COBIT 2019 is the most widely referenced enterprise IT governance framework in the world. Yet most implementations in West African financial institutions follow the same pattern: a consulting engagement, a gap assessment, a lengthy report — and then the framework quietly retreats to a shelf while the organization returns to its actual operating model.
This is not a failure of intent. It is a failure of localization.
COBIT 2019’s design principles are sound. But the guidance is written for a global — which in practice means Western and North American — context. The DSS (Deliver, Service and Support) domain examples reference stable, well-resourced IT departments with mature tooling. The MEA (Monitor, Evaluate and Assess) domain compliance references discuss SOX and GDPR. The APO (Align, Plan and Organize) guidance assumes IT strategy is regularly reviewed at board level by IT-literate directors.
For an IT Governance Lead at a Nigerian commercial bank, a Ghanaian fintech-licensed institution, or a Francophone West African bank under BCEAO oversight, the implementation starting point is different. This article describes that starting point.
The West African Financial Institution Context
Before prescribing a COBIT implementation approach, it is worth naming the specific conditions that shape IT governance at financial institutions in the region.
Regulatory layering is complex. Nigerian banks operate under CBN (Central Bank of Nigeria) guidelines, NDIC oversight, and — for listed institutions — SEC requirements. Ghanaian institutions answer to the Bank of Ghana. Francophone West African banks fall under BCEAO (Banque Centrale des États de l’Afrique de l’Ouest) and UEMOA regulatory frameworks. The compliance obligations are genuine and enforceable — but they are not always mapped to a specific IT governance standard like COBIT. The IT Governance Lead must do that mapping themselves.
IT maturity levels are mixed. A tier-1 Nigerian bank may have a mature ITSM operation, an established SOC, and a sophisticated change management process. A regional savings bank or an MFI (Microfinance Institution) in the same jurisdiction may be running its core banking system on a vendor-managed hosted platform with minimal in-house IT governance capacity. COBIT 2019 is designed for this range — but not all organizations recognize that COBIT can be applied at different maturity levels.
Board and executive IT literacy is improving but uneven. COBIT APO14 (Managed Data) and APO12 (Managed Risk) require board-level engagement with IT risk topics. In practice, many West African financial institutions are at an early stage of this conversation. The IT Governance Lead often needs to build the board reporting infrastructure before they can comply with the framework’s intent.
Digital transformation is creating new governance gaps. Mobile money, USSD banking, agency banking, and core banking system migrations have increased the IT change surface significantly. These changes often move faster than governance frameworks can adapt — creating a real-time gap between what the framework requires and what the organization can deliver.
A Domain-Focused Implementation Approach
COBIT 2019 contains 40 governance and management objectives across six domains. Attempting to implement all 40 simultaneously is a path to governance paralysis. A practical implementation for most West African financial institutions starts with three domains:
Priority Domain 1: DSS (Deliver, Service and Support)
DSS is the operational heart of IT governance for a financial institution. The practices most immediately relevant for the West African context are:
DSS01 (Managed Operations): Defines the monitoring, incident management, and operational continuity processes for IT services. For a bank with a core banking system and mobile banking platform, this means formalizing the escalation paths, SLA definitions, and monitoring dashboards that govern service continuity — particularly during high-traffic periods (salary payment days, public holidays, end of month).
DSS02 (Managed Service Requests and Incidents): The incident classification and management process. Many West African banks have informal incident management — issues are resolved by the responsible team lead with minimal documentation. DSS02 implementation means creating a structured incident register, a severity classification matrix, and a root-cause-analysis discipline for P1 and P2 incidents.
DSS03 (Managed Problems): Problem management is almost universally immature in the region. Most organizations resolve incidents but never analyze the patterns that produce recurring failures. DSS03 implementation typically reveals 5–10 systemic issues (often in core banking integrations, ATM network management, or mobile platform reliability) that have been generating repeated incidents for months or years.
DSS04 (Managed Continuity): Business continuity for IT services. CBN, Bank of Ghana, and BCEAO regulations all have explicit BCP (Business Continuity Planning) requirements. DSS04 provides the governance structure for BCM — including recovery time objectives, recovery point objectives, and DR test schedules — that satisfies regulatory expectations.
Priority Domain 2: MEA (Monitor, Evaluate and Assess)
MEA is the compliance and audit engine of COBIT. For West African financial institutions, two practices are most immediately valuable:
MEA01 (Managed Performance and Conformance Monitoring): Defines the KPIs and metrics that the organization uses to track IT governance performance. For a financial institution, this should include: incident SLA compliance rate, change success rate, system availability by service tier, and security event response time. MEA01 asks you to make this monitoring systematic — not just measured when an audit is due.
MEA02 (Managed System of Internal Control): Internal IT controls that satisfy regulatory and audit requirements. For Nigerian banks, the CBN’s IT Standards, Guidelines, and Policies for Banks and Other Financial Institutions is the reference document. MEA02 implementation creates the bridge between COBIT controls and CBN compliance evidence — which is what your internal audit team (and external auditors) actually need.
Priority Domain 3: APO (Align, Plan and Organize)
APO is the strategic layer of COBIT. For many West African financial institutions, the most important practices are:
APO12 (Managed Risk): IT risk management aligned to the institution’s overall enterprise risk framework. Most West African banks have enterprise risk functions — credit risk, market risk, operational risk — but IT risk is often managed separately and incompletely. APO12 integration means IT risks are assessed, scored, and reported using the same methodology as other operational risks, and that IT risk appears on the Board Risk Committee agenda.
APO13 (Managed Security): Cybersecurity governance. With the growth of digital banking channels, cybersecurity risk has become a primary concern for financial institution boards and regulators. APO13 defines the information security management system (ISMS) governance structure — complementing ISO 27001 where it exists, or providing the governance anchor where it does not.
APO14 (Managed Data): Data governance. NDPR compliance in Nigeria (and equivalent data protection requirements in other ECOWAS states) creates a direct regulatory obligation for data governance. APO14 provides the framework for data classification, data ownership, data quality management, and data retention — all of which are increasingly scrutinized by regulators.
Mapping COBIT to CBN Regulatory Requirements
For Nigerian institutions, the following mapping is a practical starting point for aligning COBIT 2019 to CBN technology governance requirements:
| CBN Requirement Area | Relevant COBIT 2019 Objectives |
|---|---|
| IT Strategy and Governance | APO02, APO05, EDM01 |
| IT Risk Management | APO12, APO13, EDM03 |
| Business Continuity | DSS04, APO12 |
| Change Management | BAI06, BAI07 |
| Information Security | APO13, DSS05 |
| Data Management and NDPR | APO14, DSS06 |
| IT Audit and Compliance | MEA01, MEA02, MEA03 |
| Incident Management | DSS02, DSS03 |
This mapping is not exhaustive — CBN circulars are updated periodically and specific requirements vary by institution type. Use it as a starting point for your gap assessment, not as a definitive compliance checklist.
Building a COBIT Maturity Roadmap
COBIT 2019 uses a Capability Maturity Model that rates each management objective from Level 0 (Incomplete) to Level 5 (Optimizing). For most West African financial institutions, a realistic 12-month maturity target is:
- Priority DSS practices: Move from Level 1–2 to Level 3 (Established) for DSS01, DSS02, DSS04
- Priority MEA practices: Achieve Level 2–3 (Managed) for MEA01, MEA02
- Priority APO practices: Achieve Level 2 (Managed) for APO12, APO13; Level 1–2 for APO14
A Maturity Roadmap should be structured in three phases:
Phase 1 — Foundation (Months 1–3): Complete the gap assessment. Document current state for all priority objectives. Establish governance forums (IT Steering Committee cadence, IT Risk reporting to Board Risk Committee). Define KPIs for MEA01 tracking.
Phase 2 — Implementation (Months 4–9): Implement the priority practice improvements. This typically means formalizing existing processes (incident management, change management, BCP testing) before adding new ones. Use the Goverly audit checklists to structure your implementation evidence gathering.
Phase 3 — Stabilization and Audit Readiness (Months 10–12): Run internal assessments against each priority objective. Prepare audit evidence packages. Schedule external audit or self-certification depending on regulatory requirements.
Common Implementation Mistakes to Avoid
Mistake 1: Starting with policies instead of processes. A COBIT policy document that is not supported by an operational process is compliance theatre. Start with the process (how does your team actually handle incidents today?) and then document and formalize it — before writing the policy.
Mistake 2: Treating COBIT as a one-time compliance project. COBIT is a continuous governance framework. A gap assessment completed in January should be revisited in July. Build the MEA01 monitoring into your quarterly IT governance reporting cycle — don’t treat it as an annual exercise.
Mistake 3: Under-involving business stakeholders. APO02, APO05, and EDM01 all require meaningful business engagement with IT governance. If your IT governance framework only involves IT people, it is not COBIT — it is an IT department operating model. The CFO, COO, and Risk Director need to be part of your governance conversation.
Mistake 4: Ignoring the BSS/technology vendor context. Many West African financial institutions run their core banking systems on vendor-managed platforms (Temenos, Infosys Finacle, Finastra, Oracle FLEXCUBE). COBIT must extend to these third-party relationships — particularly DSS01, DSS04, APO10, and DSS05. Your vendor governance framework is part of your COBIT implementation.
Access the Goverly COBIT 2019 Audit Checklist
The Goverly library includes a 140-point COBIT 2019 audit checklist for West African financial institutions — mapped to CBN and Bank of Ghana compliance requirements, with guidance notes for each control point.
Join the Goverly waitlist to receive your free CAB Meeting Agenda template and priority access to the full COBIT checklist at launch.