COBIT2019Design Toolkit

Yearly assessment · 2026

P&G Binh Duong Plant

Governance system design flow

From enterprise context to target capability levels

Provide the 10 Design Factors, choose their applicable weights and refine the result in the Canvas. The calculation uses the mapping tables in the COBIT 2019 Design Toolkit workbook.

10Design
factors
40Governance &
Management Objectives
4Target capability
levels

Set the scope

Design Factor weights

0 = not applicable · 1 = fully applicable. A value between 0 and 1 is allowed.

DF1 Enterprise Strategy Importance of each enterprise strategy archetype. 4 criteria

Rate the relative importance from 1 to 5.

DF2 Enterprise Goals Importance of each enterprise goal. 13 criteria

Rate the relative importance from 1 to 5.

DF3 Risk Profile Assess impact and likelihood for each generic I&T risk category. 19 criteria

Rate Impact and Likelihood from 1 (low) to 5 (very high). Risk rating = Impact × Likelihood.

IT investment decision making, portfolio definition & maintenance

Rating 8

Program & projects life cycle management

Rating 4

IT cost & oversight

Rating 16

IT expertise, skills & behavior

Rating 8

Enterprise/IT architecture

Rating 9

IT operational infrastructure incidents

Rating 9

Unauthorized actions

Rating 9

Software adoption/usage problems

Rating 9

Hardware incidents

Rating 10

Software failures

Rating 15

Logical attacks (hacking, malware, etc.)

Rating 20

Third-party/supplier incidents

Rating 6

Noncompliance

Rating 9

Geopolitical Issues

Rating 6

Industrial action

Rating 1

Acts of nature

Rating 4

Technology-based innovation

Rating 4

Environmental

Rating 2

Data & information management

Rating 16
DF4 I&T-Related Issues Rate the severity of each generic I&T-related issue. 20 criteria

Rate the relative importance from 1 to 3.

DF5 Threat Landscape Distribute 100% across the threat landscape levels. 2 criteria
The distribution must total 100%.
DF6 Compliance Requirements Distribute 100% across the compliance requirement levels. 3 criteria
The distribution must total 100%.
DF7 Role of IT Importance of each role of I&T. 4 criteria

Rate the relative importance from 1 to 5.

DF8 Sourcing Model for IT Distribute 100% across I&T sourcing models. 3 criteria
The distribution must total 100%.
DF9 IT Implementation Methods Distribute 100% across implementation methods. 3 criteria
The distribution must total 100%.
DF10 Technology Adoption Strategy Distribute 100% across technology adoption strategies. 3 criteria
The distribution must total 100%.

Steps 2–4

COBIT Design Canvas

Results from the last saved inputs

Initial Scope uses DF1–DF4. Refined Scope uses every Design Factor with a weight. Enter an adjustment from -100 to +100 and explain it when needed.

Concluded priority profile

Compare the final priority of every objective. Bar length is relative to the largest absolute priority; teal is positive and amber is negative.

Highest
Lowest
Spread
    Objective Initial\nscope Refined\nscope Adjustment Reason Concluded\npriority Suggested\ncapability Agreed\ncapability Reason
    EDM01Ensured Governance Framework Setting & Maintenance 30 25 25 Level 2
    EDM02Ensured Benefits Delivery -5 -20 -20 Level 1
    EDM03Ensured Risk Optimization 70 70 70 Level 3
    EDM04Ensured Resource Optimization 10 5 5 Level 1
    EDM05Ensured Stakeholder Engagement 5 15 15 Level 1
    APO01Managed I&T Management Framework 20 15 15 Level 1
    APO02Managed Strategy -40 -55 -55 Level 1
    APO03Managed Enterprise Architecture -15 -15 -15 Level 1
    APO04Managed Innovation -55 -75 -75 Level 1
    APO05Managed Portfolio -20 -40 -40 Level 1
    APO06Managed Budget & Costs 0 -10 -10 Level 1
    APO07Managed Human Resources -35 -35 -35 Level 1
    APO08Managed Relationships 5 -10 -10 Level 1
    APO09Managed Service Agreements 25 -5 -5 Level 1
    APO10Managed Vendors 30 10 10 Level 1
    APO11Managed Quality 40 25 25 Level 2
    APO12Managed Risk 95 80 80 Level 4
    APO13Managed Security 100 100 100 Level 4
    APO14Managed Data 30 20 20 Level 1
    BAI01Managed Programs -45 -60 -60 Level 1
    BAI02Managed Requirements Definition 15 -10 -10 Level 1
    BAI03Managed Solutions Identification & Build 20 -5 -5 Level 1
    BAI04Managed Availability & Capacity -15 -30 -30 Level 1
    BAI05Managed Organizational Change -45 -55 -55 Level 1
    BAI06Managed IT Changes 30 5 5 Level 1
    BAI07Managed IT Change Acceptance and Transitioning 40 10 10 Level 1
    BAI08Managed Knowledge -20 -15 -15 Level 1
    BAI09Managed Assets -15 -10 -10 Level 1
    BAI10Managed Configuration 55 55 55 Level 3
    BAI11Managed Projects -60 -80 -80 Level 1
    DSS01Managed Operations 5 -5 -5 Level 1
    DSS02Managed Service Requests & Incidents 75 70 70 Level 3
    DSS03Managed Problems 55 45 45 Level 2
    DSS04Managed Continuity 60 60 60 Level 3
    DSS05Managed Security Services 70 80 80 Level 4
    DSS06Managed Business Process Controls 20 30 30 Level 2
    MEA01Managed Performance and Conformance Monitoring 25 5 5 Level 1
    MEA02Managed System of Internal Control 30 35 35 Level 2
    MEA03Managed Compliance with External Requirements 70 85 85 Level 4
    MEA04Managed Assurance 25 45 45 Level 2