I NFORMATION S YSTEMS C ONTROL J OURNAL, VOLUME 6, 2007 1Copyright © 2007 ISACA. All rights reserved. www.isaca.org.In today’s complex and constantly changing business world,the governance of information technology (IT) and thealignment of IT to the business are high on the agenda ofexecutive management. Strategic planning based on thealignment of IT goals to business goals is a key component inbusiness/IT alignment. It is important that an organisationstart with a clear view on its corporate mission and athorough definition of its supporting strategy and businessgoals. Then, these need to be translated into goals for the ITdepartment, which are the basis for the IT strategy. Finally,the supporting IT processes must be carefully planned totranslate the IT strategy into action. For these planning efforts,companies may be looking for guidance to identify the set ofimportant business goals and IT goals and determine howthey interrelate. The IT Governance Institute (ITGI)’s research on thissubject was illustrated by a previous article1in the InformationSystems Control Journal and led to the publication of a set ofgenerally applicable business goals for IT and associated ITgoals in COBIT 4.0. Extensive follow-up research wasperformed to gain more insight into this set of business andIT goals and their linkage. This article presents the results ofthe follow-up research project in which experts in differentsectors were asked to validate, prioritise and link a set ofbusiness goals and IT goals. This research resulted in asignificant improvement of the business goals for IT andassociated IT goals in COBIT 4.1. Research BackgroundThis research project was based on the findings of a pilotstudy that resulted in a list of 20 generic business goals and28 generic IT goals, published in COBIT 4.0. The objective ofthis research was to:• Validate these lists for completeness, consistency and clarity• Gain more insight into goals’ priorities for different sectors• Examine the relationship between IT goals and business goalsIn practice, every enterprise has its own distinct sets ofbusiness and IT goals. Priorities within these sets differdepending on a variety of internal and external factors, suchas company size, market position, degree of IT dependency,industry and geography. This project chose an industryapproach and started with a pilot study in the financial sectorthat was then replicated in the following four sectors: • Manufacturing and pharmaceuticals• IT professional services, telecommunications and media• Government, utilities (energy, oil and gas) and healthcare • Retail and transportationFor the prioritisation and linking of the goals, a Delphimethod was used. This method is based on a structuredprocess for collecting and distilling knowledge from a groupof experts by means of several feedback rounds. A team ofexperts was asked to prioritise a list of business and IT goalsby using a ranking technique, and the averaged results werereturned to them. Different rounds were performed to achieveconsensus amongst the experts on which were the importantgoals and how the business goals linked to the IT goals. The ISACA database was used as a major source foridentifying subject experts. In total, the participants were 158business and IT professionals (managers and auditors) fromcompanies in one of the sectors previously mentioned andwith more than 150 employees. One of the assumptions wasthat these experts have sufficient knowledge on both IT andbusiness goals. Figure 1 presents the expert team’scomposition by sector and geographic area. How Does the Business Drive IT? Identifying, Prioritising and Linking Business and IT Goals By Wim Van Grembergen, Steven De Haes and Hilde Van BremptIT Professional Service,Telco, Media: 40Government, Utilities,Healthcare: 39Asia: 28Africa: 14Middle East: 18Europe: 37Latin America: 3North America: 51Australia: 7Retail Transportation: 16Expert Team per SectorExpert Team per GeographyFinancial: 38Manufacturing,Pharmaceutical: 25Figure 1—Expert Team CompositionI NFORMATION S YSTEMS C ONTROL J OURNAL, VOLUME 6, 2007FindingsThe following findings resulted from the study.Identification of Business and IT GoalsThe outcome of the exercise was an in-depth understandingof business goals and IT goals, and how they interrelate.During the research, the original list of IT goals and businessgoals (published in COBIT 4.0) was reviewed multiple timesand evolved to a generic list of 17 (IT-related) business goalsand 18 IT goals. Overlaps, inconsistencies and ambiguitiesamongst the different goals were reduced to a minimum. Thegoals turned out to be generically defined and applicableacross all sectors. Figure 2 presents the final list of businessand IT goals, categorised by their corresponding balancedscorecard (BSC) perspectives. The generically defined goalsprovide a guideline to help companies identify their set ofimportant business and IT goals. In practice, enterprises willneed to develop their own subset, but they can do thisefficiently by:• Starting from these generic business and IT goals• Updating them for enterprise specifics (strategy,infrastructure, etc.)• Adding measures to track goal achievementTop 10 Business and IT GoalsBoth lists of business and IT goals have been prioritisedover five different sectors. Figure 3 presents the top 10 mostimportant business and IT goals, consolidated over all sectors.Apart from some minor exceptions, the separate lists of thedifferent sectors include the same business goals and IT goalsin their individual top 10 lists. This proves that there is a veryhigh degree of consensus that these 10 goals are, genericallyspeaking, the most important business goals and IT goals.Filtering the results per company size and geographyconfirmed the stability of these top 10 lists of goals. Financial and Customer-oriented Goals2Although priorities may differ from sector to sector, ingeneral, business goals categorised in the customer andfinancial perspective of the BSC score high in the ranked list,whilst the internal and learning and growth perspective goalsreceive lower scores overall. As an example, the customer-oriented business goals ‘improve customer orientation andservice’ and ‘establish service continuity and availability’ andthe financial-oriented business goals ‘comply with externallaws and regulations’ and ‘manage IT-related business risks’make up the top four in the generic list