The core principle of ‘Meeting Stakeholder Needs’ is most directly applicable here. It reminds the team that the ultimate purpose of any IT initiative, like a new CRM, is to create value for stakeholders by addressing their needs and goals—in this case, the business goal of increasing customer retention. This principle shifts the focus from technology for its own sake to technology as an enabler of business outcomes.

MEA02 Monitor, Evaluate and Assess the System of Internal Control is the correct process. Its purpose is to provide assurance that the enterprise’s internal controls (which include defined processes like access reviews) are effective and operating as intended. It focuses on monitoring the performance and compliance of the control system itself, which aligns with the auditor’s recommendation for a structured, documented review process.

The COBIT 5 goals cascade is a mechanism to translate stakeholder needs into actionable enterprise goals, which then cascade to IT-related goals, process goals, and enablers. The essential first step is to clearly define what the strategic objective means in measurable terms for the enterprise (e.g., ‘Increase revenue in Region X by 20% within two years’). This provides the clear business context needed to then derive relevant IT goals and make appropriate investment decisions.

The ‘Customer’ dimension in the COBIT 5 BSC focuses on the stakeholders’ (or business units’) perception of IT’s services and products. It answers the question, ‘How do stakeholders view us?’ Metrics here relate to user satisfaction, service availability as perceived by the business, and the value delivered by IT solutions. Adding metrics from this dimension would directly help assess IT’s contribution from the business’s perspective, complementing the internal efficiency metrics they already track.

The principle of ‘Covering the Enterprise End-to-End’ emphasizes that governance and management of IT should encompass all functions and processes required to achieve value creation, regardless of where they are performed—inside the organization or by external third parties (like cloud providers). This is crucial for the startup’s hybrid environment, as it ensures governance considers the entire service chain, not just the internally managed pieces.

Principles, Policies and Frameworks are enablers that translate desired behavior into practical guidance for day-to-day management. A formal change management policy is a classic example of this enabler type. It establishes the rules and expectations (the ‘what’ and ‘why’) that govern how the change management process (which is a separate ‘Processes’ enabler) should be executed.

The practice ‘Manage security breaches and incidents’ under APO13 includes activities for preparing for, detecting, and responding to incidents. A key preparatory activity is ensuring the incident response plan—which includes accurate contact lists and team composition—is maintained and ready. Assigning responsibility for the contact list directly supports this specific practice within the broader security management process.

Services, Infrastructure and Applications are the enablers that include the actual technology (like the service desk tool) and IT services. By investing in a new tool, the company is directly intervening in this enabler category to improve the capability of the DSS processes. The related training is an intervention in the ‘People, Skills and Competencies’ enabler, but the primary investment described is in the technology infrastructure.

COBIT 5 promotes an ‘Enabling a Holistic Approach’ principle, which means that for any issue, all interrelated enablers should be considered. Simply blocking apps (focusing on Policies) or just speeding up the service (focusing on Infrastructure) may not work. A holistic analysis might reveal issues with Process design, cultural Behavior, lack of Skills to use the official tool, or poor Information provided to users. Addressing the root cause requires looking at the system of enablers as a whole.

The core principle of ‘Meeting Stakeholder Needs’ is most directly applicable here. It reminds the team that the ultimate purpose of any IT initiative, like a new CRM, is to create value for stakeholders by addressing their needs and goals—in this case, the business goal of increasing customer retention. This principle shifts the focus from technology for its own sake to technology as an enabler of business outcomes.0