Committee of Sponsoring Organizations of The Treadway Commission Formed in 1985 to sponsor the National Commission on Fraudulent Financial Reporting “Internal Control - Integrated Framework” (1992) designed to help organizations monitor the quality of their internal control systems.

Figure 1.2 COSO Internal Control - Integrated Framework

Recognized for providing guidance on organizational governance, business ethics, internal control, enterprise risk management, fraud, and financial reporting. Guides executive management and governance entities to become more effective, efficient, and ethical business operations. Accepted as internal control framework for enterprises. The framework identifies and describes five interrelated components necessary for effective internal control.

Control Objectives for Information and related Technology (COBIT®) Accepted as internal control framework for IT. Provides a process framework and presents activities in a manageable and logical structure that will optimize IT-enabled investments, ensure service delivery and provide a benchmark to measure performance against.

“COBIT framework principle(figure 5): to provide the information that the enterprise requires to achieve its objectives, the enterprise needs to manage and control IT resources using a structured set of processes to deliver the required information services. “ COBIT is a process model that subdivides IT into 34 processes in line with the responsibility areas of plan, build, run and monitor, providing an end-to-end view of IT. CobIT’s Information Criteria – Effectiveness – Efficiency – Confidentiality – Availability – Compliant – Reliability

Business & IT Goals – Business Requirements – Governance Requirements – Information Criteria – Information Services IT Resources – Applications -automated user systems and manual procedures – Information –data input, processed, & output by information systems – Infrastructure -technology and facilities – People -personnel needed to plan, organize, acquire, implement, deliver, support, monitor & evaluate information systems & services.

P L A N & O R G A N I Z E Define a Strategic IT Plan Define the Information Architecture Determine Technological Direction Define the IT Processes, Organization and Relationships Manage the IT Investment Communicate Management Aims and Direction Manage IT Human Resources Manage Quality Assess and Manage IT Risks Manage Projects A C Q U I R E & I M P L E M E N T Identify Automated Solutions Acquire and Maintain Application Software Acquire and Maintain Technology Infrastructure Enable Operation and Use Procure IT Resources Manage Changes Install and Accredit Solutions and Changes D E L I V E R & S U P P O R T Define and Manage Service Levels Manage Third-party Services Manage Performance and Capacity Ensure Continuous Service Ensure Systems Security Identify and Allocate Costs Educate and Train Users Manage Service Desk and Incidents Manage the Configuration Manage Problems, Data, and Physical Environment M O N I T O R & E VA L U A T E ME1 Monitor and Evaluate IT Performance ME2 Monitor and Evaluate Internal Control ME3 Ensure Regulatory Compliance ME4 Provide IT Governance

Goals & Metrics Key Goal Indicators Key Performance Indicators