8.2 Culture, Ethics, and Behavior

Quick Answer: Culture, ethics and behavior is a first-class COBIT 2019 component of every objective — not a soft afterthought. Desired behaviors must be created, encouraged, and maintained. Individual ethics and organizational ethics both relate to goals. Leadership tone, incentives, sanctions, speak-up channels, and risk culture are the usual levers. A perfect process fails if the culture rewards heroics and hidden workarounds. The exam trap is calling culture “untestable.” COBIT tests it as a designed component.

Chapter 6 already warned that this slot is “often underestimated.” That sentence is not decoration. In the 30% Governance System and Components domain, items that look like process questions are frequently culture questions in disguise. The process document is complete. The committee exists. The policy is signed. Production still runs on a back-door script because that is what last year’s bonus rewarded.

Desired behaviors do not appear by themselves

COBIT does not treat culture as office artwork. For each objective, the enterprise must decide which behaviors the objective requires, then do three jobs:

1. Create the desired behaviors — define them, model them, and put them in goals and codes of conduct.
2. Encourage them — incentives, recognition, tooling that makes the right path the easy path.
3. Maintain them — sanctions, monitoring, speak-up follow-through, and leadership that does not quietly bless the workaround when the quarter is tight.

If any of the three is missing, the component is incomplete. A code of ethics in the employee handbook creates a statement. It does not encourage anything if the only people who were promoted last year were the ones who shipped around the CAB. It does not maintain anything if a reported bypass is “taken offline” and never heard from again.

Write the three verbs on the inside cover of your notes. Stems that say “we published a value statement” have only done the first verb, and maybe not even that if nobody can name a behavior the statement forbids.

Individual ethics and organizational ethics

Two layers sit in this component, and both relate to goals.

Individual ethics is what a person will or will not do when the process is inconvenient — log the incident, refuse the unauthorized change, escalate the unreconciled number. Organizational ethics is what the enterprise systematically rewards, ignores, or punishes — the real rules, not the poster. COBIT cares about both because an objective fails either way: a well-designed bank with one trader who hides losses, or a shop where honest people learn that hiding work is how you keep your job.

Goals connect the layers. If the enterprise goal is “reliable change,” but the personal goal on the scorecard is “features shipped this sprint,” the culture component is fighting the process component. That is a design error, not a motivational-poster gap. Alignment of personal objectives, team objectives, and enterprise goals is how this component supports provide stakeholder value instead of providing last quarter’s hero story.

Levers you should be able to name

Foundation items will not ask you to run an employee-engagement survey. They will ask which levers belong in this component.

These levers are how culture is designed. They are also how it is evidenced. A candidate who says culture cannot be tested has not looked at incentive plans, sanction logs, speak-up metrics, or the last three all-hands. COBIT does not need a feeling. It needs behaviors that can be described, encouraged, and checked.

Related components do not replace this one. A policy can forbid unauthorized production access. Organizational structures can name a CAB. Information can show how many emergency changes landed. None of that operates if the culture treats the CAB as theater. Holistic approach: the culture slot is empty, so the objective is empty, even if the other six slots look populated.

Scenario: Riverbend Payments “just ships”

Riverbend Payments has a complete BAI06 Managed IT Changes process, a weekly CAB, and a policy that production changes require a ticket, a peer review, and a back-out plan. On-call engineers still push Friday-night hotfixes from laptops because last year’s promotions went to the people who “saved the release.” The incident channel treats a logged near-miss as disloyalty. A new join who files a bypass report is told privately to be a team player.

Nothing is wrong with the process text. The culture, ethics and behavior component is failing in all three verbs. Desired behavior (use the change path) was stated, so “create” is half-done. It is not encouraged — incentives point the other way. It is not maintained — speak-up is punished and sanctions never land on the hero. Traders at a sister desk do the same thing with unapproved pricing spreadsheets: the control exists; the behavior is to go around it.

The repair is not a thicker process document. The repair is tone (“I will not praise a silent bypass”), incentives (credit for clean changes and for stopped bad releases), sanctions that apply to stars, and a speak-up path that closes. Until those move, Riverbend is rehearsing a Foundation item: a perfect process that still fails.

Exam traps for this component

• Soft and untestable: This is the big one. COBIT lists culture, ethics and behavior as a component of every objective. If it were untestable, it would not be in the model.
• HR-only / out of EGIT: People operations may own some programs. The component still belongs on APO12, BAI06, DSS02, and EDM01. Governance does not outsource behavior and then claim the objective is complete.
• Process will fix it: More swimlanes do not create courage. If the stem shows a workaround culture, the missing slot is this one.
• One poster equals the component: A values poster is not create + encourage + maintain.
• Replaced processes in 2019: No. All seven components remain. Culture did not eat processes.

How items are written

• Workaround / heroics / “just ship” despite a complete process → this component, not “write another procedure.”
• “Culture is soft; skip it on the exam” → reject.
• Tone, incentives, sanctions, speak-up, risk culture → the lever set for this slot.
• Individual ethics versus organizational ethics → both in scope; both relate to goals.
• “Only EDM needs culture” → reject; every objective includes the slot.

Carry the three verbs and the Riverbend picture into the next section. Skills cannot save an objective if the culture punishes the people who use those skills the right way.