he numbe o p ac ices occu ences o p ocess in o al (see columns
named as Coun ) as inpu s o ou pu s di ided by le els in which hey occu . Values on
p edecesso side hen ep esen he numbe o p ocesses se ing as inpu s o analysed
p ocesses. Values on successo side hen ep esen he numbe o p ocesses se ing as
ou pu s o analysed p ocesses.
E.g. on he L1 le el, he mos equen inpu p ac ices a e p ac ices o p ocess APO12
occu ing eigh imes and APO09 occu ing i e imes. On L2 le el, he mos equen inpu
p ocesses a e APO14 occu ing eigh imes, APO12 occu ing 71 imes. On L3 le el, he
mos equen inpu p ocesses a e APO12 occu ing 20 imes, hen APO14 occu ing en
imes e c. On he L1 le el, he mos equen ou pu p ocesses a e APO08 occu ing i e
imes, hen BAI06 occu ing ou imes. On he L2 le el, he mos equen p ocesses a e
Volume 10 | Issue 4 | 2021
h ps://doi.o g/10.18267/j.ceb .264
CENTRAL EUROPEAN BUSINESS REVIEW
71
APO08 occu ing 12 imes and MEA04 occu ing 11 imes. On he L3 le el he mos
equen p ocesses a e APO02 occu ing 28 imes, APO05 occu ing 18 imes and so on.
Figu e 3 | The numbe o occu ences o p ocesses on each le el as p edecesso s and
successo s ( i s 20 ows only)
Sou ce: au ho s
Figu e 4 illus a es p ac ice elemen s analysis whe e he s uc u e o in o ma ion is he
same as in Table 1 bu wi h a ocus on p ac ices a he han p ocesses. I can be seen ha
he mos equen inpu p ac ice on he L1 le el is APO12.06, occu ing se en imes, hen
APO09.03 occu ing i e imes. On L2 le el, he mos equen p ac ice is APO12.06 and
EDM03.03 occu ing se en imes, hen APO11.02 occu ing six imes. L3 le el: he mos
equen inpu p ac ice is EDM03.03, APO12.04 and APO12.02 occu ing se en imes, hen
APO12.06 occu ing six imes.
Simila ly, he mos equen ou pu p ac ice on he L1 le el is BAI06.01, occu ing ou
imes, hen BAI03.11, MEA04.07, APO09.04 and APO08.03 all occu ing h ee imes. On
L2 le el, he mos equen p ac ices a e APO12.01 occu ing se en imes, MEA01.03 and
APO02.02, bo h occu ing six imes. L3 le el: he mos equen p ac ice is APO02.02,
occu ing 14 imes, and so on.
Volume 10 | Issue 4 | 2021
h ps://doi.o g/10.18267/j.ceb .264
78
CENTRAL EUROPEAN BUSINESS REVIEW
P ocess EDM04 Ensu ed Resou ce Op imiza ion has e alua ed 30 poin s om he o iginal
design phase analysis, so i is among less ecommended p ocesses. Ne e heless, i s
p ac ices EDM04.03 Moni o esou ce managemen , EDM04.01 E alua e esou ce
managemen , EDM04.02 Di ec esou ce managemen could be ele an o
implemen a ion because hey a e o en used as inpu s on all le els (L1-L3). P ac ices deal
wi h esou ce managemen issues om alloca ion p inciples, s a egies o moni o ing
ac i i ies (an example o in o ma ion lows: Guiding p inciples o alloca ing esou ces and
capabili ies; App o ed esou ces plan and o he s)— ecommended a ge capabili y le el 3.
P ocess BAI02 Managed Requi emen s De ini ion ob ained om he ini ial go e nance
sys em design phase 55 poin s wi h a ge capabili y le el 3. Based on he esul s o he
inpu /ou pu analysis, we can con i m he esul and ecommend a he g ea e impo ance
o wo easons. Fi s , in o ma ion lows om he BAI02 p ocess a e o en used as inpu s
and ou pu s on all le els (L1 – L3), and h ee p ac ices om ou a e used. Second,
p ac ices BAI02.01 and BAI02.02 a e he mos o en used inpu s. Mo eo e , o ealise
p ac ice BAI02.02 Pe o m a easibili y s udy and o mula e al e na i e solu ions, capabili y
le el 4 is ecommended. Acco ding o hese easons, we e alua e BAI02 as
unde es ima ed and ecommend paying g ea e a en ion o i s in ol emen in he EGIT
sys em.
P ocess APO02 Managed S a egy is wo h assessing. All p ac ices om p ocess APO02
a e ep esen ed in he analysis esul s and a e dis ibu ed e enly among p edecesso s and
successo s on all obse ed le els L1-L3. In o ma ion lows a e o ien ed o in o ma ion ha
assis s in he s a egic app oach o IT building and ope a ion ( o example, De ined scope o
a chi ec u e; A chi ec u e concep business case and alue p oposi ion and o he s). Gi en
he ac , ha p ocess is mos ly a successo o e alua ed p ocesses. We ha e no special
ecommenda ions.
BAI01 Managed P og ams ensu es he managemen o p og ams om he in es men
po olio. Wi h espec o he esul s o inpu /ou pu analysis, i should be ecommended a
g ea e a ge capabili y le el. Used p ac ices equi e mainly capabili y le el 3, selec ed 4.
Rega ding he desc ip ion o company objec i es and design phase esul s, i can be s a ed
ha he p ocess BAI01 can success ully suppo he implemen a ion o he go e nance
sys em in he managemen con ex as well as in he in o ma ion con ex . Recommended
a ge capabili y le el is 3.
In o ma ion lows om p ocess APO05 Managed Po olio a e used p ima ily as successo s
o e alua ed p ocesses. We do no make addi ional ecommenda ions.
P ac ices o p ocess APO01 Managed I&T Managemen F amewo k a e aluable as well.
Fi e om ele en p ac ices om his p ocess a e used as inpu s. Mo eo e , p ac ices
APO01.01, .02, .03 and .11 a e lis ed as mul iple inpu /ou pu , so hei ole is e en s onge .
Wi h ega d o he used in o ma ion lows, i is app op ia e o achie e he a ge capabili y
le el 3.
P ocess APO11 is unde es ima ed as well, acco ding o he esul s o ou app oach. APO11
has mul iple ou pu s o o he p ocesses. Al hough, wi hou hem, we ha e moni o ed
in o ma ion lows om APO11. Conside ing capabili y le el, we ecommend achie ing a
leas a ge capabili y le el 2 o APO11.

Volume 10 | Issue 4 | 2021
h ps://doi.o g/10.18267/j.ceb .264
CENTRAL EUROPEAN BUSINESS REVIEW
79
Table 2 | Case s udy 2 Summa y o ecommenda ions
P ocess
Commen s
O iginal a ge
capabili y le el
P oposed a ge
capabili y le el
EDM04
Unde es ima ed
2
3
BAI01
Unde es ima ed
2
3
BAI02
Conside a en ion o selec ed p ac ices
om BAI02
3
3
APO01
Unde es ima ed
2
3
APO02
No changes o ecommenda ion
2
2
APO05
No changes o ecommenda ion
3
3
APO11
Take in o accoun o implemen a ion.
2 - 3
Sou ce: Au ho s
5 Resul s assessmen , limi a ions and u he esea ch
COBIT 2019 comes wi h a new app oach o designing he go e nance sys em o
en e p ise in o ma ion and echnology (ISACA, 2018b). E en hough COBIT 2019
de e mines he impo ance o p ocesses by assigning p io i y alues based on design
ac o s, i s ill does no conside he in e connec edness o p ocesses by in o ma ion lows.
One o he p inciples o he COBIT amewo k is he holis ic p inciple. Ou mo i a ion is o
in ol e ele an p ocesses, p ac ices and in o ma ion lows. Ha mon (2018) shows ha
mos o ganisa ions do no apply a sys ema ic app oach o p ocess managemen . In ou
implemen a ion, he selec ion o p ocesses is made acco ding o EGIT goals and he
con ex o a gi en o ganisa ion.
The app oach p esen ed in (ISACA, 2018b) combines quan i a i e and quali a i e
e alua ion. This s udy shows ano he ac o ha may be used in he e alua ion. Mo eo e ,
he ac o is calcula ed om de ined dependencies. The e o e i is no subjec i e. Al hough
we inally use subjec i e assessmen , which is aluable in he bes p ac ice amewo k, he
basis is exac in o ma ion. E.g. in he documen a ion, au ho s (ISACA, 2018b) se he
capabili y le el o p ocesses mechanically (sco e = o > 25 le el 2; sco e > 25 le el 2;
sco e > 50 le el 3; sco e > o = 75 le el 4). Ou app oach allows 1) o compu e a numbe o
occu ences o each indi idual p ac ice and in his way o assess impo an p ac ice and i s
in o ma ion lows, 2) o de e mine capabili y le el o each occu ing p ac ice ound in his
way.
The esul s can be used in se e al ways acco ding o he implemen a ion s a egy. Well
assessed, i.e. p io i ised p ocesses (p ac ices):
1) can be pa o he inal lis o selec ed p ocesses o go e nance sys em
implemen a ion,
2) can a ec a ge p ocess capabili y le els, and in his way, hey will be a pa o he
solu ion, e.g. o ensu e consequences om/ o selec ed p ac ices as discussed in
he pa ag aph abo e,
3) can be conside ed (al hough no di ec ly implemen ed) a he app op ia e s age o
he implemen a ion p ocess, e.g. o wo k wi h selec ed in o ma ion lows.
Al hough he s udy demons a es ha analysis can be used o iden i y equen ly used
p ac ices by bo h p edecesso s and successo s, he e a e se e al limi a ions and a eas ha
need o be s udied u he .
Volume 10 | Issue 4 | 2021
h ps://doi.o g/10.18267/j.ceb .264
80
CENTRAL EUROPEAN BUSINESS REVIEW
Fi s , he applica ion o ou app oach o he eal si ua ion would be especially sui able o
he possibili y o conside some de ails mo e au hen ically. Ou app oach was es ed on
case s udies published by au ho s o COBIT, which a e allowed o exac compa ison.
Second, he isualisa ion o ob ained da a in he o m o a p ocess map could be desi able.
Thi d, he de elopmen o mo e ad anced so wa e solu ions o bo h quan i a i e and
quali a i e analysis could be bene icial. I was necessa y o ex ac in o ma ion o he inal
assessmen om COBIT documen a ion semi-manually o he pu pose o his a icle. I is
wo h men ioning. I would be possible o compu e ise he quali a i e pa o he e alua ion.
Howe e , his equi es a se o exac condi ions o he e alua ion. Because he au ho s o
he COBIT amewo k suppo indi idual, pe sonal o ms o he inal e alua ion, au oma ion
o quali a i e e alua ion was no conside ed o his esea ch. This a icle should open a
discussion ocusing on he p ocess aspec o he COBIT amewo k and i s applica ions.
Fo his eason, so wa e ools based on COBIT a e no pa o his esea ch. Gene ally,
he e is also a need o u he esea ch and discussion o he bene i s o p ocess analysis
in he design phase.
Conclusions
The ocus o his a icle is o p esen in o ma ion lows inpu /ou pu analysis as ano he
ac o o p io i isa ion o p ocesses and hei p ac ices o EGIT sys em cons uc ion. The
app oach p esen ed in his a icle is based on he iden i ica ion o p ocesses ( hei p ac ices
o in o ma ion lows) ha occu mos o en as a p edecesso o successo o p ocesses
selec ed o a gi en go e nance sys em. We wo k no only wi h di ec p edecesso s and
successo s, bu we analyse in o ma ion lows up o he hi d gene a ion o p ocesses.
Quan i a i e analysis was pe o med by so wa e compu a ion. Thus, we ha e achie ed
numbe o inpu s and ou pu s occu ences o each p ac ice (o p ocess). Du ing he
analysis, se e al inconsis encies we e iden i ied in COBIT documen a ion conce ning
ela ionships be ween p ocesses. Howe e , compa ed o he o e all amoun o da a, hese
inconsis encies we e deemed negligible (9 om 479).
The i s wo case s udies published in COBIT documen a ion (ISACA, 2018b) we e used as
an example o inpu s/ou pu s analysis. Bo h quan i a i e and quali a i e analyses we e
pe o med. The ad an age o using his da a as a alida ion inpu is he abili y o con on
he esul s agains he o icial COBIT 2019 ma e ials. The disad an age is ha he au ho s
o he s udy could no su icien ly e alua e some quali a i e aspec s o he si ua ion in he
case s udy, which a e subjec i e na u ally. Howe e , bes p ac ice me hodology is always
based on he subjec i e pe cep ions o he expe s (a i udes, expe iences, opinions, e c.) in
he inal phase. I is COBIT’s na u al cha ac e is ics. The esul s show ha analysis can
iden i y he nex in o ma ion ha can be used in decision making abou he EGIT sys em.
Acco ding o ou indings, his is he i s ime when he de ini ions o in o ma ion low in
COBIT p ocesses a e discussed o imp o e design phase esul s. Fo go e nance sys em
cons uc ion, ou app oach ep esen s ano he way o iden i y p ac ices and p ocesses
equi ed o a leas conside ed o success ul implemen a ion. Knowledge o he p ocess
con ex suppo s one o he COBIT p inciples - he holis ic app oach.
Volume 10 | Issue 4 | 2021
h ps://doi.o g/10.18267/j.ceb .264
CENTRAL EUROPEAN BUSINESS REVIEW
81
Re e ences
Abu-Musa, A. (2009). Explo ing he Impo ance and Implemen a ion o COBIT P ocesses in Saudi
O ganisa ions: An Empi ical S udy. In o ma ion Managemen & Compu e Secu i y, 17(2), 73–
95. h ps://doi.o g/10.1108/09685220910963974.
Anind a, F., Abbas, B.S., T ise ya so, A., Supa a, W., Kang, C., & Wa na s, H. L. H. S. (2018).
Imp o ing he quali y o en e p ise IT goals using COBIT 5 p io i isa ion app oach. In 2018
In e na ional Con e ence on In o ma ion and Communica ions Technology (pp. 270–274).
Yogyaka a: IEEE.
A ison, D., Jones, J., Powell, P., & Wilson. D. (2004). Using and Valida ing he S a egic Alignmen
Model. Jou nal o S a egic In o ma ion Sys ems, 13(3), 223–246.
h ps://doi.o g/10.1016/j.jsis.2004.08.002.
Ba ens, Y., de Haes, S., Lamoen, Y., Schul e, F., & Voss, S. (2015). On he Way o a Minimum
Baseline in IT Go e nance: Using Expe Views o Selec i e Implemen a ion o COBIT 5. In
Sys em Sciences (HICSS) 48 h Hawaii In e na ional Con e ence on Sys em Sciences (pp.
4554–4563). Kauai, HI: IEEE.
Chan, Y. E., & Reich, B. H. (2007). IT Alignmen : Wha Ha e We Lea ned? Jou nal o In o ma ion
Technology, 22(4), 297–315. h ps://doi.o g/10.1057/palg a e.ji .2000109.
C ows on, K. (2003). A Taxonomy O O ganiza ional Dependencies and Coo dina ion Mechanisms. In
Malone T.W., C ows on, K., & He man, G.A. (Eds.), O ganising Business Knowledge: The MIT
P ocess Handbook (pp. 85–108). MIT P ess.
Da enpo , T. H., & Sho , J. E. (1990). The New Indus ial Enginee ing: In o ma ion Technology and
Business P ocess Redesign. MITSloan Managemen Re iew, 31(4).
De Haes, S., an G embe gen, W., & Deb eceny, R.S. (2016). COBIT 5 and En e p ise Go e nance o
In o ma ion Technology: Building Blocks and Resea ch Oppo uni ies. Jou nal O In o ma ion
Sys ems, 27(1), 307–324. h ps://doi.o g/10.2308/isys-50422.
Figl, K., & Recke , J. (2016). P ocess inno a ion as c ea i e p oblem sol ing: An expe imen al s udy o
ex ual desc ip ions and diag ams. In o ma ion & Managemen , 53(6), 767–786.
h ps://doi.o g/10.1016/j.im.2016.02.008.
F oge , M., Bénaben, F., T up il, S., & Boissel-Dallie , N. (2019). A non-linea business p ocess
managemen ma u i y amewo k app ehend u u e challenges. In e na ional Jou nal o
In o ma ion Managemen , 49, 290–300. h ps://doi.o g/10.1016/j.ijin omg .2019.05.013.
Hamme , M. (2002). P ocess Managemen and he Fu u e o Six Sigma. MIT Sloan Managemen
Re iew, 43(2), 26–32.
ISACA. (2012). COBIT 5 A Business F amewo k o he Go e nance and Managemen o En e p ise
IT. Rolling Meadows: ISACA.
ISACA. (2018a). COBIT® 2019 F amewo k: Go e nance and Managemen Objec i es. Schaumbu g:
ISACA.
ISACA. (2018b). COBIT® 2019 Design Guide: Designing an In o ma ion and Technology Go e nance
Solu ion. Schaumbu g: ISACA.
ISACA. (2018c). COBIT® 2019 F amewo k: In oduc ion and Me hodology. Schaumbu g: ISACA.
ISO. (2008). ISO/IEC 38500:2008. Co po a e go e nance o in o ma ion echnology. Gene a:
In e na ional O ganiza ion o S anda diza ion.
Volume 10 | Issue 4 | 2021
h ps://doi.o g/10.18267/j.ceb .264
82
CENTRAL EUROPEAN BUSINESS REVIEW
ISO. (2015). ISO/IEC 38500:2015. In o ma ion echnology -- Go e nance o IT o he o ganisa ion.
Gene a: In e na ional O ganiza ion o S anda diza ion.
ITGI. (2007). COBIT® 4.1. Rolling Meadows: ISACA.
Jes on, J., & Nelis, J. (2014). Business P ocess Managemen P ac ical guidelines o success ul
implemen a ions. Thi d edi ion. New Yo k: Rou ledge.
Ki chme , M. (2015). Managemen P ocess Excellence. In om B ocke, J., & Rosemann, M. (Eds.),
Handbook on Business P ocess Managemen 2, S a egic Alignmen , Go e nance, People and
Cul u e. 2nd Edi ion. (pp. 79–100). Be lin Heidelbe g: Sp inge -Ve lag.
Lu man, J., Zadeh, H. S., De ksen, B., San ana, M., Rigoni, E. H., & Huang, Z. (2013). Key In o ma ion
Technology and Managemen Issues 2012-2013: An In e na ional S udy. Jou nal o In o ma ion
Technology, 28(4), 354–366. h ps://doi.o g/10.1057/ji .2013.22
Valo in a, M. (2011). IT alignmen and he bounda ies o he IT unc ion. Jou nal o In o ma ion
Technology, 26(1), 46–59. h ps://doi.o g/10.1057/ji .2010.28
Mølle , C., Maack,C. J., & Rune, D. T. (2007). Wha is business p ocess managemen : A wo s age
li e a u e iew o an eme ging ield In Xu, L.D., Tjoa, A.M., & Chaudh y, S.S. (Eds.), Resea ch
and P ac ical Issues o En e p ise In o ma ion Sys ems II. IFIP — The In e na ional Fede a ion
o In o ma ion P ocessing, ol 254. (pp. 19–31). Bos on, MA: Sp inge .
Rahimi, F., Molle , C., & H am, L. (2016). Business p ocess managemen and IT managemen : The
missing in eg a ion. In e na ional Jou nal o In o ma ion Managemen , 36(1), 142–154.
h ps://doi.o g/10.1016/j.ijin omg .2015.10.004
Rosing, M., on Scheel H., & on Schee . A. W. (2015). The comple e business p ocess handbook.
Body o knowledge om P ocess Modeling o BPM, Volume 1. Wal ham: Else ie .
Řepa, V., & S a oš, O. (2016). Wo king wi h P ocess Abs ac ion Le els. In Řepa, V., & B uckne T.
(Eds.), Pe spec i es in Business In o ma ics Resea ch. Lec u e No es in Business In o ma ion
P ocessing, 261. (pp. 65–79). Cham: Sp inge .
Schlosse , F., Wagne , H., & Col man. T. (2012). Reconside ing he Dimensions o Business-IT
Alignmen . In Sys em Science (HICSS) 45 h Hawaii In e na ional Con e ence on Sys em
Sciences (pp. 5053–5061). Maui, HI: IEEE.
Ta a da , M., & Go don, S. R. (2007). Unde s anding he in luence o in o ma ion sys ems
compe encies on p ocess inno a ion: A esou ce-based iew. Jou nal o S a egic In o ma ion
Sys ems, 16, 353–392. h ps://doi.o g/10.1016/j.jsis.2007.09.001.
Weske, M. (2012). Business P ocess Managemen . Concep s, Languages, A chi ec u es. Second
Edi ion. Be lin Heidelbe g: Sp inge .
The esea ch pape passed he e iew p ocess. | Recei ed: Augus 27, 2020; Re ised: Oc obe
15, 2020; Accep ed: Oc obe 23, 2020; P e-published online: Feb ua y 12, 2021; Published in he
egula issue: Sep embe 20, 2021.