Тhe IT Governance Institute (ITGITM)

The IT Governance Institute®

The IT Governance Institute (ITGITM) (www.itgi.org) was established in 1998 to advance international thinking and standards in

directing and controlling an enterprise’s information technology. Effective IT governance helps ensure that IT supports business

goals, optimises business investment in IT, and appropriately manages IT-related risks and opportunities. ITGI offers original

research, electronic resources and case studies to assist enterprise leaders and boards of directors in their IT governance

responsibilities.

Disclaimer

ITGI (the “Owner”) has designed and created this publication, titled COBIT® 4.1 (the “Work”), primarily as an educational resource

for chief information officers (CIOs), senior management, IT management and control professionals. The Owner makes no claim

that use of any of the Work will assure a successful outcome. The Work should not be considered inclusive of any proper

information, procedures and tests or exclusive of other information, procedures and tests that are reasonably directed to obtaining

the same results. In determining the propriety of any specific information, procedure or test, CIOs, senior management, IT

management and control professionals should apply their own professional judgement to the specific circumstances presented by

the particular systems or IT environment.

Disclosure

© 1996-2007 IT Governance Institute. All rights reserved. No part of this publication may be used, copied, reproduced, modified,

distributed, displayed, stored in a retrieval system, or transmitted in any form by any means (electronic, mechanical, photocopying,

recording or otherwise), without the prior written authorisation of ITGI. Reproduction of selections of this publication, for internal

and non-commercial or academic use only, is permitted and must include full attribution of the material’s source. No other right or

permission is granted with respect to this work.

IT Governance Institute

3701 Algonquin Road, Suite 1010

Rolling Meadows, IL 60008 USA

Phone: +1.847.590.7491

Fax: +1.847.253.1443

E-mail: info@itgi.org

Web site: www.itgi.org

COBIT® 4.1

Printed in the United States of America

ACKNOWLEDGEMENTS

IT Governance Institute wishes to recognise:

Expert Developers and Reviewers

Mark Adler, CISA, CISM, CIA, CISSP, Allstate Ins. Co., USA

Peter Andrews, CISA, CITP, MCMI, PJA Consulting, UK

Georges Ataya, CISA, CISM, CISSP, MSCS, PBA, Solvay Business School, Belgium

Gary Austin, CISA, CIA, CISSP, CGFM, KPMG LLP, USA

Gary S. Baker, CA, Deloitte & Touche, Canada

David H. Barnett, CISM, CISSP, Applera Corp., USA

Christine Bellino, CPA, CITP, Jefferson Wells, USA

John W. Beveridge, CISA, CISM, CFE, CGFM, CQA, Massachusetts Office of the State Auditor, USA

Alan Boardman, CISA, CISM, CA, CISSP, Fox IT, UK

David Bonewell, CISA, CISSP-ISSEP, Accomac Consulting LLC, USA

Dirk Bruyndonckx, CISA, CISM, KPMG Advisory, Belgium

Don Canilglia, CISA, CISM, USA

Luis A. Capua, CISM, Sindicatura General de la Nación, Argentina

Boyd Carter, PMP, Elegantsolutions.ca, Canada

Dan Casciano, CISA, Ernst & Young LLP, USA

Sean V. Casey, CISA, CPA, USA

Sushil Chatterji, Edutech, Singapore

Ed Chavennes, Ernst & Young LLP, USA

Christina Cheng, CISA, CISSP, SSCP, Deloitte & Touche LLP, USA

Dharmesh Choksey, CISA, CPA, CISSP, PMP, KPMG LLP, USA

Jeffrey D. Custer, CISA, CPA, CIA, Ernst & Young LLP, USA

Beverly G. Davis, CISA, Federal Home Loan Bank of San Francisco, USA

Peter De Bruyne, CISA, Banksys, Belgium

Steven De Haes, University of Antwerp Management School, Belgium

Peter De Koninck, CISA, CFSA, CIA, SWIFT SC, Belgium

Philip De Picker, CISA, MCA, National Bank of Belgium, Belgium

Kimberly de Vries, CISA, PMP, Zurich Financial Services, USA

Roger S. Debreceny, Ph.D., FCPA, University of Hawaii, USA

Zama Dlamini, Deloitte & Touche LLP, South Africa

Rupert Dodds, CISA, CISM, FCA, KPMG, New Zealand

Troy DuMoulin, Pink Elephant, Canada

Bill A. Durrand, CISA, CISM, CA, Ernst & Young LLP, Canada

Justus Ekeigwe, CISA, MBCS, Deloitte & Touche LLP, USA

Rafael Eduardo Fabius, CISA, Republica AFAP S.A., Uruguay

Urs Fischer, CISA, CIA, CPA (Swiss), Swiss Life, Switzerland

Christopher Fox, ACA, PricewaterhouseCoopers, USA

Bob Frelinger, CISA, Sun Microsystems Inc., USA

Zhiwei Fu, Ph. D, Fannie Mae, USA

Monique Garsoux, Dexia Bank, Belgium

Edson Gin, CISA, CFE, SSCP, USA

Sauvik Ghosh, CISA, CIA, CISSP, CPA, Ernst & Young LLP, USA

Guy Groner, CISA, CIA, CISSP, USA

Erik Guldentops, CISA, CISM, University of Antwerp Management School, Belgium

Gary Hardy, IT Winners, South Africa

Jimmy Heschl, CISA, CISM, KPMG, Austria

Benjamin K. Hsaio, CISA, Federal Deposit Insurance Corp., USA

Tom Hughes, Acumen Alliance, Australia

Monica Jain, CSQA, Covansys Corp., US

Wayne D. Jones, CISA, Australian National Audit Office, Australia

John A. Kay, CISA, USA

Lisa Kinyon, CISA, Countrywide, USA

Rodney Kocot, Systems Control and Security Inc., USA

Luc Kordel, CISA, CISM, CISSP, CIA, RE, RFA, Dexia Bank, Belgium

Linda Kostic, CISA, CPA, USA

John W. Lainhart IV, CISA, CISM, IBM, USA

ACKNOWLEDGEMENTS

I T G O V E R N A N C E I N S T I T U T E 1

Philip Le Grand, Capita Education Services, UK.

Elsa K. Lee, CISA, CISM, CSQA, AdvanSoft International Inc., USA

Kenny K. Lee, CISA, CISSP, Countrywide SMART Governance, USA

Debbie Lew, CISA, Ernst & Young LLP, USA

Donald Lorete, CPA, Deloitte & Touche LLP, USA

Addie C.P. Lui, MCSA, MCSE, First Hawaiian Bank, USA

Debra Mallette, CISA, CSSBB, Kaiser Permanente, USA

Charles Mansour, CISA, Charles Mansour Audit & Risk Service, UK

Mario Micallef, CPAA, FIA, National Australia Bank Group, Australia

Niels Thor Mikkelsen, CISA, CIA, Danske Bank, Denmark

John Mitchell, CISA, CFE, CITP, FBCS, FIIA, MIIA, QiCA, LHS Business Control, UK

Anita Montgomery, CISA, CIA, Countrywide, USA

Karl Muise, CISA, City National Bank, USA

Jay S. Munnelly, CISA, CIA, CGFM, Federal Deposit Insurance Corp., USA

Sang Nguyen, CISA, CISSP, MCSE, Nova Southeastern University, USA

Ed O’Donnell,

...