According to the COBIT 2019 Study Manual from Isaca, the output of the "what needs to be done" phase is a high-level program plan. This plan identifies the required resources, activities, and timelines for the implementation of the governance system, as well as any proposed changes that need to be made to the existing system. It is important to have this plan in place before proceeding with the implementation of any changes, as it will help ensure the success of the governance system.

According to the ISACA COBIT 2019 Framework, the Legal office is responsible for executing contracts that retain independent legal consultants to review the level of regulatory compliance of a proposed IT solution. This is specified in Domain 1, Objective 1.2: "Ensure external legal, regulatory and contractual compliance". The Legal office is responsible for ensuring compliance with applicable laws and regulations, as well as for managing risk associated with any non-compliance.