Analysis of processes information flows and items as additional design factor in COBIT framework

Volume 10 | Issue 4 | 2021 https://doi.org/10.18267/j.cebr.264 CENTRAL EUROPEAN BUSINESS REVIEW 63 ANALYSIS OF PROCESSES INFORMATION FLOWS AND ITEMS AS ADDITIONAL DESIGN FACTOR IN COBIT FRAMEWORK ——————————————————————————————————————— Rozehnal, P., Novák, V. ——————————————————————————————————————— Petr Rozehnal / VSB - Technical University of Ostrava, Faculty of Economics, Department of Applied Informatics, Sokolská tř. 33, Ostrava, 702 00, Czech Republic. Email: [email protected] Vítězslav Novák / VSB - Technical University of Ostrava, Faculty of Economics, Department of Applied Informatics, Sokolská tř. 33, Ostrava, 702 00, Czech Republic. Email: [email protected] Abstract COBIT is a process-oriented IT governance framework. In the 2019 version, the framework offers a significantly redesigned approach to prioritise processes and set process target capability levels. The design phase is very important to achieve a governance system in future. Although there are several design factors defined in the design phase of COBIT 2019, these factors do not assess process suitability and value for the governance system. Thus, connections and continuity among processes are not taken into consideration enough. Therefore, the aim of the article is to suggest another design factor based on the interrelationships of processes in the COBIT framework represented by its information flows. The nature of the proposed innovation is described, and the analysis of process information flows and items is performed. The article also publishes several inconsistencies in COBIT 2019 documentation that have been identified in the process of research. The application of process information flows and items analysis has been illustrated in two case studies. We have identified new information that can be relevant to decision making in the design phase and discussed their importance for the planned governance system. The results could help to improve the quality of the design phase by providing additional information about the context of the processes designed to ensure the governance system. Implications for Central European audience: The implications for senior managers in the Central European region will be beneficial. Optimisation and effective use of information technologies is a prerequisite for achieving long-term competitiveness. COBIT is a best practice framework, and its implementation in companies is largely based on the specifics of each organisation. Therefore, it is important to pay close attention to the implementation phase of the application of COBIT. Framework application positively supports the holistic approach to management, resource optimisation, management based on responsibility and measurability. Today, these attributes of the organisation’s management are emphasised not only in Central Europe but in developed countries in general. Keywords: IT; governance; COBIT; framework; analysis; process JEL Classification: M15, O33, O38 Volume 10 | Issue 4 | 2021 https://doi.org/10.18267/j.cebr.264 64 CENTRAL EUROPEAN BUSINESS REVIEW Introduction The transformation of enterprises towards the use of digital technologies as well as the massive use of data requires a comprehensive management approach based on the holistic principle. As Crowston (2003) states, interdependency and coordination are important topics in organisation studies. Information technologies (IT) are pervasive and create a dynamic environment full of possibilities and challenges. It is still more important to achieve IT/business alignment in organisations (Avison et al., 2004; Chan & Reich, 2007; Schlosser et al., 2012; Valorinta, 2011), which is a fundamental objective of information technology governance/management. The value delivering is critically dependent on an ability to create a management system where the processes are linked and support each other. It is obvious that IT influence processes and vice versa (Luftman et al., 2013; Rahimi et al., 2016; Tarafdar & Gordon, 2007). IT governance, as a part of corporate governance, should ensure consistency among aspects that are important for strategic business management. Terminologically, IT governance has undergone many changes, both in terms of management levels and content (ITGI, 2007; ISO, 2008; ISO, 2015; ISACA, 2012). Enterprise governance of IT (EGIT), see (De Haes et al., 2016; ISACA, 2018c) in this article is used. COBIT (ISACA, 2018c) is the worldwide known framework for EGIT. It should assist in the process of implementation and realisation of the EGIT system. COBIT is process-oriented. The key component is the objective. There are 40 objectives described in COBIT 2019 (37 processes in COBIT 5). Each objective is referred to as one process. The process is characterised as follows: “a collection of practices influenced by the enterprise’s policies and procedures that takes inputs from a number of sources (including other processes), manipulates the inputs and produces outputs (e.g. products, services).” (ISACA, 2012, p. 92). The process is further described in the practices, which are specified in the activities. The process and other COBIT components (organisational structures; principles, policies and frameworks; information; culture, ethics and behaviour; people, skills and competencies; services, infrastructures and applications) influence the governance system and help to establish the transparent environment within the organisation. Big attention should be paid to the question of how to apply the framework to achieve better results in the planned EGIT system (Abu-Musa, 2009; Anindra et al., 2018). One of the most important issues of the new COBIT 2019 framework is a change in design and customisation (ISACA, 2018b). Due to EGIT complexity (Bartens et al., 2015), the challenge for the design phase is how to customise COBIT for a given enterprise. In COBIT 5 version, processes for the EGIT system were selected by goals cascading with support of mapping tables that express relationships priorities. Such a procedure is rather a guideline for process prioritisation. In COBIT 2019, the phase of process priority rating has been significantly changed (ISACA, 2018b). Eleven design factors, together with the recommended design process on how to tailor the governance system, are described to improve process prioritisation. A different focus area should be taken into consideration, as well. All these aspects influence the selection of processes within the context of the current/specific situation in the organisation and the determination of process capability levels. Volume 10 | Issue 4 | 2021 https://doi.org/10.18267/j.cebr.264 CENTRAL EUROPEAN BUSINESS REVIEW 65 The design phase of EGIT system implementation supports prioritisation of management objectives (processes), components variation and establishes recommended capability level. Davenport and Short (1990) mentioned the exhaustive approach based on data for identification of important processes or alternative one based on the general sense of which processes are crucial. Our approach follows Davenport in both ways. There is no one ideal way how to apply the COBIT framework and thus achieve the EGIT system. Process prioritisation and decision for EGIT system implementation are based on the combination of experts’ experiences, knowledge of company situation, knowledge of COBIT methodology. Thus, it is a mix of objective and subjective information, opinions and attitudes. During the design phase, COBIT uses partly mechanical calculation based on subjective/objective values and opinions, and partly it is followed by a qualitative evaluation (although subjective again because it is done by experts responsible for EGIT system implementation). Finally, there are selected processes sorted by relevance (their usefulness) to the assessed factors (i.e. current situation and organisation goals) and other components important for achieving the EGIT system. Process capability level is also recommended. ISACA provides a software toolkit to support the design process. As stated above, part of the design phase is calculated, based on matrices, described in (ISACA, 2018b), in Chapter 6, and customer inputs. Despite the publication of the COBIT framework, many factors recommended during the design phase suffer from a lack of documentation. Moreover, it is very difficult to measure their influence and potential impact on the EGIT system. In one sense, this may not be surprising because COBIT is practically oriented. However, the ability to implement the EGIT system is critically important, so all discussion and research that can help improve the quality of the design phase are valuable. The wrong composition of processes in the EGIT system may cause a gap in the overall concept which should be holistic according to ISACA. In the article, we suggest a new design factor that is based on the process character of COBIT. Our approach considers process context by providing process information flows input/output analysis as another design factor to support process prioritisation. The design phase is an important area in the EGIT system life cycle. The higher the quality of tailoring the governance system is, the higher the probability of obtaining a high-quality EGIT system is. The impact of design factors is described in (ISACA, 2018b). Assuming EGIT system construction follows COBIT documentation, design factors play a crucial role in the design phase. Our concept thus supports one of the key principles of the COBIT framework - the holistic approach. The remainder of this article is organised as follows: the next chapter describes both phases of the methodology concept. Chapter 2 provides a brief theoretical background. Chapters 3 and 4 describe case studies where our approach is applied. Chapter 5 discusses general assessment, limitations and future research implications. Conclusion and list of references finalise our article. 1 Methodology approach The concept of the paper is based on process management theory and analysis of processes relationships. In the context of the COBIT framework, we extend the design phase and customisation of governance solution published in (ISACA, 2018b). Volume 10 | Issue 4 | 2021 https://doi.org/10.18267/j.cebr.264 66 CENTRAL EUROPEAN BUSINESS REVIEW The methodology is quantitative as well as qualitative. Quantitative analysis was performed using a software tool developed by the authors. For the analysis, this tool used data representing relationships between processes described in COBIT 2019 (ISACA, 2018a). The quantitative part of the analysis involves process information flows and items analysis (Note: COBIT 5 version used term process inputs/outputs). The source of information is the original COBIT documentation (ISACA, 2018a). We analyse the relationships between processes to assess the role and importance of the given process in the context of selected processes. The qualitative analysis follows the quantitative analysis. The reason to apply a qualitative approach is that COBIT cannot be mechanically implemented. It is necessary to tailor the EGIT system to fit organisation specifications. COBIT recommends concluding the design of the EGIT system with the final human evaluation to discuss the situation, resolve conflicts and achieve conclusions. Our analysis consists of three stages. First, the process entity is analysed. This stage describes the process view, which encapsulates issues from the next stages. Second, the practices analysis stage, where practices of processes are analysed. Third, the information flows stage, where inputs and outputs are considered (the approach is illustrated in Figure 1). The position in governance system design workflow is between steps 3.7 and 4.1 (ISACA, 2018b), Figure 4.1. It should support the final evaluation of the design phase. One supplement design factor is the input/output analysis of information flows. It can be used as follows: 1) Influenced management objective priority (in other words, processes) and target capability levels. 2) Influenced component variation, specifically information flows and items (ISACA, 2018b), Figure 3.1). 2 Process information flows and items as an additional design factor The theoretical background of our approach is based on the business process management concept. Practical deployment of quantitative analysis is based on a software tool that is able to analyse relationships between processes. 2.1 Business process management Business process management (BPM) is an approach that covers concepts, methods and techniques to support the design, administration and other activities related to business processes (Weske, 2012). Jeston and Nelis (2014) state that BPM is a significant contributor to achieving an organisation’s objectives. There is a reason to realise processes, achieve value and meet objectives. This is done by process outcomes or products that are intended for customers (Davenport & Short, 1990). Rahimi et al. (2016) state that business process links business strategy to an organisation’s IT capabilities. In fact, BPM describes how process works and technology plays a crucial role by delivering an infrastructure (Moller et al., 2007). The list of BPM definitions is presented and discussed in (Rosing et al., 2015). Volume 10 | Issue 4 | 2021 https://doi.org/10.18267/j.cebr.264 CENTRAL EUROPEAN BUSINESS REVIEW 67 Hammer (2002) understands the process as an organised group of activities that work together and create a result with value to the customer. Hammer underlines that activities must work together and be aligned. The process is the way how to achieve the goal. Froger et al. (2019) point out the BPM challenge in the area of alignment between human actors and information systems. The process is the link among business strategy, people and technology. Thus, it supports innovation and agility (Kirchmer, 2015). The description of the process may be realised in different levels of detail (Řepa & Svatoš, 2016). According to the level of detail, a process may contain subsections (activities, practices, steps). The process is in relationships with other processes and plays a role within an organisation. COBIT process dependencies are shown in Figure 1. The governance of processes means end-to-end managing of processes (Jeston & Nelis, 2014). BPM manages all relevant processes within the organisation because of a holistic approach. In a process chain, processes are influenced by their predecessors (chronologically, they occur before and produce outputs) and affect successors (chronologically, they happen after and accept inputs). COBIT is a process-oriented framework. Each process is described in text form. The framework does not contain a model of process flow. Although such a description is the most used (Figl & Recker, 2016), it has limitations for practical implementation. Each process description contains input and output information flows from and to other processes. Information flows and items represent process outcomes for the next processes (their customers). Examples of such outcomes, according to Davenport and Short (1990) marketing plan, contract as well as product or goods. While Crowston (2003) discusses dependencies theoretically in organisational structures, COBIT defines exact relationships between processes. Regarding the number of inputs and outputs (we identified nearly 500 relationships, see below), it is difficult to express a complex process model for all COBIT processes. However, it is possible to use the inputs/outputs analysis to get knowledge about the partial process context. In the article, we analyse predecessors and successors up to the third generations (L1 means 1st level, L2 means 2nd level and L3 means 3rd level). COBIT application requires finding a suitable combination of processes and their level of capability to create an EGIT system. Our approach complements the implementation process with the element of process continuity, one of the fundamental principles in BPM. The decision-making process in the design phase, whose objective is a set of key processes for building the EGIT system, is enhanced by the knowledge of the process context. Volume 10 | Issue 4 | 2021 https://doi.org/10.18267/j.cebr.264 68 CENTRAL EUROPEAN BUSINESS REVIEW Figure 1 | Process dependencies applied in COBIT Source: authors 2.2 Information flows and items as inputs/outputs The basis of quantitative analysis is a software tool that uses and evaluates the mapping of relationships between processes presented in COBIT. For the purpose of the article, a database management system and a spreadsheet were used. The reason is simplicity, availability and mutual compatibility of both tools (the official ISACA toolkit is also based on the spreadsheet). It is not necessary to research process dependency structures, as shown in (Crowston, 2003). In COBIT, each process has assigned its direct input and output processes. However, these relationships are available only in PDF format. Relationships were therefore transformed semi-manually into two tables representing two possible relationships between two processes: (1) process – predecessor, (2) process – successor. During this transformation, 479 relationships were identified. For example, practice APO07.01 has its predecessor APO01.05, as APO01.05 produces information flow named Definition of supervisory practices, which is listed as input for APO07.01. Therefore, it is logical to conclude that the process relationships tables processpredecessor and process-successor mentioned above are identical. Information stored in both tables essentially describes the same relationships between processes. For the purpose of inputs/outputs analysis, the table of process relationships was created (Figure 2). Figure 2 | Example of relationships between processes in the database management system Source: authors Volume 10 | Issue 4 | 2021 https://doi.org/10.18267/j.cebr.264 CENTRAL EUROPEAN BUSINESS REVIEW 69 Note: Multiple inputs/outputs as used in (ISACA, 2018a, p. 23) are not included in these tables. The influence of multiple inputs/outputs is assessed separately in the qualitative analysis phase. During the comparison of process-predecessor and process-successor tables, several inconsistencies (details below) were identified. Since the authors of the article are not entitled to establish a correct version of relationships, these relationships showing inconsistencies were excluded from the analysis. The aim of the quantitative phase (supported by software solution) was to identify the most frequently occurring processes as predecessor or successors (up to 3rd level) for the selected set of processes (shown in Figure 1). For this purpose, the views were created that simulate the sequence of individual processes through several levels with the help of self-join operations on a single process sequences table. At the same time, the frequencies of processes for each level are computed for individual processes at given levels and the selected combination of input processes. Subsequently, obtained frequencies were used for determining which processes are the most often used and, therefore, should be considered as important during implementation. The information flow between practices is also a part of the predecessor-successor relationship. In the subsequent phases of the evaluation, it is thus possible to identify better the importance of relationships according to the transmitted information. It is necessary to identify the most influential factors to further analyse the results of quantitative evaluation. Following factors were considered during the analysis: • Inputs are more important than outputs. Inputs are important as predecessors to realise processes of the EGIT system. Outputs are important for successors; in other words, for the next development of the EGIT system outside the scope of defined goals. • Three levels of predecessors and successors are used. The most important is the L1 level, next is L2, and finally L3. • Evaluation of important processes, practices and information flows based on their frequencies of occurrence. • The importance of selected processes is derived from the number of practices used in EGIT system construction. For example, if the process contains four practices, and they are all used in the construction of the system, then the process is considered very important. Similarly, the low number of used practices leads the process to be considered unimportant for the construction of the system. The same stands true for information flows. Results of the presented analysis, therefore, identify the importance of the whole process or one of its practices or information flows. It should be noted that COBIT assigns each activity to recommended capability level and contains information about its information flows. Usually, the determination of capability levels is one of the outputs of the design phase. Therefore, our approach allows for a more detailed analysis and evaluation of the design phase. Volume 10 | Issue 4 | 2021 https://doi.org/10.18267/j.cebr.264 70 CENTRAL EUROPEAN BUSINESS REVIEW 2.3 Process inputs/outputs inconsistencies in COBIT 2019 framework After the data transformation phase, both inputs and outputs were used, and relationships were compared. The following inconsistencies in inputs/outputs among process practices were found in (ISACA, 2018a) in the following information flows: • Data classification guidelines, APO14.01 versus APO01.06 and APO01.07. • Data integrity procedures, APO14.04 versus APO01.06 and APO01.07. • Data security and control guidelines, APO14.08 versus APO01.07. • Customer requirements for quality management, BAI11.05 and BAI11.06 versus APO11.02. • Root causes of problems, DSS03.05 versus DSS03.04. • Plan of right-size I&T landscape including missing I&T capabilities, services and applications, APO02.02 and APO02.03 versus APO01.10. • Incident resolutions, DSS03.05 versus DSS02.05. • Root causes of problems, DSS03.05 and DSS03.02. 3 Case study 1 This case study is described by ISACA (ISACA, 2018b), see p. 67. According to results in this document, chapter 7.2.4., we have used processes that seem to be likely important for the EGIT system for analysis (without correction after qualitative evaluation, see note at the end of the case study 1). There are only processes with the greatest priority rating (relative importance 75 and more on a scale from -100 to +100) in input/output analysis. • DSS02 Managed service requests and incidents (75), • APO13 Managed security (80), • DSS04 Managed continuity (80), • DSS03 Managed problems (75), • BAI09 Managed assets (75), • BAI10 Managed configuration (75). Case study 1 Quantitative part of the evaluation The quantitative part of the evaluation is shown in Figures 3, 4, 5. Note: in the results below, processes selected within the initial design phase are included in the tables and are highlighted with grey colour. Figure 3 shows the number of practices occurrences for process in total (see columns named as Count) as inputs or outputs divided by levels in which they occur. Values on predecessor side then represent the number of processes serving as inputs of analysed processes. Values on successor side then represent the number of processes serving as outputs of analysed processes. E.g. on the L1 level, the most frequent input practices are practices of process APO12 occurring eight times and APO09 occurring five times. On L2 level, the most frequent input processes are APO14 occurring eight times, APO12 occurring 71 times. On L3 level, the most frequent input processes are APO12 occurring 20 times, then APO14 occurring ten times etc. On the L1 level, the most frequent output processes are APO08 occurring five times, then BAI06 occurring four times. On the L2 level, the most frequent processes are Volume 10 | Issue 4 | 2021 https://doi.org/10.18267/j.cebr.264 CENTRAL EUROPEAN BUSINESS REVIEW 71 APO08 occurring 12 times and MEA04 occurring 11 times. On the L3 level the most frequent processes are APO02 occurring 28 times, APO05 occurring 18 times and so on. Figure 3 | The number of occurrences of processes on each level as predecessors and successors (first 20 rows only) Source: authors Figure 4 illustrates practice elements analysis where the structure of information is the same as in Table 1 but with a focus on practices rather than processes. It can be seen that the most frequent input practice on the L1 level is APO12.06, occurring seven times, then APO09.03 occurring five times. On L2 level, the most frequent practice is APO12.06 and EDM03.03 occurring seven times, then APO11.02 occurring six times. L3 level: the most frequent input practice is EDM03.03, APO12.04 and APO12.02 occurring seven times, then APO12.06 occurring six times. Similarly, the most frequent output practice on the L1 level is BAI06.01, occurring four times, then BAI03.11, MEA04.07, APO09.04 and APO08.03 all occurring three times. On L2 level, the most frequent practices are APO12.01 occurring seven times, MEA01.03 and APO02.02, both occurring six times. L3 level: the most frequent practice is APO02.02, occurring 14 times, and so on. Volume 10 | Issue 4 | 2021 https://doi.org/10.18267/j.cebr.264 78 CENTRAL EUROPEAN BUSINESS REVIEW Process EDM04 Ensured Resource Optimization has evaluated 30 points from the original design phase analysis, so it is among less recommended processes. Nevertheless, its practices EDM04.03 Monitor resource management, EDM04.01 Evaluate resource management, EDM04.02 Direct resource management could be relevant for implementation because they are often used as inputs on all levels (L1-L3). Practices deal with resource management issues from allocation principles, strategies to monitoring activities (an example of information flows: Guiding principles for allocating resources and capabilities; Approved resources plan and others)—recommended target capability level 3. Process BAI02 Managed Requirements Definition obtained from the initial governance system design phase 55 points with target capability level 3. Based on the results of the input/output analysis, we can confirm the result and recommend rather greater importance for two reasons. First, information flows from the BAI02 process are often used as inputs and outputs on all levels (L1 – L3), and three practices from four are used. Second, practices BAI02.01 and BAI02.02 are the most often used inputs. Moreover, to realise practice BAI02.02 Perform a feasibility study and formulate alternative solutions, capability level 4 is recommended. According to these reasons, we evaluate BAI02 as underestimated and recommend paying greater attention to its involvement in the EGIT system. Process APO02 Managed Strategy is worth assessing. All practices from process APO02 are represented in the analysis results and are distributed evenly among predecessors and successors on all observed levels L1-L3. Information flows are oriented to information that assists in the strategic approach to IT building and operation (for example, Defined scope of architecture; Architecture concept business case and value proposition and others). Given the fact, that process is mostly a successor of evaluated processes. We have no special recommendations. BAI01 Managed Programs ensures the management of programs from the investment portfolio. With respect to the results of input/output analysis, it should be recommended a greater target capability level. Used practices require mainly capability level 3, selected 4. Regarding the description of company objectives and design phase results, it can be stated that the process BAI01 can successfully support the implementation of the governance system in the management context as well as in the information context. Recommended target capability level is 3. Information flows from process APO05 Managed Portfolio are used primarily as successors of evaluated processes. We do not make additional recommendations. Practices of process APO01 Managed I&T Management Framework are valuable as well. Five from eleven practices from this process are used as inputs. Moreover, practices APO01.01, .02, .03 and .11 are listed as multiple input/output, so their role is even stronger. With regard to the used information flows, it is appropriate to achieve the target capability level 3. Process APO11 is underestimated as well, according to the results of our approach. APO11 has multiple outputs to other processes. Although, without them, we have monitored information flows from APO11. Considering capability level, we recommend achieving at least target capability level 2 for APO11. Volume 10 | Issue 4 | 2021 https://doi.org/10.18267/j.cebr.264 CENTRAL EUROPEAN BUSINESS REVIEW 79 Table 2 | Case study 2 Summary of recommendations Process Comments Original target capability level Proposed target capability level EDM04 Underestimated 2 3 BAI01 Underestimated 2 3 BAI02 Consider attention to selected practices from BAI02 3 3 APO01 Underestimated 2 3 APO02 No changes or recommendation 2 2 APO05 No changes or recommendation 3 3 APO11 Take into account for implementation. 2 - 3 Source: Authors 5 Results assessment, limitations and further research COBIT 2019 comes with a new approach to designing the governance system for enterprise information and technology (ISACA, 2018b). Even though COBIT 2019 determines the importance of processes by assigning priority values based on design factors, it still does not consider the interconnectedness of processes by information flows. One of the principles of the COBIT framework is the holistic principle. Our motivation is to involve relevant processes, practices and information flows. Harmon (2018) shows that most organisations do not apply a systematic approach to process management. In our implementation, the selection of processes is made according to EGIT goals and the context of a given organisation. The approach presented in (ISACA, 2018b) combines quantitative and qualitative evaluation. This study shows another factor that may be used in the evaluation. Moreover, the factor is calculated from defined dependencies. Therefore it is not subjective. Although we finally use subjective assessment, which is valuable in the best practice framework, the basis is exact information. E.g. in the documentation, authors (ISACA, 2018b) set the capability level for processes mechanically (score = or > 25 level 2; score > 25 level 2; score > 50 level 3; score > or = 75 level 4). Our approach allows 1) to compute a number of occurrences for each individual practice and in this way to assess important practice and its information flows, 2) to determine capability level for each occurring practice found in this way. The results can be used in several ways according to the implementation strategy. Well assessed, i.e. prioritised processes (practices): 1) can be part of the final list of selected processes for governance system implementation, 2) can affect target process capability levels, and in this way, they will be a part of the solution, e.g. to ensure consequences from/to selected practices as discussed in the paragraph above, 3) can be considered (although not directly implemented) at the appropriate stage of the implementation process, e.g. to work with selected information flows. Although the study demonstrates that analysis can be used to identify frequently used practices by both predecessors and successors, there are several limitations and areas that need to be studied further. Volume 10 | Issue 4 | 2021 https://doi.org/10.18267/j.cebr.264 80 CENTRAL EUROPEAN BUSINESS REVIEW First, the application of our approach to the real situation would be especially suitable for the possibility to consider some details more authentically. Our approach was tested on case studies published by authors of COBIT, which are allowed for exact comparison. Second, the visualisation of obtained data in the form of a process map could be desirable. Third, the development of more advanced software solutions for both quantitative and qualitative analysis could be beneficial. It was necessary to extract information for the final assessment from COBIT documentation semi-manually for the purpose of this article. It is worth mentioning. It would be possible to computerise the qualitative part of the evaluation. However, this requires a set of exact conditions for the evaluation. Because the authors of the COBIT framework support individual, personal forms of the final evaluation, automation of qualitative evaluation was not considered for this research. This article should open a discussion focusing on the process aspect of the COBIT framework and its applications. For this reason, software tools based on COBIT are not part of this research. Generally, there is also a need for further research and discussion of the benefits of process analysis in the design phase. Conclusions The focus of this article is to present information flows input/output analysis as another factor for prioritisation of processes and their practices for EGIT system construction. The approach presented in this article is based on the identification of processes (their practices or information flows) that occur most often as a predecessor or successor of processes selected for a given governance system. We work not only with direct predecessors and successors, but we analyse information flows up to the third generation of processes. Quantitative analysis was performed by software computation. Thus, we have achieved number of inputs and outputs occurrences for each practice (or process). During the analysis, several inconsistencies were identified in COBIT documentation concerning relationships between processes. However, compared to the overall amount of data, these inconsistencies were deemed negligible (9 from 479). The first two case studies published in COBIT documentation (ISACA, 2018b) were used as an example of inputs/outputs analysis. Both quantitative and qualitative analyses were performed. The advantage of using this data as a validation input is the ability to confront the results against the official COBIT 2019 materials. The disadvantage is that the authors of the study could not sufficiently evaluate some qualitative aspects of the situation in the case study, which are subjective naturally. However, best practice methodology is always based on the subjective perceptions of the experts (attitudes, experiences, opinions, etc.) in the final phase. It is COBIT’s natural characteristics. The results show that analysis can identify the next information that can be used in decision making about the EGIT system. According to our findings, this is the first time when the definitions of information flow in COBIT processes are discussed to improve design phase results. For governance system construction, our approach represents another way to identify practices and processes required or at least considered for successful implementation. Knowledge of the process context supports one of the COBIT principles - the holistic approach. Volume 10 | Issue 4 | 2021 https://doi.org/10.18267/j.cebr.264 CENTRAL EUROPEAN BUSINESS REVIEW 81 References Abu-Musa, A. (2009). Exploring the Importance and Implementation of COBIT Processes in Saudi Organisations: An Empirical Study. Information Management & Computer Security, 17(2), 73– 95. https://doi.org/10.1108/09685220910963974. Anindra, F., Abbas, B.S., Trisetyarso, A., Suparta, W., Kang, C., & Warnars, H. L. H. S. (2018). Improving the quality of enterprise IT goals using COBIT 5 prioritisation approach. In 2018 International Conference on Information and Communications Technology (pp. 270–274). Yogyakarta: IEEE. Avison, D., Jones, J., Powell, P., & Wilson. D. (2004). Using and Validating the Strategic Alignment Model. Journal of Strategic Information Systems, 13(3), 223–246. https://doi.org/10.1016/j.jsis.2004.08.002. Bartens, Y., de Haes, S., Lamoen, Y., Schulte, F., & Voss, S. (2015). On the Way to a Minimum Baseline in IT Governance: Using Expert Views for Selective Implementation of COBIT 5. In System Sciences (HICSS) 48th Hawaii International Conference on System Sciences (pp. 4554–4563). Kauai, HI: IEEE. Chan, Y. E., & Reich, B. H. (2007). IT Alignment: What Have We Learned? Journal of Information Technology, 22(4), 297–315. https://doi.org/10.1057/palgrave.jit.2000109. Crowston, K. (2003). A Taxonomy Of Organizational Dependencies and Coordination Mechanisms. In Malone T.W., Crowston, K., & Herman, G.A. (Eds.), Organising Business Knowledge: The MIT Process Handbook (pp. 85–108). MIT Press. Davenport, T. H., & Short, J. E. (1990). The New Industrial Engineering: Information Technology and Business Process Redesign. MITSloan Management Review, 31(4). De Haes, S., van Grembergen, W., & Debreceny, R.S. (2016). COBIT 5 and Enterprise Governance of Information Technology: Building Blocks and Research Opportunities. Journal Of Information Systems, 27(1), 307–324. https://doi.org/10.2308/isys-50422. Figl, K., & Recker, J. (2016). Process innovation as creative problem solving: An experimental study of textual descriptions and diagrams. Information & Management, 53(6), 767–786. https://doi.org/10.1016/j.im.2016.02.008. Froger, M., Bénaben, F., Truptil, S., & Boissel-Dallier, N. (2019). A non-linear business process management maturity framework apprehend future challenges. International Journal of Information Management, 49, 290–300. https://doi.org/10.1016/j.ijinfomgt.2019.05.013. Hammer, M. (2002). Process Management and the Future of Six Sigma. MIT Sloan Management Review, 43(2), 26–32. ISACA. (2012). COBIT 5 A Business Framework for the Governance and Management of Enterprise IT. Rolling Meadows: ISACA. ISACA. (2018a). COBIT® 2019 Framework: Governance and Management Objectives. Schaumburg: ISACA. ISACA. (2018b). COBIT® 2019 Design Guide: Designing an Information and Technology Governance Solution. Schaumburg: ISACA. ISACA. (2018c). COBIT® 2019 Framework: Introduction and Methodology. Schaumburg: ISACA. ISO. (2008). ISO/IEC 38500:2008. Corporate governance of information technology. Geneva: International Organization for Standardization. Volume 10 | Issue 4 | 2021 https://doi.org/10.18267/j.cebr.264 82 CENTRAL EUROPEAN BUSINESS REVIEW ISO. (2015). ISO/IEC 38500:2015. Information technology -- Governance of IT for the organisation. Geneva: International Organization for Standardization. ITGI. (2007). COBIT® 4.1. Rolling Meadows: ISACA. Jeston, J., & Nelis, J. (2014). Business Process Management Practical guidelines to successful implementations. Third edition. New York: Routledge. Kirchmer, M. (2015). Management Process Excellence. In vom Brocke, J., & Rosemann, M. (Eds.), Handbook on Business Process Management 2, Strategic Alignment, Governance, People and Culture. 2nd Edition. (pp. 79–100). Berlin Heidelberg: Springer-Verlag. Luftman, J., Zadeh, H. S., Derksen, B., Santana, M., Rigoni, E. H., & Huang, Z. (2013). Key Information Technology and Management Issues 2012-2013: An International Study. Journal of Information Technology, 28(4), 354–366. https://doi.org/10.1057/jit.2013.22 Valorinta, M. (2011). IT alignment and the boundaries of the IT function. Journal of Information Technology, 26(1), 46–59. https://doi.org/10.1057/jit.2010.28 Møller, C., Maack,C. J., & Rune, D. T. (2007). What is business process management: A two stage literature view of an emerging field In Xu, L.D., Tjoa, A.M., & Chaudhry, S.S. (Eds.), Research and Practical Issues of Enterprise Information Systems II. IFIP — The International Federation for Information Processing, vol 254. (pp. 19–31). Boston, MA: Springer. Rahimi, F., Moller, C., & Hvam, L. (2016). Business process management and IT management: The missing integration. International Journal of Information Management, 36(1), 142–154. https://doi.org/10.1016/j.ijinfomgt.2015.10.004 Rosing, M., von Scheel H., & von Scheer. A. W. (2015). The complete business process handbook. Body of knowledge from Process Modeling to BPM, Volume 1. Waltham: Elsevier. Řepa, V., & Svatoš, O. (2016). Working with Process Abstraction Levels. In Řepa, V., & Bruckner T. (Eds.), Perspectives in Business Informatics Research. Lecture Notes in Business Information Processing, 261. (pp. 65–79). Cham: Springer. Schlosser, F., Wagner, H., & Coltman. T. (2012). Reconsidering the Dimensions of Business-IT Alignment. In System Science (HICSS) 45th Hawaii International Conference on System Sciences (pp. 5053–5061). Maui, HI: IEEE. Tarafdar, M., & Gordon, S. R. (2007). Understanding the influence of information systems competencies on process innovation: A resource-based view. Journal of Strategic Information Systems, 16, 353–392. https://doi.org/10.1016/j.jsis.2007.09.001. Weske, M. (2012). Business Process Management. Concepts, Languages, Architectures. Second Edition. Berlin Heidelberg: Springer. The research paper passed the review process. | Received: August 27, 2020; Revised: October 15, 2020; Accepted: October 23, 2020; Pre-published online: February 12, 2021; Published in the regular issue: September 20, 2021.