by Leigh Goessl

Created on: October 13, 2009

The Control Objectives for Information and related Technology (COBIT) is a good framework strategy to help an organization maintain standards and develop a system of IT governance. COBIT is a common methodology used by many companies in order to develop a systematic means to meet compliance laws.

Why COBIT?

COBIT consists of 34 IT processes and is a way for an organization to use in its attempts to "balance risk and control in a cost-effective manner" (Pederiva, 2003). With newer regulations such as SOX, HIPAA and other government imposed laws, compliance is a necessary item for organizations to think about, because the costs associated with non-compliance can come with a high price tag.

These newer legislations have led businesses to have to cope with several quandaries, and many of them are associated with change and the difficulties associated with the task of enacting these changes.

Conforming to new laws and regulations entails a lot of alterations, and it is probable more legislative changes are on the horizon and being prepared by having established control processes can't hurt.

How COBIT Assists with Compliance

As a part of making changes in order for a company to align with the law and be in total compliance, companies can utilize the COBIT Framework; it is a tool that can assist in both internal audits and corrective action.

Using COBIT can help lead businesses towards the path of regulatory compliance because it systematically outlines the steps a business needs to take to be in accordance with legislative constraints.

Fundamentally COBIT's structure offers best practices for users to measure their own business processes. Subsequently they can identify, improve and/or modify any weaknesses in the various IT control areas that are discovered.

COBIT and Internal Controls

In Section 404 of SOX there is a mandate for the creation and maintenance of feasible internal controls when it comes to organizational data and information. Due to this mandate, companies have to test their internal control processes and meet this SOX requirement and pass an external audit.

Since internal controls affect everyone across an organization at all levels, internal auditing, monitoring and control is an ongoing process businesses need to engage in to remain compliant. To continue remaining compliant, this is going to need to be revisited on a regular basis to ensure conformity to laws and regulations.

When faults are found, the company will need to take corrective action,

• 1
• 2
• Next Page >>