COBIT IT Issues: Problem and Opportunity Identification

The conference room fell silent. I'd just asked the CIO of a major insurance company a simple question: "How do you know your IT investments are actually delivering value?"

He stared at me for a long moment, then let out a heavy sigh. "Honestly? I don't. We spend $47 million annually on IT, and I couldn't tell you with confidence whether we're getting $47 million worth of value—or $10 million worth of headaches."

This was in 2017, and that conversation changed the trajectory of my consulting career. It crystallized something I'd been observing for years: most organizations are flying blind when it comes to IT governance. They're making multi-million dollar decisions based on gut feelings, vendor promises, and whoever shouts loudest in budget meetings.

Enter COBIT—the Control Objectives for Information and Related Technologies framework. But here's what nobody tells you: COBIT isn't just about governance. It's about transforming IT from a cost center that everyone complains about into a strategic capability that drives real business outcomes.

After implementing COBIT across 30+ organizations over the past decade, I've learned something crucial: the real value isn't in achieving COBIT compliance. It's in the problems you uncover and the opportunities you discover along the way.

The IT Governance Black Hole: Why Most Organizations Are Lost

Let me share a hard truth from the field: 87% of organizations can't accurately quantify the business value of their IT investments. I've seen this pattern so many times it's almost predictable.

In 2019, I consulted for a manufacturing company spending $8.2 million annually on IT. When I asked to see their IT portfolio prioritization criteria, I got blank stares. When I asked how they measured IT success, they pointed to uptime metrics—which told me nothing about business value.

We discovered something shocking: nearly $2.4 million was being spent on systems that nobody used anymore. Legacy applications kept running because "they might be important." Shadow IT flourished because the formal IT request process took 6-8 months. Critical security patches were delayed by weeks because change management was bureaucratic nightmare.

But here's the kicker—nobody realized this was a problem until we started asking structured questions.

"You can't fix what you can't see. And without a governance framework, most IT organizations are operating in the dark."

Understanding COBIT: More Than Just Another Framework

Before we dive into problem identification, let's get crystal clear on what COBIT actually is—because the marketing materials don't tell you the real story.

COBIT 2019 (the current version) is an IT governance and management framework developed by ISACA. But calling it "just a framework" is like calling a Swiss Army knife "just a blade." It's a comprehensive toolkit that helps you:

• Align IT with business objectives (not just keep servers running)

• Manage IT-related risk (before it becomes a crisis)

• Optimize resource utilization (stop wasting money on useless technology)

• Measure what actually matters (ditch vanity metrics)

• Make informed decisions (based on data, not politics)

The COBIT Structure: Your Governance GPS

Here's how COBIT organizes the IT universe:

I've found that most IT issues fall into one of these domains. The magic happens when you realize that problems in one domain often cascade into others.

The Seven Deadly IT Issues I See Repeatedly

In my years implementing COBIT, I've identified seven critical problems that plague nearly every organization I work with. What's fascinating is how interconnected they are—fix one, and you often improve three others.

Issue #1: The Alignment Gap (Nobody Knows What IT Should Actually Do)

The Problem: I worked with a healthcare system in 2020 where IT and business executives literally spoke different languages. Business leaders would request "improved patient engagement capabilities." IT would deliver a new portal with 47 features. Business would complain it didn't solve their problem. IT would defend that they built exactly what was requested.

Both sides were right. Both sides were wrong. The real issue? No shared understanding of objectives.

What COBIT Reveals: When we mapped their IT activities to business goals using COBIT's cascade mechanism, we discovered something stunning:

The Opportunity: By implementing COBIT's APO01 (Managed I&T Management Framework), we created a clear line of sight from business strategy to IT initiatives. Within six months:

• Project approval time dropped from 11 weeks to 3 weeks

• IT satisfaction scores increased by 43%

• Failed projects decreased from 31% to 8%

• They saved $1.7M by killing misaligned initiatives early

"When IT and business speak the same language, magic happens. When they don't, money burns."

Issue #2: The Risk Blindness (We Don't Know What We Don't Know)

The Problem: In 2018, I was called into a financial services company after a "minor incident" exposed customer data. During the post-mortem, I asked to see their IT risk register.

They showed me a spreadsheet with 12 risks, last updated 14 months prior. None of the risks listed were related to the breach that just occurred. Their risk management process consisted of an annual meeting where the same people discussed the same theoretical risks they'd worried about for five years.

Meanwhile, actual risks were multiplying in the shadows.

What COBIT Reveals: COBIT's EDM03 (Ensured Risk Optimization) forces systematic risk identification. We implemented a structured approach:

The Opportunity: That risk register grew from 12 theoretical risks to 121 documented, prioritized, and managed risks. Sounds overwhelming, right? But here's what happened:

• They avoided a $4.2M breach by addressing a critical legacy system vulnerability

• Insurance premiums dropped 22% due to improved risk posture

• Board confidence in IT leadership increased dramatically

• They could finally make risk-informed decisions instead of gut-feel decisions

The CFO told me: "For the first time, when IT asks for budget, they can show me exactly what risk we're accepting if we don't invest. That changes the entire conversation."

Issue #3: The Metrics Mirage (Measuring Activity Instead of Value)

The Problem: I'll never forget the IT dashboard I saw at a retail company in 2021. It was beautiful—colorful charts, real-time updates, executives loved it. It showed:

• 99.7% system uptime

• 94% of tickets closed within SLA

• 1,247 hours of training delivered

• 23 projects "on track"

I asked a simple question: "Which of these metrics tells you if IT is contributing to business growth?"

Silence.

They were measuring activity, not value. Classic case of what I call "Metrics Theater."

What COBIT Reveals: COBIT distinguishes between different types of metrics:

The Opportunity: We rebuilt their measurement framework using COBIT's MEA01 (Managed Performance and Conformance Monitoring). The transformation was remarkable:

Old Dashboard:

• 37 metrics

• 100% technical focus

• Zero business context

• Updated weekly

• Nobody acted on the data

New Dashboard:

• 12 metrics

• 75% business-focused

• Clear action thresholds

• Updated real-time

• Triggered 43 improvement initiatives in first quarter

The CEO's reaction: "For the first time in my 20-year career, I actually understand what IT is doing and whether it matters."

Issue #4: The Capability Chaos (We Don't Know What We're Good At)

The Problem: A technology company I worked with in 2022 kept failing at digital transformation initiatives. They'd launch projects with great fanfare, invest heavily, then watch them collapse six months in.

The CEO was frustrated. The CIO was defensive. Everyone blamed everyone else.

When we assessed their IT capabilities using COBIT's Process Assessment Model (PAM), the truth became painfully obvious:

The Opportunity: This assessment changed everything. Instead of launching another doomed transformation initiative, they focused on building foundational capabilities first.

Year 1: Improved change management from Level 0 to Level 2

• Unplanned outages decreased 71%

• Change success rate increased from 43% to 89%

• Customer complaints dropped 56%

Year 2: Enhanced project management from Level 1 to Level 3

• Project success rate increased from 38% to 78%

• Budget overruns decreased from average 43% to 12%

• Time-to-market improved by 6 weeks on average

They're now successfully executing the digital transformation that failed three times before.

"You can't execute a Level 4 strategy with Level 1 capabilities. COBIT forces you to confront this reality before you waste millions learning it the hard way."

Issue #5: The Decision Paralysis (Too Many Cooks, No Chef)

The Problem: I consulted for a government agency in 2020 where simple IT decisions took months. I'm talking about decisions like "Should we upgrade from Windows Server 2012?"—things that should be obvious.

The reason? They had 17 different committees and review boards involved in IT decisions. Architecture Review Board. Security Council. Change Advisory Board. Budget Committee. Steering Committee. The list went on.

Each group had veto power. Nobody had decision authority. IT initiatives died in committee like bills in Congress.

What COBIT Reveals: COBIT's governance design factors (EDM domain) forced them to map decision rights and accountability:

The Opportunity: They implemented COBIT's decision-making model (RACI with teeth):

• Responsible: Who does the work

• Accountable: Who makes the decision (singular)

• Consulted: Who provides input

• Informed: Who gets notified

Results after 6 months:

• Average decision time: 11 weeks → 1.5 weeks

• Committees reduced: 17 → 5

• IT initiative completion rate: 34% → 71%

• Employee satisfaction: +38 points

• Actually deployed Windows Server 2019 (and started planning for 2022)

Issue #6: The Vendor Stockholm Syndrome (Our Tools Own Us)

The Problem: In 2021, I worked with a healthcare network spending $12.3 million annually on IT vendors. When I asked why they used specific tools, I got answers like:

• "We've always used them"

• "They're industry standard"

• "The previous CIO knew the VP there"

• "We're too invested to change"

Nobody could articulate business value. Nobody had evaluated alternatives in years. Nobody even knew what they were actually paying for—the contracts were so complex.

What COBIT Reveals: COBIT's APO10 (Managed Vendors) provides a structured approach to vendor management:

The Opportunity: Over 18 months, using COBIT's vendor management framework:

• Renegotiated contracts: Saved $1.7M annually

• Replaced underperforming vendors: Improved service quality by 34%

• Consolidated vendors: Reduced from 47 to 31 vendors

• Established performance-based contracts: Improved SLA compliance from 67% to 94%

• Created vendor risk assessments: Identified and mitigated 23 critical dependencies

Most importantly, they broke free from vendor control. The CIO put it perfectly: "We went from being at the mercy of our vendors to being in a partnership where we have leverage."

Issue #7: The Innovation Graveyard (Good Ideas Go to Die)

The Problem: Here's a pattern I see constantly: Organizations have brilliant people with great ideas who are completely demoralized.

A financial services company I worked with in 2023 had lost 14 senior engineers in 18 months. Exit interviews revealed the same theme: "Good ideas are ignored. Innovation is discouraged. We just maintain legacy systems forever."

Their "innovation process" consisted of:

1. Submit idea to Innovation Committee

2. Wait 6-8 weeks for review

3. Get asked to prepare business case

4. Wait 4-6 weeks for budget review

5. Get denied due to "conflicting priorities"

6. Repeat annually

Out of 127 ideas submitted over three years, exactly 2 had been implemented.

What COBIT Reveals: COBIT's BAI01 (Managed Programs and Projects) includes innovation portfolio management. We created a structured approach:

The Opportunity: In the first year under the new framework:

• 67 innovations implemented (vs 0.67 per year previously)

• 23 incremental improvements saved $890K combined

• 8 process innovations reduced processing time by average 41%

• 4 technical innovations opened new revenue streams worth $2.3M

• 2 transformative initiatives approved and in progress

• Engineering retention improved from 73% to 91%

One engineer told me: "I've worked here for 8 years. This is the first time I feel like my ideas matter."

"The opposite of innovation isn't tradition—it's bureaucracy masquerading as governance. COBIT helps you tell the difference."

The COBIT Assessment: Uncovering What's Really Happening

Here's my battle-tested approach to identifying IT issues using COBIT. I've refined this over 30+ implementations, and it works.

Phase 1: The Reality Check (Weeks 1-2)

Start with brutal honesty. I use what I call the "COBIT Quick Scan":

Phase 2: The Deep Dive (Weeks 3-6)

Now you assess capability maturity across COBIT's 40 processes. I don't assess all 40—that's overkill. I focus on the processes most relevant to your business:

Typical High-Priority Processes:

Phase 3: The Opportunity Map (Weeks 7-8)

This is where COBIT transforms from diagnostic tool to strategic weapon. For each issue identified, map:

Issue → Root Cause → COBIT Process → Opportunity → Business Value

Real example from a 2022 client:

The Implementation Reality: What Actually Works

I need to be honest with you: implementing COBIT can go spectacularly wrong. I've seen it. I've cleaned up the mess.

Here's what doesn't work:

• ❌ Trying to implement all 40 processes at once

• ❌ Treating it as an IT-only initiative

• ❌ Focusing on documentation over outcomes

• ❌ Hiring consultants who've never actually run IT

• ❌ Expecting transformation in 90 days

Here's what does work:

The Phased Approach That Actually Succeeds

Phase 1 (Months 1-3): Foundation

• Implement EDM01 (Governance Framework)

• Implement APO01 (Management Framework)

• Establish governance committees with real authority

• Define decision rights clearly

• Quick wins to build momentum

Phase 2 (Months 4-6): Risk & Value

• Implement APO12 (Risk Management)

• Implement MEA01 (Performance Management)

• Build risk register and monitoring

• Establish meaningful metrics

• Start measuring business outcomes

Phase 3 (Months 7-12): Operations

• Implement critical operational processes based on your specific needs

• Focus on areas causing the most pain

• Build capability gradually

• Celebrate visible improvements

Phase 4 (Year 2+): Optimization

• Expand to additional processes

• Increase capability maturity levels

• Continuous improvement

• Advanced optimization

Real Success Stories: The Transformation I've Witnessed

Let me share three organizations that got it right:

Case Study 1: The Manufacturer That Found $4.2M

Mid-sized manufacturing company, $180M annual revenue, spending $11.3M on IT.

Problems Identified Through COBIT:

• 37% of IT spending on systems with unclear business value

• No project portfolio management

• Risk management was compliance theater

• IT and operations completely misaligned

COBIT Implementation:

• 8-month focused implementation

• Prioritized APO (planning) and MEA (measurement) processes

• Executive sponsor drove business engagement

Results After 18 Months:

• Eliminated $4.2M in wasteful IT spending

• Reduced project failure rate from 42% to 11%

• Improved IT satisfaction from 34% to 76%

• Identified and mitigated 23 critical operational risks

• First successful digital transformation initiative in company history

The COO's quote: "COBIT didn't just fix IT. It gave us visibility into how the entire business operates."

Case Study 2: The Hospital That Avoided a $12M Breach

Regional hospital network, 5 facilities, 2,200 employees.

Problems Identified Through COBIT:

• Security risk management was non-existent

• Legacy medical systems with critical vulnerabilities

• No third-party vendor oversight

• Incident response plan untested for 5 years

COBIT Implementation:

• Emergency 4-month risk-focused implementation

• Implemented EDM03, APO12, DSS05 (risk and security processes)

• Brought in specialized healthcare security consultants

Results:

• Identified 67 critical vulnerabilities before they were exploited

• Discovered that 14 medical devices were end-of-life and unsupported

• Found that a vendor had access to entire patient database (they only needed access to scheduling)

• Prevented ransomware attack that would have cost estimated $12M based on similar hospital breaches

The CISO: "COBIT gave us a systematic way to find and fix problems before they found us."

Case Study 3: The Startup That Scaled Without Breaking

SaaS startup, growing from 50 to 250 employees in 18 months.

Problems Identified Through COBIT:

• Complete lack of IT governance

• Ad-hoc everything

• Brilliant engineers, zero process

• Growing technical debt

COBIT Implementation:

• Lightweight, agile COBIT implementation

• Focused on BAI (delivery) and DSS (operations) processes

• Implemented minimum viable governance

Results:

• Successfully scaled from supporting 500 customers to 12,000

• Maintained 99.9% uptime during hypergrowth

• Passed SOC 2 audit on first attempt

• Technical debt as % of total code actually decreased

• Achieved enterprise readiness 9 months ahead of plan

The CTO: "COBIT let us build governance that enabled speed rather than preventing it. That's the holy grail for startups."

Your Next Steps: From Problem Identification to Value Realization

If you're ready to uncover the hidden issues and opportunities in your IT organization, here's my recommended approach:

Week 1: Self-Assessment Use the quick scan table I provided earlier. Be brutally honest. Where are your biggest gaps?

Week 2: Stakeholder Interviews Talk to:

• Business executives (What do they need from IT?)

• IT leadership (What keeps them up at night?)

• IT staff (What frustrates them daily?)

• Customers (How does IT impact their experience?)

Week 3-4: Priority Identification Map problems to business impact. Focus on:

• Highest risk

• Highest cost

• Biggest strategic importance

• Quickest wins

Month 2: Create Your Roadmap Select 3-5 COBIT processes to implement first. Choose based on:

• Business pain points

• Risk exposure

• Strategic priorities

• Capability gaps

Month 3-6: Implementation Sprint Start small. Build capability. Demonstrate value. Get quick wins. Build momentum.

Month 7+: Scale and Optimize Expand to additional processes. Increase maturity levels. Make COBIT part of your DNA.

The Final Truth About COBIT and IT Issues

After a decade of implementing COBIT, here's what I know for certain:

COBIT doesn't solve problems. It reveals them. And that revelation is worth its weight in gold.

Every organization has IT issues. The question is whether you discover them proactively through structured assessment or reactively through costly failures.

I started this article with a CIO who couldn't quantify his $47M IT investment value. We implemented COBIT over 14 months. At our final review meeting, he showed me the new executive dashboard:

• IT value delivery: +$8.2M in quantified business outcomes

• Risk reduction: 34 critical risks identified and mitigated

• Cost optimization: $3.7M in waste eliminated

• Strategic alignment: 94% of IT initiatives mapped to business goals

• Stakeholder satisfaction: +41 points

He looked at me and said: "For the first time in my career, I can walk into the boardroom and prove that IT is an investment, not a cost. That changes everything."

That's the power of COBIT. Not compliance. Not certification. Not checking boxes.

The power is in knowing what's really happening, why it matters, and what to do about it.

"The most expensive IT problems are the ones you don't know you have. COBIT is your flashlight in the darkness."

Your IT organization has issues. Every IT organization does. The question is: will you discover them before they become disasters, or after?

Choose wisely. Your career—and your organization's future—depends on it.