From Assessment to Improvement: IT Governance Lessons from Indonesian Higher Education Using COBIT 2019
DOI:
https://doi.org/10.15408/aism.v9i2.50919Keywords:
IT governance, COBIT 2019, BAI domain, capability level, digital transformationAbstract
This study's objective is to identify capability gaps and provide standardized improvement recommendations to support Indonesian higher education institutions' digital transformation roadmap. It was achieved by measuring the information technology (IT) governance capability levels across all 11 processes within the Build, Acquire, and Implement (BAI) domain of the COBIT 2019 framework in one Indonesian higher education institution. Utilizing a qualitative case study design, data collection involved semi-structured interviews with five purposively sampled key IT stakeholders and a comprehensive review of internal operational documents. Data analysis followed a five-stage protocol, converting qualitative compliance findings into quantitative maturity metrics based on COBIT 2019 scoring criteria. The findings reveal an asymmetric capability landscape in which five processes focusing on requirements, solution building, organizational change, knowledge, and project management achieved the target capability level 3 (Defined). On the other hand, six operational processes failed to meet the benchmark, with four processes stalling at level 2 (Managed) and two at level 1 (Initial) due to a lack of formal standard operating procedures, missing configuration baselines, and severe personnel constraints. These results imply that imposing rigid governance frameworks amid critical resource shortages can induce administrative compliance traps that degrade operational agility. Consequently, the study recommends that resource-constrained public institutions prioritize lightweight, scalable documentation aligned with actual staffing capacity. Lagging process maturity possibly indicates a rational, survival-driven prioritization of immediate operational demands over formal administrative workflows.
Downloads
References
[1] A. Wibowo, Revolusi Industri 4.0 dan Society 5.0. Semarang: Yayasan Prima Agus Teknik, 2023.
[2] M. Nashrullah, S. Rahman, A. Majid, N. Hariyati, and B. Budiyanto, “Transformasi digital dalam pendidikan Indonesia: Analisis kebijakan dan implikasinya terhadap kualitas pembelajaran,” Mudir: Jurnal Manajemen Pendidikan, vol. 7, no. 1, pp. 52–59, Jan. 2025, doi: 10.55352/mudir.v7i1.1290.
[3] A. S. Bimantoro and R. Jayadi, “IT governance measurement using COBIT 5 for evaluating IT project management aspect: Case study of insurance company,” Journal of System and Management Sciences, vol. 12, no. 6, pp. 315–333, Dec. 2022, doi: 10.33168/JSMS.2022.0620.
[4] T. Wulyatiningsih and J. Y. Mambu, “IT governance maturity and business alignment: A COBIT 2019 evaluation at RSUD ODSK,” International Journal of Engineering, Science and Information Technology, vol. 5, no. 2, pp. 248–255, Mar. 2025, doi: 10.52088/ijesty.v5i2.822.
[5] W. Febriyani, F. R. Hendrawan, and T. F. Kusumasari, “Advancing towards IT maturity governance excellence: COBIT 2019 in higher education (Indonesia),” in 2023 Eighth International Conference on Informatics and Computing (ICIC), IEEE, Dec. 2023, pp. 1–6. doi: 10.1109/ICIC60109.2023.10382082.
[6] A. Ishlahuddin, P. W. Handayani, K. Hammi, and F. Azzahro, “Analysing IT governance maturity level using COBIT 2019 framework: A case study of small size higher education institute (XYZ-edu),” in 2020 3rd International Conference on Computer and Informatics Engineering (IC2IE), IEEE, Sep. 2020, pp. 236–241. doi: 10.1109/IC2IE50715.2020.9274599.
[7] R. A. Nugraha and R. Syaidah, “Smart campus governance design for XYZ polytechnic based on COBIT 2019,” International Journal on Informatics Visualization, vol. 6, no. 3, pp. 718–725, Sep. 2022, doi: 10.30630/joiv.6.3.1257.
[8] I. N. A. P. Siboro, J. Siallagan, A. Purba, L. Ambarita, S. Nggebu, and Lasino, “Evaluation of information security governance in educational institutions using the COBIT 5 framework,” in 2024 6th International Conference on Cybernetics and Intelligent System (ICORIS), IEEE, Nov. 2024, pp. 1–6. doi: 10.1109/ICORIS63540.2024.10903958.
[9] Y. D. Prabowo, E. Fernando, and J. Gate, “Evaluation of IT governance with BAI domain at senior high school using Cobit 5,” in 2023 International Conference on Information Management and Technology (ICIMTech), IEEE, Aug. 2023, pp. 01–06. doi: 10.1109/ICIMTech59029.2023.10277731.
[10] ISACA, COBIT 2019: Introduction and Methodology. ISACA, 2018.
[11] P. Kwak and R. I. Desanti, “IT governance evaluation using COBIT 2019 framework in a manufacturing company,” in 2023 7th International Conference on New Media Studies (CONMEDIA), IEEE, Dec. 2023, pp. 62–67. doi: 10.1109/CONMEDIA60526.2023.10428517.
[12] B. S. Yulistiawan, R. Widyastuti, R. O. Mulianingtyas, G. P. R. Ariono, and H. T. Sihotang, “Developing the adaptive digital IT governance framework for next-generation IT governance,” MATRIK: Jurnal Manajemen, Teknik Informatika dan Rekayasa Komputer, vol. 25, no. 1, pp. 97–112, Nov. 2025, doi: 10.30812/matrik.v25i1.5628.
[13] M. Ayat and S. Shafiee, “Developing a comprehensive IT governance framework for Iranian hospitals: a fuzzy Delphi approach,” International Journal of Health Governance, vol. 30, no. 4, pp. 410–421, Nov. 2025, doi: 10.1108/IJHG-03-2025-0027.
[14] A. Budiman and Y. F. A. Lubis, “Perbandingan framework COBIT 2019 dan ITIL 4 dalam tata kelola teknologi informasi,” Jurnal Ilmu Komputer dan Teknik Informatika, vol. 1, no. 2, pp. 52–57, Jul. 2025, doi: 10.64803/juikti.v1i2.50.
[15] ISACA, COBIT 2019: Governance and Management Objectives. ISACA, 2018.
[16] R. Y. Pratama and S. Umaroh, “An IT asset governance model design using COBIT 2019 and ITIL V4 framework at BKU itenas,” E3S Web of Conferences, vol. 484, Art. no. 02006, Feb. 2024, doi: 10.1051/e3sconf/202448402006.
[17] M. S. Afiani, M. Lubis, A. F. Santoso, and M. F. Safitra, “Aligning IT asset management at XYZ university with infocom standard and COBIT 2019 BAI09 domain: Assessment and design,” in Proceedings of the 2023 9th International Conference on Industrial and Business Engineering, New York, NY, USA: ACM, Sep. 2023, pp. 537–544. doi: 10.1145/3629378.3629444.
[18] M. S. Fauzi, M. Lubis, L. Abdurrahman, F. S. Lubis, and H. Fakhrurroja, “Optimizing IT human capital: Evaluating and crafting an innovative management system with COBIT 2019,” in Proceedings of the 2023 9th International Conference on Industrial and Business Engineering, New York, NY, USA: ACM, Sep. 2023, pp. 545–550. doi: 10.1145/3629378.3629445.
[19] K. Vasileiou, J. Barnett, S. Thorpe, and T. Young, “Characterising and justifying sample size sufficiency in interview-based studies: Systematic analysis of qualitative health research over a 15-year period,” BMC Med. Res. Methodol., vol. 18, no. 1, pp. 1–18, Dec. 2018, doi: 10.1186/s12874-018-0594-7.
[20] J. W. Creswell and J. D. Creswell, Research Design, 5th ed. SAGE, 2017.
[21] A. Moser and I. Korstjens, “Series: Practical guidance to qualitative research. Part 3: Sampling, data collection and analysis,” European Journal of General Practice, vol. 24, no. 1, pp. 9–18, Jan. 2018, doi: 10.1080/13814788.2017.1375091.
[22] Project Management Institute, The Standard for Program Management, 5th ed. Project Management Institute, 2024.
[23] G. M. Khan et al., “Complex outsourcing relationships management model,” Journal of Software: Evolution and Process, vol. 37, no. 1, Jan. 2025, doi: 10.1002/smr.2724.
[24] S. K. Sahu, “Incident response and security monitoring,” in Building Secure PHP Applications, Berkeley, CA: Apress, 2024, pp. 347–388. doi: 10.1007/979-8-8688-0932-3_7.
[25] R. Quinlan, A. Brinister, T. Macdonald, and A. White, “Securing ATE using the DoD’s risk management framework,” in 2022 IEEE AUTOTESTCON, IEEE, Aug. 2022, pp. 1–6. doi: 10.1109/AUTOTESTCON47462.2022.9984778.
[26] M. Ilman and C. A. Anwar, “Analysis and quality assurance testing on Alpha97 landing page based on ISO/IEC/IEEE 29119 international standard,” Journal of Information Systems and Business Technology, vol. 1, no. 4, pp. 101–106, Dec. 2025, [Online]. Available: https://journal.jci.co.id/jisbt/article/view/259
[27] Y. Gerek and M. N. Aydin, “Management frameworks and management system standards in the context of integration and unification: A review and classification of core building blocks for consilience,” Systems, vol. 13, no. 4, pp. 234–267, Mar. 2025, doi: 10.3390/systems13040234.
[28] A. Falkiewicz, “Education of IT students in the field of IT management practices and sofware asset management in framework of IT studies at academic level,” Journal of Education, Health and Sport, vol. 8, no. 11, pp. 718–736, Nov. 2018, [Online]. Available: https://apcz.umk.pl/JEHS/article/view/6773
[29] L. English, A. Yunusa‐Kaltungo, M. Kidd, and A. Labib, “Development of a complementary framework for implementing asset register solutions,” Engineering Reports, vol. 4, no. 6, Art. no. e12493, Jun. 2022, doi: 10.1002/eng2.12493.
[30] S. L. Star and A. Strauss, “Layers of silence, arenas of voice: The ecology of visible and invisible work,” Computer Supported Cooperative Work (CSCW), vol. 8, no. 1–2, pp. 9–30, Mar. 1999, doi: 10.1023/A:1008651105359.
[31] N. P. Repenning and J. D. Sterman, “Nobody ever gets credit for fixing problems that never happened: creating and sustaining process improvement,” IEEE Engineering Management Review, vol. 30, no. 4, pp. 64–64, 2002, doi: 10.1109/EMR.2002.1167285.
[32] C. A. O’Reilly and M. Tushman, “Organizational ambidexterity: Past, present and future,” SSRN Electronic Journal, vol. 27, no. 4, pp. 324–338, 2013, doi: 10.2139/ssrn.2285704.
[33] M. Acharya and R. Thakurta, “Digital transformation in organisations - a review and research agenda,” Int. J. Bus. Inf. Syst., vol. 51, no. 2, pp. 212–251, 2026, doi: 10.1504/IJBIS.2026.151691.
[34] M. Hamidi, S. Ghazinoori, M. Naghizadeh, and N. Bagheri-Moghaddam, “Digital transformation as a technological innovation system: diversity of policy instruments in the lifecycle of upstream oil and gas technologies,” Technol. Anal. Strateg. Manag., pp. 1–16, Jul. 2025, doi: 10.1080/09537325.2025.2509241.
[35] P. S. Tolbert and L. G. Zucker, “The institutionalization of institutional theory,” in Studying Organization: Theory & Method, London, UK: SAGE Publications, 1999, pp. 169–184. doi: 10.4135/9781446218556.n6.
[36] M. S. Feldman and B. T. Pentland, “Reconceptualizing organizational routines as a source of flexibility and change,” Adm. Sci. Q., vol. 48, no. 1, pp. 94–118, Mar. 2003, doi: 10.2307/3556620.
[37] J. Poeppelbuss, B. Niehaves, A. Simons, and J. Becker, “Maturity models in information systems research: Literature search and analysis,” Communications of the Association for Information Systems, vol. 29, no. 1, pp. 491–502, 2011, doi: 10.17705/1CAIS.02927.
[38] M. Staples, M. Niazi, R. Jeffery, A. Abrahams, P. Byatt, and R. Murphy, “An exploratory study of why organizations do not adopt CMMI,” Journal of Systems and Software, vol. 80, no. 6, pp. 883–895, Jun. 2007, doi: 10.1016/j.jss.2006.09.008.
[39] K. J. Meier and M. A. Calderon, “Goal displacement and the protection of human subjects: The view from public administration,” Political Science and Politics, vol. 49, no. 2, pp. 294–298, Apr. 2016, doi: 10.1017/S1049096516000238.
[40] R. K. Merton, “Bureaucratic structure and personality,” Social Forces, vol. 18, no. 4, pp. 560–568, May 1940, doi: 10.2307/2570634.
[41] M. Power, The Audit Society. Oxford University Press, 1999. doi: 10.1093/acprof:oso/9780198296034.001.0001.
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Poppy Buana Mega Putri, Muhammad Rifki Shihab, Imairi Eitiveni
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
