Information Systems and Information Technology Audit for Performance Effectiveness at the Binterbusih Foundation using COBIT 2019

Abstract

Binterbusih Foundation is a nonprofit organization that has focused on the development and education of students from Papua since 1982. Its operations rely on System X and the Odoo application to manage student data. However, the foundation faces several challenges, including the absence of standardized operating procedures (SOPs) for data management and security, as well as the lack of a systematic assessment of the effectiveness of its existing information systems and information technology (IS/IT) infrastructure. This study aims to audit data governance at Binterbusih Foundation using the APO14 (Managed Data) domain of the COBIT 2019 framework. A qualitative research approach was employed, involving in-depth interviews and direct observation. The research process comprised focus area identification, Goals Cascade analysis, Design Factor assessment, RACI chart development, AS-IS capability assessment using the Not Achieved–Fully Achieved rating scale, gap analysis, and the formulation of TO-BE recommendations. The findings indicate that none of the ten management practices within the APO14 domain achieved a rating of Largely Achieved or Fully Achieved. Four practices (APO14.01, APO14.04, APO14.08, and APO14.09) were rated Partially Achieved, while six practices (APO14.02, APO14.03, APO14.05, APO14.06, APO14.07, and APO14.10) were rated Not Achieved. The primary underlying issue was the absence of documented SOPs, which had cascading effects on the maturity of other formal management practices, including backup procedures and network maintenance, neither of which was performed according to a structured schedule. This study recommends formally establishing data management SOPs, implementing an archival retention policy, developing structured schedules for equipment and network maintenance, and configuring internet failover between service providers. These recommendations are tailored to the resource constraints of a nonprofit organization.