"Strong framework tools are essential for ensuring IT resources are aligned with an enterprise's business objectives, and that services and information meet quality, fiduciary and security needs," the institute says. CobiT is designed to ensure alignment of IT resources with an enterprise's business objectives so that information and services meet quality, fiduciary and security needs, and to provide a mechanism to balance IT risks and returns. CobiT defines 34 significant processes linked with 318 tasks and activities, and defines an internal control framework for all of them.

The institute says CobiT is a useful and powerful framework for communicating effectiveness and value to the business. It also warns its usefulness can occasionally be undermined by resistance from IT executives, who may see CobiT as a threat when it is introduced in an enterprise, as it often is, via the audit route.

Such resistance is likely to be misguided, says Ian Hill, manager, quality and policy at Curtin University of Technology's information services group. It was staff members of the Curtin internal audit team who learned about CobiT and, impressed with its content, brought it to the attention of their institution's central IT leadership. Members of senior committees, who had an ongoing concern about IT governance, chose to adopt CobiT as their university standard.

"Our big interest in CobiT is because CobiT is like a best practice framework," Hill says. "It is intended to be a benchmark against which auditors can judge whether an organisation is doing okay or not, but internally we don't use it that way."

Hill says the central IT area of Curtin treats the CobiT framework as a road map for continuous improvement, on the understanding that ISACA developed the CobiT framework to embrace a comprehensive review of world's best practice and professional standards. He says the framework integrates so many different standards, Curtin can now look to it for best practice guidance about any area of IT targeted for improvement and get leadership on critical success factors. Organisations unsure about where to start to improve their IT can also use the framework as a guide to priority selection, he says.

Curtin accepts CobiT as a strong factor in its success in achieving its primary goals for IT governance: transformation of organisational practices and pursuit of improved processes.

Just as boards assign committees to oversee other critical areas, the IT Governance Institute says boards should establish an IT strategy committee charged with determining how the board should be involved in IT governance, how to integrate the board's role in IT and business strategy, and who decides the extent to which the committee has an ongoing role in IT governance. Its IT Strategy Committee publication provides a sample charter and describes responsibilities, authority, mem-bership and meeting structure.

It is a message few organisations appear to have heeded. ISACA recently completed an IT governance maturity survey to measure the maturity level of major organisations relative to IT governance at the board and executive levels. The survey found that 90.7 per cent of the 204 respondents said their board asks questions regarding IT, but only 39.2 per cent answered to an IT strategy committee. With IT governance, maturity was measured in levels from 1 to 5, with Level 1 defined as "initial/ad hoc" and Level 5 defined as "optimised". Few Asian and Oceania respondents identified themselves as being at Level 1 (a mere 3.7 per cent), but only a little more than one-third (33.3 per cent) indicated they were at Level 5, leaving a substantial number of organisations with less-than-optimised IT governance.