Methodology and limitations

Framework

The questionnaire is structured around the seven information quality criteria associated with COBIT: effectiveness, efficiency, confidentiality, integrity, availability, compliance, reliability. Each criterion is assessed through 5 questions on common controls (35 questions in total).

Scoring

• Yes = 2 points, Partially = 1 point, No = 0 points.
• Not applicable answers are excluded from the maximum applicable score.
• Score = points obtained ÷ maximum applicable points × 100, calculated for each criterion and overall.
• No score is displayed when no applicable question has been answered.

Indicative thresholds

These thresholds are indicative and configurable; they are not a standard.

Risks and critical indicators

Every No or Partially answer is reported as a weakness with its associated risk and a recommendation. 10 questions are critical indicators (e.g. backups, access management, segregation of duties). A critical indicator answered No is reported as a critical risk, answered Partially as a high risk. Critical risks are always displayed, whatever the overall score: a high score never hides them.

Limitations

• Results rely entirely on the answers provided; no evidence is checked.
• All questions carry the same weight within a criterion, and all criteria the same weight overall.
• The questionnaire covers a selection of key controls, not the full COBIT framework.
• The assessment does not replace an audit by a qualified professional.

This assessment is an indicative self-assessment based on the answers provided. It does not constitute an audit, nor an official COBIT compliance certification or opinion. Score thresholds are indicative.