IT governance and strategy
Structure, business alignment, decision rights, steering bodies, responsibilities, performance measures, investment oversight and board reporting.
IT Audit | IT Governance | COBIT 2019
IT Audit & COBIT Governance Assessment
Independent evaluation of IT governance, technology processes, internal controls and risk management using COBIT 2019 and internationally recognized IT audit practices.
Independent IT audit and COBIT governance assessment can be commissioned separately or together. We agree the criteria, scope and deliverables before work begins.
Why IT Audit and Governance Matter
Weak governance can leave technology decisions disconnected from business priorities. Independent audit tests defined controls against evidence; a governance assessment identifies how decisions, accountability and resources can improve.
- Business and IT objectives become misaligned
- Technology risks lack ownership or escalation
- Investment and resource decisions lack oversight
- Operational disruption and uncontrolled change increase exposure
- Security controls and supplier dependencies remain unclear
- Compliance gaps and weak reporting hinder management decisions
IT Audit Scope
We select audit domains according to your environment, risk profile and agreed criteria. Application-control testing and sample sizes depend on the engagement scope.
IT risk management
Risk identification, methodology, register, ownership, appetite, treatment, indicators, reporting and escalation.
IT general controls
Logical and privileged access, provisioning, segregation of duties, changes, operations, backups, monitoring, scheduling and configuration.
IT service management
Incidents, problems, requests, change enablement, service levels, assets, configuration, capacity, availability and continuity.
Infrastructure and cloud governance
Architecture, servers, networks, cloud controls, baselines, patches, vulnerabilities, backups, monitoring and hosting dependencies.
Application and system controls
Access, changes, integrations, processing integrity, input and output, logs, exceptions and critical application controls.
Cybersecurity governance
Security policies, identity, monitoring, incident readiness, vulnerabilities, supplier security, awareness and risk reporting.
Continuity and disaster recovery
Critical IT services, BIA dependencies, recovery objectives, plans, backups, restoration tests and crisis escalation. IT recovery is distinct from enterprise continuity.
Third-party governance
Due diligence, contracts, service levels, security obligations, performance, concentration risk, exit plans and incident arrangements.
Projects and change governance
Prioritization, project risk, development lifecycle, releases, testing, acceptance, production controls and post-implementation review.
IT Governance Assessment Using COBIT 2019
COBIT 2019 is ISACA's framework for enterprise governance and management of information and technology. We select relevant objectives across five domains; the examples below describe our assessment questions, evidence and decision value, rather than reproducing COBIT practices.
EDM · Evaluate, Direct and Monitor
Are benefits, risks and resources actively governed? Board decisions, investment records and performance reports show whether oversight works. EDM04 provides a focused example of resource optimization.
APO · Align, Plan and Organize
Do strategy, architecture, portfolio, budgets, people, vendors, quality, risk, security and data plans support business priorities? Strategies, budgets and risk records reveal alignment gaps.
BAI · Build, Acquire and Implement
Are requirements, projects, solutions, changes, assets and transition controlled? Approvals, test evidence and release records show whether delivery risk is managed.
DSS · Deliver, Service and Support
Are operations, requests, incidents, problems, continuity, security services and business-process controls effective? Tickets, service reports and recovery evidence reveal operational reliability.
MEA · Monitor, Evaluate and Assess
Are performance, internal controls, external obligations and assurance monitored? Dashboards, audit reports and remediation tracking show whether management can act on issues.
IT Process Capability and Performance Assessment
Where a formal capability assessment is agreed, selected COBIT objectives are assessed with a defined methodology and sufficient evidence. The applicable COBIT performance model uses levels 0–5. We identify a justified current level, a business-relevant target and the gap between them; we do not rate every objective by default.
- Select objectives and organizational priorities
- Review implemented practices and control evidence
- Determine current and target capability where supported
- Prioritize gaps and improvement actions
Our IT Audit and COBIT Assessment Approach
Six transparent stages connect agreed criteria with evidence and practical decisions.
- 01
Planning and scope
Agree objectives, environment, risks, criteria and boundaries.
- 02
Risk assessment and objective selection
Select relevant COBIT objectives and risk-based audit priorities.
- 03
Evidence review
Examine policies, procedures, governance records, configurations, inventories and reports.
- 04
Interviews and control testing
Interview owners and test design and operating effectiveness as appropriate.
- 05
Findings and capability
Identify deficiencies, governance gaps and risks; assess capability only where agreed.
- 06
Reporting and roadmap
Deliver the scoped report, recommendations, priorities and follow-up options.
Required Evidence and Client Involvement
Evidence and interviews are tailored to the agreed scope; no organization is expected to supply every item below. We normally speak with relevant executives, IT and security leaders, operations and application owners, risk and compliance, internal audit and supplier managers.
- IT structure, strategy and governance records
- Policies, procedures and risk registers
- System and asset inventories; access and change records
- Incident, problem and service-level reports
- Supplier contracts and outsourcing registers
- Backups, recovery tests, project and management reports
Audit Deliverables
The contract and agreed scope determine which deliverables are included. A formal capability rating or follow-up review is provided only when specifically commissioned.
Independent IT audit report
Scope, criteria, method, evidence, risk-rated findings and conclusions.
COBIT governance assessment
Selected objectives, gaps and improvement opportunities.
IT control matrix
Evaluated controls mapped to criteria and relevant objectives.
Process capability assessment
Current and target levels when formally included.
Risk-based findings register
Risk, cause, impact and recommended action.
Corrective action plan
Priorities, proposed owners and target dates.
Executive summary
Key issues, strategic implications and decisions.
Optional follow-up
Independent review of remediation progress.
Business Value of IT Audit
The assessment can improve visibility and decision quality; it cannot eliminate all risk or confer certification.
- Technology-risk visibility and clearer accountability
- Stronger governance and investment decisions
- More reliable operations and effective controls
- Better regulatory readiness and resource use
- Greater resilience and clearer executive reporting
Who Is This Service For?
The scope can be tailored to regulated institutions and organizations with complex technology dependencies.
- Banks, financial institutions, FinTechs and payment providers
- Insurers and energy or utility operators
- Telecommunications and public-sector organizations
- Healthcare organizations and medium or large enterprises
- Organizations undertaking digital transformation
How This Relates to Other Frameworks
COBIT is a governance and management framework, not an ISO certification standard. A COBIT assessment is not automatically an ISO certification audit. Depending on scope, findings may complement ISO/IEC 27001:2022, ISO/IEC 20000-1:2018, ISO 22301, NIST CSF 2.0, ITIL 4, applicable NBG cybersecurity requirements and contractual duties.
Frequently asked questions
What is an IT audit?
An IT audit evaluates specified technology processes and controls against agreed criteria using evidence and testing. Its scope and conclusion are documented in the engagement.
What is COBIT 2019?
COBIT 2019 is ISACA's framework for enterprise governance and management of information and technology. We use selected objectives relevant to your priorities.
How does IT audit differ from a COBIT governance assessment?
IT audit tests defined controls and risks against audit criteria. A COBIT assessment considers governance and management objectives and improvement opportunities. They may be separate or combined.
What does an IT general controls audit cover?
Depending on scope, it may cover access, segregation of duties, change management, IT operations, backups, monitoring and configuration controls.
What are COBIT capability levels?
Under the applicable COBIT performance model, levels run from 0 to 5. A formal rating requires a defined method and sufficient evidence; it is not included automatically.
How long does an IT audit take?
Timing depends on systems, locations, evidence availability, testing depth and agreed deliverables. We estimate it after scoping rather than promise a fixed duration.
What evidence is required?
Typical evidence includes policies, risk records, system inventories, access and change logs, incidents, supplier records and recovery tests. The exact request is limited to the agreed scope.
Can we assess only selected COBIT objectives?
Yes. We select objectives based on business priorities, risks and engagement boundaries. An assessment does not automatically cover every COBIT objective.
Does a COBIT assessment lead to certification?
No. COBIT is not an ISO certification standard. The assessment provides findings and recommendations, not a COBIT or ISO certificate.
What happens after the report?
Management can prioritize remediation, assign owners and monitor progress. If contracted separately, we can perform an independent follow-up assessment.
Strengthen Your IT Governance and Control Environment
Request an independent IT audit or a COBIT 2019-based governance assessment. We will define the scope, identify control gaps and agree on a practical improvement roadmap.
Request an IT Audit