Adopting COBIT 2019 for the Evaluation of Information Technology Risk Management in a Startup Company

Abstract

The start-up XYZ operates in tourism and digital agencies, where every business activity relies on IT from the outset. We must implement good risk management to ensure optimal operation of all business processes and minimize risks, particularly in light of the post-pandemic changes. The study uses the COBIT 2019 framework to evaluate the risk management of the company's business processes. The study comprises five stages: a preliminary study, a research planning phase, data collection, data analysis, and a recommendation phase. As a result, the company has successfully identified potential risks, along with their respective impact levels, and gained insights into IT-related issues. However, the company still requires an extensive evaluation for its field implementation. While the company believes it has effectively managed risks, subsequent assessments reveal that it is still in the early stages, necessitating numerous improvements in risk management implementation. This is evident from the evaluation of the EDM03 and APO12 processes; the company's capacity is currently at level 1 with a gap of 2. The overarching recommendation is for companies to document all past risks, standardize SOPs, and regularly evaluate them to ensure continuous improvement in future business processes.