Financial Services/Insurance |
|
Enterprise Date |
How Used? |
Why COBIT? |
|
Anonymous
April 2013
|
This bank chose COBIT 4.1 to address a great deal of challenges it was facing with day-to-day IT service delivery. The project was bundled with a security assessment exercise. The project kicked off with an assessment, which was documented using the COBIT 4.1 Implementation Tool Kit. Following the determination of business and IT goals, the core of the gap assessment exercise commenced. The focus was on the 34 processes, not on the 210 controls. Several interviews and process review sessions then followed from Plan and Organize (PO) all the way to Monitor and Evaluate (ME), although not necessarily in order as sessions were based on available resources. |
- COBIT 4.1 provided the most rounded approach to achieving the desired outcomes.
|
|
|
TT Hellenic Postbank
October 2012
|
TT Hellenic Postbank’s IT audit function uses COBIT 4.1 to define the audit universe on which IT audits are performed, to create tactical and strategic risk-based audit plans and to conduct audit engagements. |
- COBIT is a widely accepted international IT governance framework.
- COBIT 4.1’s maturity model and detailed control objectives allow for a clearer understanding of the current level of effectiveness and control over IT processes.
- COBIT helped to easily customized the solution for the needs of each organization and mapped with other commonly accepted assurance frameworks.
|
|
|
Scotiabank (BNS), Costa Rica
July 2012
|
In 2009, COBIT 4.0 implementation became mandatory for financial entities in Costa Rica. Since then,COBIT 4.0 has been used as the overall guidance framework to achieve a third level of maturity for each identified COBIT process. BNS Costa Rica met compliance with this regulation by creating a route plan to achieve control objectives: implementing good IT governance practices and controls; executing independent external audits, led by CISA-certified professionals; and providing COBIT and IT governance training to strengthen the knowledge of personnel participating in the implementation process. |
- COBIT helped to achieve a stronger alignment among business and IT strategies.
- COBIT helped in the creation of processes with internationally accepted, auditable and measurable structures that integrate the best practices in the banking industry.
- COBIT assisted the organization with key controls identification to ensure internal IT control.
- COBIT proved useful in the creation of reliable processes to strengthen the application of practices related to the five elements of control that constitute good IT governance.
|
|
|
National Stock Exchange (NSE) of India Limited
January 2012
|
NSE’s risk management framework was developed based on Risk IT, a component of COBIT. Due to the criticality of NSE’s business operations—and the frequent changes in its IT infrastructure—the decision was made to focus on risk management as an integral element of its day-to-day business processes. NSE concluded that changes in risk need to be tracked on an ongoing basis and defined a monitoring process for continuous updating of changes in the risk profile. |
- Risk IT provided control objectives to identify control gaps and to assess the impact of controls on the risk profile.
- Risk IT helped NSE build a uniform structure and view of IT risk across the organization.
- Risk IT provided a granular guidance on risk management processes.
- Risk IT helped to link IT risk with business objectives.
|
|
|
Grupo Bancolombia
January 2011
|
Grupo Bancolombia used COBIT to create a shared vision, unique language, alignment between business strategic planning and IT strategic planning, and clarity in roles and responsibilities. |
- Is used worldwide by auditors to verify adherence to and compliance with IT internal controls
- Helps to ensure compliance with the US Sarbanes-Oxley Act and other global legislation
- Provides a proactive approach to improving technology processes and services
|
|
|
Banco Supervielle S.A.
November 2010
(Spanish)
|
Banco Supervielle S.A. used COBIT to create an IT governance framework that enabled the bank to provide training and awareness of internal controls and best practices; to redefine roles, responsibilities and IT internal processes; to implement a control dashboard; and to initiate risk administration. |
- Recommended by the local ISACA chapter
- Most closely matched the bank’s needs
- Facilitated the bank in measuring its current maturity level, its desired maturity level and estimated time to achieve it
|
|
|
MetLife
August 2010
|
Leveraged Risk IT to create a MetLife-specific IT risk management framework that allows management to consider all aspects of managing IT risk consistently across the enterprise and better connect it to business operational risk activities. |
- COBIT is a globally accepted source of best practices.
- Risk IT’s structure and contents are easily digested by risk professionals
- Plan to use the MetLife IT Risk Framework (based on ISACA’s Risk IT) to perform a process maturity analysis on an annual basis
|
|
|
A global bank
July 2010 |
A global bank used COBIT successfully to provide a common language for multiple technology and business teams, streamline the company’s list of controls, and manage risk and control process for Sarbanes-Oxley and other regulations. |
- COBIT provided a common governance and assurance process across technology teams.
- COBIT helped in developing and managing a single list of controls for each type of risk.
- COBIT provided confidence to senior executives on the reporting and attestation process.
|
|
|
Blue Cross and Blue Shield of North Carolina
And
IBM Business Consulting
October 2009 |
When developing a program that addressed Sarbanes-Oxley, the team realized that they needed the COBIT control framework because it allows them to “own” their IT controls. |
- COBIT is the only IT management and control framework that covers the end-to-end IT life cycle.
- COBIT maps 100% to COSO.
|
|
|
Central Bank of the Republic of Armenia
February 2009
|
The IT audit division uses COBIT when performing audits, and risk assessments are conducted according to COBIT processes. |
- The board selected COBIT after conducting global research and finding that COBIT was well known and internationally respected.
|
|
|
ICW Group
January 2009 |
ICW Group’s CIO presented the Val IT tool set from ISACA to senior management as the most effective way to both mature the organization and deliver high-quality solutions. |
- Val IT is helping the organization achieve ambitious goals by enabling it to make smart decisions that deliver the best business value.
- Val IT’s proven practices provide practical guidance that helps it reduce costs and increase control.
|
|
|
Pension–Fennia
October 2008
|
Pension–Fennia used COSO ERM and COBIT to maximize its effectiveness and optimize the maturity of its controls. By using this combined approach, the organization was able to clarify the mutual goals and responsibilities of its business units and IT. |
- To use COBIT’s maturity approach as a complement to COSO ERM
- To deepen the synergy and mutual understanding between business units and IT, and between IT and its service providers.
|
|
|
Kuwait Turk Participation Bank
April 2007
|
Kuwait Turk initially implanted COBIT to comply with requirements set by the Banking Regulation and Supervision Agency of Turkey (BRSA), but soon realized that the use of COBIT provided many additional benefits, including more controlled and integrated IT processes. |
- Came highly recommended
- Internationally accepted and easily maps to other leading standards
|
|
|
Canadian Tire Financial Services, Ltd.
February 2007
|
COBIT helped communicate to IT and management why they needed to care about effective controls and provide a framework for implementation. |
- COBIT was selected as the framework with which to comply because its control objectives are internationally recognized and considered to be effective at controlling IT-related processes
|
|
|
Prudential, Asia
September 2006 |
The adoption of COBIT was supported by Prudential’s CEO and board members. COBIT has helped Prudential’s Asia IT team achieve enhanced communication between IT and business operations and responsiveness in project management. |
- Helped provide a uniformed platform to sustain growth and eliminate risks
|