COBIT 2019 IT Governance for Banking and Insurance Training Course

Course overview

Banks and insurers must demonstrate that technology decisions, outsourced services, data controls and cyber investments support regulated business objectives—not merely that policies exist. Risk committees, internal audit teams, technology leaders and control owners need a shared way to connect IT processes with operational resilience, prudential requirements, customer-data protection, financial reporting and measurable risk appetite. COBIT 2019 provides that governance structure, but its value depends on tailoring it to the institution’s products, regulatory obligations, sourcing model and control environment.

This five-day course teaches participants how to apply COBIT 2019 to banking and insurance governance scenarios. Participants work with the COBIT governance and management objectives, design factors, goals cascade, capability levels and performance management approach. They learn to translate business priorities such as digital onboarding, claims-platform modernisation, payment-service resilience, third-party cloud risk and regulatory reporting into governance objectives, practices, metrics and accountable roles. The course also covers practical alignment with ISO/IEC 27001 and NIST Cybersecurity Framework controls.

Instruction combines facilitated framework teaching with banking and insurance case work, control-design workshops and small-group review sessions. Participants build a COBIT 2019 governance design for a fictional regulated financial institution, including a prioritised objective set, design-factor rationale, RACI assignments, performance measures, capability assessment and improvement roadmap. They leave with a reusable governance-design workbook and an action plan for applying COBIT methods to a live function, programme or control issue in their organisation.

The course is suited to foundation-to-intermediate professionals who influence technology risk, IT controls, digital transformation, internal audit, compliance or operational resilience in banks, insurers, lenders, payment firms and financial-services shared-service environments.

Course objectives

By the end of this course, participants will be able to:

• Apply the COBIT 2019 goals cascade to translate banking or insurance business priorities into governance and management objectives
• Assess COBIT 2019 design factors to scope a governance system for a regulated financial institution
• Prioritise COBIT governance and management objectives for scenarios involving cloud services, digital channels and third-party providers
• Map COBIT practices and components to operational resilience, cyber-risk and data-protection control requirements
• Define RACI accountability matrices for board, executive, risk, compliance, IT and control-owner responsibilities
• Measure governance performance using COBIT capability levels, metrics, targets and evidence sources
• Develop a risk-based improvement roadmap that addresses identified IT governance and control gaps
• Produce a COBIT 2019 governance-design workbook for a banking or insurance operating context

Benefits of attending

Target competencies

Who should attend

• IT Governance Managers — who need to design and maintain accountable technology governance arrangements
• Technology Risk Managers — who must connect IT risk treatment to risk appetite, control ownership and reporting
• Internal Auditors — who assess IT controls and need a structured basis for audit scoping and recommendations
• Information Security Managers — who align cyber controls, security metrics and executive oversight with enterprise governance
• Compliance and Operational Resilience Officers — who need traceable governance evidence for regulatory obligations and resilience testing
• Digital Transformation and Technology Leaders — who must govern cloud, platform and automation programmes without weakening control discipline

Requirements and prerequisites

This is a foundation-to-intermediate course. Participants should understand basic IT service, information-security or operational-risk concepts, such as controls, incidents, vendors, policies, risk assessments and management reporting. Familiarity with a bank or insurer’s three-lines model, risk appetite, audit process, or technology change lifecycle is helpful, but not essential. Participants should be comfortable reading process diagrams, simple RACI charts and spreadsheet-based metrics. No previous COBIT certification, coding ability, GRC-platform configuration experience, or detailed knowledge of ISO standards is required. Complete beginners should expect structured guidance through COBIT terminology before applying it in financial-services cases.

Training methodology

The instructor leads short, focused COBIT 2019 explanations followed by guided application to a bank-and-insurer case environment. Participants use the COBIT 2019 Design Toolkit to assess design factors, select priority objectives and build ownership models for issues such as cloud outsourcing, customer-data controls and critical-service resilience. Small groups review evidence, score capability, challenge proposed metrics and present improvement recommendations as if reporting to a technology-risk committee. The final session converts the case work into an individual application plan for a real governance issue or programme.

Course outline

Day 1: COBIT 2019 foundations for regulated financial institutions

• Banking and insurance governance challenges: resilience, conduct, data and third-party risk
• COBIT 2019 principles for governance systems and governance frameworks
• Governance versus management under the EDM and APO, BAI, DSS and MEA domains
• COBIT governance and management objectives structure
• COBIT components: processes, organisational structures, policies, information and culture
• Financial-services business goals and stakeholder needs analysis
• Introduction to the COBIT 2019 goals cascade

Workshop: Participants map a retail bank or insurer’s strategic priorities to enterprise goals, alignment goals and candidate COBIT objectives.

Day 2: Designing a tailored COBIT governance system

• COBIT 2019 design workflow and governance system scope
• Enterprise strategy design factor for growth, innovation and client service
• Enterprise goals and risk profile design factors
• Threat landscape and regulatory compliance requirement design factors
• IT-related issues and sourcing-model design factors
• Technology adoption strategy and enterprise-size design factors
• Using the COBIT 2019 Design Toolkit to prioritise objectives

Workshop: Teams complete a Design Toolkit assessment for an insurer adopting a cloud-based claims and customer-service platform.

Day 3: Controls, accountability and risk integration

• EDM objectives for governance oversight, benefits, risk and resources
• APO objectives for enterprise architecture, risk, security and supplier management
• BAI objectives for programme governance, change enablement and solution delivery
• DSS objectives for operations, continuity, security services and incident management
• MEA objectives for performance monitoring, internal control and assurance
• RACI responsibility design across board, executive, risk, compliance and IT functions
• Mapping COBIT practices to ISO/IEC 27001 and NIST Cybersecurity Framework outcomes

Workshop: Participants produce a RACI matrix and control mapping for a payment-service provider outage and outsourced recovery scenario.

Day 4: Performance management, evidence and assurance

• COBIT performance management concepts and capability levels
• Process purpose statements, practices and activities
• Setting governance metrics, targets, thresholds and reporting frequency
• Selecting evidence for internal audit and second-line challenge
• Control testing versus capability assessment
• Issue logging, root-cause analysis and remediation tracking
• Technology-risk dashboards for executive and board committees

Workshop: Participants assess the capability of a critical-service continuity process and create a metric dashboard with escalation thresholds.

Day 5: Governance improvement roadmap for banking and insurance

• Interpreting COBIT assessment findings and prioritising governance gaps
• Risk-based sequencing of quick wins, control uplift and operating-model changes
• Building improvement initiatives for cloud governance and third-party oversight
• Embedding governance in digital onboarding, claims automation and core-system change
• Stakeholder engagement and committee approval planning
• Governance roadmap milestones, owners, dependencies and success measures
• Preparing a COBIT governance-design workbook and executive narrative

Workshop: Each participant finalises and presents a COBIT 2019 governance improvement roadmap for a selected banking or insurance use case.

Tools & standards covered

COBIT 2019 Framework, COBIT 2019 Design Toolkit, ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0

A typical training day

Live online deliveries follow the same structure in the East Africa Time zone, with shorter screen blocks and longer breaks.

What the fee includes

How you can take this course

Certification

Participants who complete the full five days receive the Skillset Development Certificate of Completion, stating the course title, course code, dates and delivery format — suitable for professional-development records and employer reimbursement.

Frequently asked questions