Financial Services/Insurance
|
|
How Used? |
Why COBIT? |
|
National Stock Exchange (NSE) of India Limited
January 2012
|
NSE’s risk management framework was developed based on Risk IT, a component of COBIT. Due to the criticality of NSE’s business operations—and the frequent changes in its IT infrastructure—the decision was made to focus on risk management as an integral element of its day-to-day business processes. NSE concluded that changes in risk need to be tracked on an ongoing basis and defined a monitoring process for continuous updating of changes in the risk profile. |
- Risk IT provided control objectives to identify control gaps and to assess the impact of controls on the risk profile.
- Risk IT helped NSE build a uniform structure and view of IT risk across the organization.
- Risk IT provided a granular guidance on risk management processes.
- Risk IT helped to link IT risk with business objectives.
|
|
|
Grupo Bancolombia
January 2011
|
Grupo Bancolombia used COBIT to create a shared vision, unique language, alignment between business strategic planning and IT strategic planning, and clarity in roles and responsibilities. |
- Is used worldwide by auditors to verify adherence to and compliance with IT internal controls
- Helps to ensure compliance with the US Sarbanes-Oxley Act and other global legislation
- Provides a proactive approach to improving technology processes and services
|
|
|
Banco Supervielle S.A.
November 2010
(Spanish)
|
Banco Supervielle S.A. used COBIT to create an IT governance framework that enabled the bank to provide training and awareness of internal controls and best practices; to redefine roles, responsibilities and IT internal processes; to implement a control dashboard; and to initiate risk administration. |
- Recommended by the local ISACA chapter
- Most closely matched the bank’s needs
- Facilitated the bank in measuring its current maturity level, its desired maturity level and estimated time to achieve it
|
|
|
MetLife
August 2010
|
Leveraged Risk IT to create a MetLife-specific IT risk management framework that allows management to consider all aspects of managing IT risk consistently across the enterprise and better connect it to business operational risk activities. |
- COBIT is a globally accepted source of best practices.
- Risk IT’s structure and contents are easily digested by risk professionals
- Plan to use the MetLife IT Risk Framework (based on ISACA’s Risk IT) to perform a process maturity analysis on an annual basis
|
|
|
A global bank
July 2010 |
A global bank used COBIT successfully to provide a common language for multiple technology and business teams, streamline the company’s list of controls, and manage risk and control process for Sarbanes-Oxley and other regulations. |
- COBIT provided a common governance and assurance process across technology teams.
- COBIT helped in developing and managing a single list of controls for each type of risk.
- COBIT provided confidence to senior executives on the reporting and attestation process.
|
|
|
Blue Cross and Blue Shield of North Carolina
And
IBM Business Consulting
October 2009 |
When developing a program that addressed Sarbanes-Oxley, the team realized that they needed the COBIT control framework because it allows them to “own” their IT controls. |
- COBIT is the only IT management and control framework that covers the end-to-end IT life cycle.
- COBIT maps 100% to COSO.
|
|
|
|
Central Bank of the Republic of Armenia
February 2009
|
The IT audit division uses COBIT when performing audits, and risk assessments are conducted according to COBIT processes. |
- The board selected COBIT after conducting global research and finding that COBIT was well known and internationally respected.
|
|
|
ICW Group
January 2009 |
ICW Group’s CIO presented the Val IT tool set from ISACA to senior management as the most effective way to both mature the organization and deliver high-quality solutions. |
- Val IT is helping the organization achieve ambitious goals by enabling it to make smart decisions that deliver the best business value.
- Val IT’s proven practices provide practical guidance that helps it reduce costs and increase control.
|
|
|
Pension–Fennia
October 2008
|
Pension–Fennia used COSO ERM and COBIT to maximize its effectiveness and optimize the maturity of its controls. By using this combined approach, the organization was able to clarify the mutual goals and responsibilities of its business units and IT. |
- To use COBIT’s maturity approach as a complement to COSO ERM
- To deepen the synergy and mutual understanding between business units and IT, and between IT and its service providers.
|
|
|
Kuwait Turk Participation Bank
April 2007
|
Kuwait Turk initially implanted COBIT to comply with requirements set by the Banking Regulation and Supervision Agency of Turkey (BRSA), but soon realized that the use of COBIT provided many additional benefits, including more controlled and integrated IT processes. |
- Came highly recommended
- Internationally accepted and easily maps to other leading standards
|
|
|
Canadian Tire Financial Services, Ltd.
February 2007
|
COBIT helped communicate to IT and management why they needed to care about effective controls and provide a framework for implementation. |
- COBIT was selected as the framework with which to comply because its control objectives are internationally recognized and considered to be effective at controlling IT-related processes
|
|
|
Prudential, Asia
September 2006 |
The adoption of COBIT was supported by Prudential’s CEO and board members. COBIT has helped Prudential’s Asia IT team achieve enhanced communication between IT and business operations and responsiveness in project management |
- Helped provide a uniformed platform to sustain growth and eliminate risks
|