Assessment of Information and Technology Risk Management Capability Using the COBIT 2019 Framework at the Communication and Informatics Office of Klungkung Regency

Authors

  • Ananda Dharmawati Universitas Pendidikan Ganesha, Singaraja, Kabupaten Buleleng, Bali, Indonesia
  • I Made Ardwi Pradnyana Universitas Pendidikan Ganesha, Singaraja, Kabupaten Buleleng, Bali, Indonesia https://orcid.org/0000-0002-2076-5129
  • I Gusti Lanang Agung Raditya Putra Universitas Pendidikan Ganesha, Singaraja, Kabupaten Buleleng, Bali, Indonesia

DOI:

https://doi.org/10.51903/50srf612

Keywords:

I&T risk management, COBIT 2019, process capability, EDM03, APO12

Abstract

Digital transformation and the Electronic-Based Government System (SPBE) mandate require local governments to establish structured and measurable governance for Information and Technology (I&T) risk management. This study aims to assess the capability level of I&T risk management processes within the strategic governance (EDM03) and operational management (APO12) domains using the COBIT 2019 framework at the Diskominfo of Klungkung Regency, analyze capability gaps, and formulate contextual improvement recommendations. Employing an evaluative case study approach, data were collected through Focus Group Discussion (FGD) involving six key informants mapped via the COBIT 2019 RACI matrix, complemented by a documentation review of 28 organizational artifacts. Capability assessment was conducted using the NPLF (Not Achieved, Partially Achieved, Largely Achieved, Fully Achieved) scale. The results indicate that EDM03 has achieved capability level 2 (Managed); however, it requires further strengthening in standardization and formal reporting consistency. Conversely, APO12 remains at level 1 (Performed), reflecting ad-hoc execution, inadequate SOP documentation, and the absence of formalized Disaster Recovery Plan (DRP) and Business Continuity Plan (BCP) documents. Gap analysis identifies all APO12 processes as high-priority improvements (gap = 2), while EDM03 processes are classified as medium-priority (gap = 1). It is concluded that the primary barriers are not a lack of risk awareness, but rather insufficient formal administrative mandates, the absence of standardized procedures, and low inter-unit reporting integration. Recommendations focus on developing SOPs for risk data collection and analysis, standardizing risk registers, designating risk owners per division, and formalizing DRP/BCP documents to sustainably advance risk governance capability.

References

[1] V. A. Putri, I. M. A. Pradnyana, and I. G. A. A. D. Indradewi, “Perancangan Manajemen Risiko Operasional Sistem Pemerintahan Berbasis Elektronik,” J. Tek. Inform. dan Sist. Inf., vol. 11, no. 2, pp. 311–326, 2025.

[2] Kementerian Pendayagunaan Aparatur Negara dan Reformasi Birokrasi, “Peraturan Menteri Pendayagunaan Aparatur Negara dan Reformasi Birokrasi Republik Indonesia Nomor 5 Tahun 2020 tentang Pedoman Manajemen Risiko Sistem Pemerintahan Berbasis Elektronik,” 2020.

[3] S. K. Gouwnalan and A. R. Tanaamah, “Penggunaan Framework COBIT 2019 dalam Evaluasi Tata Kelola Teknologi Informasi,” J. Tek. Inform. dan Sist. Inf., vol. 9, no. 2, pp. 1–11, 2023, doi: ttp://dx.doi.org/10.28932/jutisi.v9i2.6373.

[4] S. T. Hossain, T. Yigitcanlar, K. Nguyen, and Y. Xu, “Local Government Cybersecurity Landscape: A Systematic Review and Conceptual Framework,” Appl. Sci., vol. 14, no. 13, pp. 1–33, 2024, doi: 10.3390/app14135501.

[5] R. Bisma, “Manajemen Risiko Aset Teknologi Informasi: Studi kasus Implementasi Manajemen Risiko SPBE Dinas Komunikasi dan Informatika Pemerintah Kota Balikpapan,” J. Inf. Eng. Educ. Technol., vol. 06, no. 02, pp. 73–79, 2022.

[6] F. Syafa, R. Azhar, S. Aminah, and F. Zakiyabarsih, “Penerapan Sistem Pemerintahan Berbasis Elektronik (SPBE) pada Instansi Daerah: Studi Kasus Disdukcapil Kab . Donggala,” J. Manaj. Inform. Sist. Inf. dan Teknol. Komput., vol. 4, no. 1, pp. 384–391, 2025, doi: 10.70247/jumistik.v4i1.142.

[7] T. Qureshi, “Enhancing organizational Governance: A Proposal for COBIT 2019 Maturity Assessment,” Int. J. Adv. Res. Ideas Innov. Technol., vol. 10, no. 1, pp. 186–194, 2024, [Online]. Available: https://www.ijariit.com/manuscript/enhancing-organizational-governance-a-proposal-for-cobit-2019-maturity-assessment/

[8] N. M. Virgantari, I. G. Lanang, A. Raditya, and G. A. Jude, “Evaluasi Tata Kelola Teknologi Informasi (TI) pada Dinas Komunikasi dan Informatika Kabupaten Karangasem Menggunakan Framework COBIT 2019,” Inf. Syst. Emerg. Technol. J., vol. 6, no. 2, pp. 119–135, 2025.

[9] A. Afifah, G. F. Nama, and R. A. Pradipta, “Implementasi Framework COBIT 2019 dalam Audit Tata Kelola Teknologi Informasi (Studi Kasus: Diskominfo Kabupaten Rejang Lebong),” J. Inform. dan Tek. Elektro Terap., vol. 13, no. 3, pp. 1350–1362, 2023, doi: http://dx.doi.org/10.23960/jitet.v13i3S1.7550.

[10] D. Putra, A. Putera, and U. Siahaan, “COBIT 2019 for IT Governance Evaluation: A Cross-Sector Systematic Review,” J. Techbology Comput., vol. 3, no. 2, pp. 94–102, 2026, [Online]. Available: https://journal.technolabs.co.id/index.php/jotechcom/article/view/95/95

[11] D. Putra, D. Mutiara, K. Nugraheni, and J. E. Suseno, “Desain Arsitektur Enterprise Berbasis Risiko Teknologi Informasi untuk Sistem Pelatihan: Integrasi COBIT 2019 dan TOGAF ADM,” J. Sains dan Teknol., vol. 14, no. 1, pp. 35–46, 2025, doi: https://doi.org/10.23887/jstundiksha.v14i1.93498.

[12] R. Yulita and J. J. . Tambotoh, “Analisis Manajemen Risiko pada PT . XYZ Menggunakan Risk Management Analysis of PT XYZ Using COBIT 2019 with Domain,” J. Sist. Inf., vol. 13, no. 5, pp. 2033–2047, 2024, [Online]. Available: https://sistemasi.ftik.unisi.ac.id/index.php/stmsi/article/view/4430/814

[13] I. S. Rahayu, R. Mulyana, and H. Fakhrurroja, “Ambidextrous IoT Governance Framework for SmartCo’s Digital Transformation Aligned with COBIT 2019 Traditional and DevOps,” J. Nas. Pendidik. Tek. Inform., vol. 14, no. 2, pp. 308–320, 2025, doi: https://doi.org/10.23887/janapati.v14i2.98135.

[14] A. F. K. Parinduri and J. Hartono, “Evaluasi Penerapan Tata Kelola Teknologi Informasi (TI) Menggunakan Framework Cobit 2019 (Studi Kasus pada Perguruan Tinggi Harapan Maju),” Account. Bus. Inf. Syst. J., vol. 11, no. 3, pp. 225–243, 2023.

[15] A. B. Exacta, Suprapto, and A. Rachmadi, “Evaluasi Tata Kelola Teknologi Informasi menggunakan Kerangka Kerja COBIT 2019 pada Proses EDM04, APO07, dan DSS01 (Studi Kasus: Dinas Komunikasi dan Informatika Kabupaten Mojokerto),” J. Pengemb. Teknol. Inf. dan Ilmu Komput., vol. 9, no. 6, pp. 1–13, 2025.

[16] T. R. Mcintosh et al., “From COBIT to ISO 42001: Evaluating Cybersecurity Frameworks for Opportunities, Risks, and Regulatory Compliance in Commercializing Large Language Models,” Elsevier, vol. 144, no. November 2023, pp. 1–16, 2024, [Online]. Available: https://www.researchgate.net/publication/378713354_From_COBIT_to_ISO_42001_Evaluating_Cybersecurity_Frameworks_for_Opportunities_Risks_and_Regulatory_Compliance_in_Commercializing_Large_Language_Models

[17] S. Widjaja, “Pengembangan Manajemen Data dan Penyimpanan Perguruan Tinggi menggunakan Framework COBIT 2019,” Inf. Syst. Emerg. Technol. J., vol. 5, no. 1, pp. 12–22, 2024.

[18] T. Rahany et al., “Quality Optimisation of Electronic-Based Government Systems (SPBE) Through the Application of the COBIT Framework in Tangerang Regency,” J. Ilm. Adm. Publik ( JIAP ), vol. 11, no. 1, pp. 67–80, 2025.

[19] H. Santoso and U. Pradita, “Evaluasi Kematangan Tata Kelola TI dalam Manajemen Risiko dan Keamanan Informasi di PT Kereta Commuter Indonesia Menggunakan COBIT 2019,” J. Pendidik. dan Teknol. Indones., vol. 5, no. 6, pp. 1527–1535, 2025, doi: https://doi.org/10.52436/1.jpti.776.

[20] M. Salman et al., “Design of Risk Management in SPBE Infrastructure Based on PAN- RB Ministerial Regulation Number 5 of 2020 (Case Study : XYZ,” J. Teknol. Inf. dan Pendidik., vol. 16, no. 2, pp. 41–55, 2023, doi: https://doi.org/10.24036/jtip.v16i2.724.

[21] M. Alfonzo et al., “Implementasi Kebijakan Keamanan Siber pada Pemerintah Daerah: Studi Kasus Diskominfo Kota Bogor,” J. Golden Gener. Multidiciplinary, vol. 2, no. 2, pp. 767–775, 2026, doi: https://doi.org/10.65244/jggm.v2i2.716.

[22] D. W. Setyadi and S. Jatmiko, “Assessment Penerapan Manajemen Risiko Teknologi Informasi Menggunakan ISO 31000,” J. Ilm. Komputasi, vol. 21, no. 2, pp. 281–288, 2022, doi: https://doi.org/10.32409/jikstik.21.2.3061.

[23] A. Firdaus, S. Mukaromah, and D. Rodwandono, “Evaluasi Tingkat Kapabilitas Manajemen Risiko SPBE Pada Diskominfo Jatim Menggunakan Cobit 5,” J. Publ. Sist. Inf. dan Telekomun., vol. 2, no. 3, pp. 159–171, 2024, doi: https://doi.org/10.62951/bridge.v2i3.135.

[24] B. Azzahra, A. Nur, E. Nur, and F. Dewi, “Information Technology Governance Assessment using the COBIT 2019 Framework and ISO / Iec 38500 At RSUD XYZ,” J. Appl. Inf. Syst. Informatics, vol. 2, no. 2, pp. 42–48, 2024, doi: https://doi.org/10.37058/jaisi.v2i2.12722.

[25] A. Pratama, D. Yulisda, and M. Fajar, “Analisis Tingkat Kemampuan (Capability Level) Teknologi Informasi Menggunakan Framework COBIT 2019 Domain DSS (Deliver, Service, And Support) Studi Kasus Diskominfo Kota Pematang Siantar,” J. Tika, vol. 8, no. 1, pp. 10–16, 2023, doi: 10.51179/tika.v8i1.1781.

[26] T. A. Ali, Suprapto, and A. Rachmadi, “Evaluasi Tata Kelola Teknologi Informasi menggunakan Kerangka Kerja COBIT 2019 pada Proses EDM04 dan APO07 pada Dinas Komunikasi Informatika Statistik dan Persandian Kabupaten Lahat,” J. Pengemb. Teknol. Inf. dan Ilmu Komput., vol. 9, no. 7, pp. 1–11, 2025.

[27] A. Y. Nugroho, “Audit Tata Kelola Teknologi Informasi Adaptif Di Era Transformasi Digital menggunakan COBIT 2019,” J. Ilm. Bisnis Digit., vol. 2, no. 1, pp. 1–10, 2025, doi: 10.69533/2n2y4m65.

[28] Haikal et al., ”Assessing IT Governance in Digital UMKM Application Projects: A Comparative Study Using the COBIT 2019 Framework,” vol. 4, no. 2, pp. 232–241, 2025, https://doi.org/10.51903/wpt7q648

Downloads

Published

2026-10-28

Issue

Vol. 5 No. 3 (2026): November

Section

IT Governance, E-Commerce and E-Government

License

Copyright (c) 2026 Ananda Dharmawati, I Made Ardwi Pradnyana, I Gusti Lanang Agung Raditya Putra

Creative Commons License

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.

All articles published in this journal are open access and licensed under the terms of the Creative Commons Attribution-ShareAlike 4.0 International License (CC BY-SA 4.0).

Under this license:

  • Authors retain copyright of their work.

  • Others are free to:

    • Share — copy and redistribute the material in any medium or format;

    • Adapt — remix, transform, and build upon the material for any purpose, even commercially;

  • As long as they:

    • Give appropriate credit to the original author(s) and the source;

    • Provide a link to the license;

    • Indicate if changes were made;

    • Distribute their contributions under the same license as the original.

This ensures that derivative works will also remain free and open under the same terms.