Enhancing IT Risk Management in XYZ Vocational School: Leveraging COBIT 5 Framework with the APO12 Domain

This article explores the importance of IT risk management, especially at XYZ Vocational School. The agency is equipped to manage business risks, emphasizing the need to improve decision-making and risk mitigation by identifying potential hazards and evaluating internal and external threats, including hacking risks. The research investigates IT risk management at XYZ Vocational School using a qualitative and quantitative method with a focus on the APO12 COBIT 5 domain: Align, plan, and organize. It assesses subdomains such as data collection, risk analysis, profile maintenance, risk articulation, portfolio management, and response strategies. Conclusively, the research reveals institutional IT capabilities at level 1 (Performed Process) in the APO12 subdomain. Recommendations include developing COBIT-compliant SOPs for processes at this level, highlighting the need for further improvements in IT governance. This study provides valuable insights into IT risk management practices, offering recommendations for improving IT governance in educational settings.