Cobit is a tool that helps people to manage rather than telling them how to manage. I think that the way COBIT is put together it allows for easier management of possible threats. The program allows for early detection and recognition of anything that the program may deem hurtful. Such as: * To establish and reduce the likelihood and impact of IT risks. * To establish cost-effective action plans for critical IT risks.
And these goals correspond to the following metrics: * Percent of identified critical IT events that have been assessed. * Number of newly identified IT risks (compared to previous exercise). * Number of significant incidents caused by risks that were not identified by the risk assessment process. * Percent of identified critical IT risks with an action plan developed.
With the above bulleted points you can more effectively navigate your way through the problem at hand and gain a clearer perspective of what the problem is. (http://searchsecurity.techtarget.com/tip/How-to-use-COBIT-for-compliance)
The purpose of the RACI, I feel is to help one to delegate who is responsible for what and what actions would be taken when a problem occurs. To me the various forms of RACI that I have seen seem to have little variance to them. And that basically you assign one person per letter as in (http://project-management.com/understanding-responsibility-assignment-matrix-raci-matrix).
I find RACI can be very helpful tool in for projects. It is helpful to define Roles and Responsibilities in cross functional teams where the lines are blurred, particularly around Responsible and Accountable from a leadership, Also RACI helps those on different levels be able to participate on a more level field. From what I have read this just helps the whole flow of problem solving and with the proper delegation less confusion of who does what and how they