Designing IT Governance Improvement Priorities Using COBIT 2019 Design Factors: A Case Study of Digital Organizations

Abstract

This study aims to design information technology governance improvement priorities using COBIT 2019 Design Factors in digital organizations. The study was conducted using a case study approach with a descriptive-analytical method, integrating quantitative and qualitative data to obtain a comprehensive understanding of the current IT governance condition. Quantitative data were collected through capability level assessment questionnaires based on selected COBIT 2019 governance and management objectives, while qualitative data were obtained through interviews, observation, and document analysis. The COBIT 2019 Design Factors were used to identify organizational context, including enterprise strategy, IT risk profile, threat landscape, compliance requirements, role of IT, sourcing model, technology adoption, and digital service complexity. The results show that most selected COBIT 2019 objectives are positioned at Capability Level 2, indicating that IT governance processes have been implemented and managed but are not yet fully standardized, measured, and continuously improved. The highest capability gaps were found in APO13 – Managed Security, DSS04 – Managed Continuity, APO12 – Managed Risk, and DSS05 – Managed Security Services. These findings indicate that information security governance, IT risk management, service continuity, incident handling, internal control, and compliance monitoring should become the main improvement priorities. This study contributes to the development of a structured, context-based, and evidence-driven IT governance improvement model for digital organizations.