Overview
Designing a Tailored Governance System is 7% of the COBIT 2019 Foundation exam and covers the method described in the COBIT 2019 Design Guide. Eleven design factors describe the enterprise's context: enterprise strategy, enterprise goals, risk profile, I&T-related issues, threat landscape, compliance requirements, role of IT, sourcing model for IT, IT implementation methods, technology adoption strategy and enterprise size. Each factor can change the priority and target capability level of objectives, call for component variants, or point to specific focus areas.
The design workflow has four stages: understand the enterprise context and strategy, determine the initial scope of the governance system, refine that scope, and conclude the design by resolving conflicts. This area applies the tailored and dynamic principles and feeds Implementation, where the design becomes an improvement program.
How it's tested
Questions describe an enterprise characteristic and ask which design factor it represents, what effect a factor value has on the governance system, or which stage of the design workflow is under way. The reasoning is to identify the factor by its exact name and possible values, then apply the stage sequence.
-
Name the design factor
A characteristic such as moving to DevOps delivery or a heavily regulated market is described, and you name the factor, here IT implementation methods or compliance requirements.
-
Effect of a factor value
You predict the impact of a factor value, such as a high threat landscape raising the priority of security-related objectives and target capability levels.
-
Which design stage
An activity in the design process is described, and you place it in one of the four stages.
A question says the design team has set initial objective priorities from strategy, goals, risk profile and I&T-related issues, and is now assessing a strict new regulatory regime and a move to cloud sourcing. It asks which stage this is. Initial scope used the first four factors in stage 2; adjusting priorities with the remaining factors, including compliance requirements and sourcing model, is stage 3, refine the scope of the governance system.
Framework topics 4
Official framework topics from the ISACA outline, in outline order.
6.1 Design factorsThe eleven factors that describe an enterprise's context.
- What it means
- Design factors are factors that can influence the design of an enterprise's governance system and position it for success. COBIT 2019 defines eleven: enterprise strategy, enterprise goals, risk profile, I&T-related issues, threat landscape, compliance requirements, role of IT, sourcing model for IT, IT implementation methods, technology adoption strategy and enterprise size.
- What to understand
- Several factors have defined values: strategy archetypes (growth or acquisition, innovation or differentiation, cost leadership, client service or stability), threat landscape (normal or high), compliance requirements (low, normal or high), role of IT (support, factory, turnaround, strategic), sourcing (outsourcing, cloud, insourced, hybrid), implementation methods (agile, DevOps, traditional, hybrid) and technology adoption (first mover, follower, slow adopter).
- How it shows up
- A scenario describes an enterprise characteristic and asks which design factor or factor value it represents.
- Common confusion
- Inventing factors such as industry sector or IT budget, or mixing the role of IT values, for example calling an IT function that is critical to operations but not to innovation strategic instead of factory.
6.2 Impact of design factorsPriorities and capability targets, component variations and focus areas.
- What it means
- Design factors influence the governance system in three ways: the priority and target capability level of governance and management objectives, the variations of components that are needed, and the specific focus areas that apply.
- What to understand
- Examples: a high threat landscape raises priority and targets for security-related objectives; a small and medium enterprise may need component variants with fewer roles and structures; DevOps as an implementation method points to the DevOps focus area.
- How it shows up
- A factor value is given and you choose its most likely effect, such as which objectives gain priority.
- Common confusion
- Thinking design factors add or remove objectives from the core model; they change priority and capability targets of the existing 40.
6.3 Governance system design workflowFour stages from context to a concluded design.
- What it means
- The Design Guide workflow has four stages: 1 understand the enterprise context and strategy, 2 determine the initial scope of the governance system, 3 refine the scope of the governance system, and 4 conclude the governance system design.
- What to understand
- Stage 1 examines enterprise strategy, enterprise goals, risk profile and current I&T-related issues. Stage 2 converts them into initial objective priorities, using the goals cascade. Stage 3 adjusts that scope using the other seven design factors.
- How it shows up
- A design activity is described and you identify its stage, or you identify which factors are considered in a given stage.
- Common confusion
- Placing compliance requirements or enterprise size in stage 1 or 2, when they are used to refine the scope in stage 3.
6.4 Resolving design conflicts and concluding the designStage 4: reconcile competing guidance and finalize.
- What it means
- In stage 4, the design team resolves conflicts between the guidance coming from different design factors and then concludes the governance system design.
- What to understand
- Factors can pull in different directions, for example an agile implementation method and high compliance requirements. The team weighs them with judgment and stakeholder input, and the output is a set of prioritized objectives with target capability levels, required component variants and relevant focus areas.
- How it shows up
- A scenario shows two factors suggesting contradictory priorities and asks what the next design step is.
- Common confusion
- Assuming the design tool resolves conflicts automatically, or skipping straight to implementation without concluding the design.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Eleven design factors
Enterprise strategy, enterprise goals, risk profile, I&T-related issues, threat landscape, compliance requirements, role of IT, sourcing model for IT, IT implementation methods, technology adoption strategy, enterprise size.
- Remember
- Exactly eleven, with exact names.
- Tested as
- Identification questions in almost every item from this area.
- Trap
- Adding industry sector, budget or geography.
-
Enterprise strategy archetypes
Growth or acquisition, innovation or differentiation, cost leadership, client service or stability.
- Remember
- Four archetypes, usually with one primary and one secondary.
- Tested as
- Strategy-based scenarios.
- Trap
- Confusing cost leadership with client service or stability.
-
Role of IT
Support, factory, turnaround or strategic, based on how critical IT is for running and for innovating the business.
- Remember
- Factory: critical to running, not innovation. Turnaround: drives innovation, not yet critical to running. Strategic: both.
- Tested as
- A favored factor-value question.
- Trap
- Calling a factory role strategic.
-
Threat landscape
The general threat environment the enterprise operates in, rated normal or high.
- Remember
- High raises the priority of security-related objectives.
- Tested as
- Effect-of-factor questions.
- Trap
- Confusing it with risk profile, which is the enterprise's own risk categories.
-
Compliance requirements
The level of compliance obligations, rated low, normal or high.
- Remember
- High raises the priority of compliance and assurance objectives such as MEA03.
- Tested as
- Regulated-industry scenarios.
- Trap
- Treating it as part of risk profile.
-
Sourcing model for IT
Outsourcing, cloud, insourced or hybrid.
- Remember
- Heavy outsourcing or cloud raises the importance of vendor and service agreement objectives.
- Tested as
- Cloud and outsourcing scenarios.
- Trap
- Confusing it with technology adoption strategy.
-
IT implementation methods
Agile, DevOps, traditional or hybrid.
- Remember
- DevOps points to the DevOps focus area.
- Tested as
- Delivery-method scenarios.
- Trap
- Confusing it with technology adoption strategy.
-
Technology adoption strategy
First mover, follower or slow adopter.
- Remember
- Describes how quickly new technology is adopted, not how it is delivered.
- Tested as
- Innovation scenarios.
- Trap
- Labeling an agile shop a first mover.
-
Enterprise size
Large enterprise or small and medium enterprise.
- Remember
- Small and medium enterprises may use component variants with fewer roles and structures.
- Tested as
- Size-based tailoring questions.
- Trap
- Assuming small enterprises can ignore governance.
-
Three impacts of design factors
Objective priority and target capability levels, component variations, specific focus areas.
- Remember
- Factors adjust the existing 40 objectives; they do not add new ones.
- Tested as
- Effect questions.
- Trap
- Saying design factors create new objectives.
-
Four design stages
Understand context and strategy; determine initial scope; refine scope; conclude the design.
- Remember
- First four factors drive stages 1 and 2; the other seven refine in stage 3; conflicts are resolved in stage 4.
- Tested as
- Stage identification questions.
- Trap
- Placing refinement factors in the initial scope stage.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Role of IT: support vs. factory vs. turnaround vs. strategic
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Support | IT is not crucial for running or innovating business processes | Low on both dimensions | Assuming support means IT is unimportant to governance |
| Factory | IT failure immediately affects running the business, but IT is not a driver of innovation | Critical to operations only | Calling it strategic |
| Turnaround | IT drives innovation in processes and strategy, without critical dependency for current operations | Critical to innovation only | Confusing it with factory |
| Strategic | IT is critical for both running and innovating the business | High on both dimensions | Using it for any IT-heavy enterprise |
Design factors vs. focus areas
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Design factors | Eleven context characteristics that influence the governance system design | Inputs to tailoring | Treating them as guidance content |
| Focus areas | Collections of objectives and components around a governance topic | Possible outputs of tailoring, such as DevOps guidance | Listing them as design factors |
Threat landscape vs. risk profile
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Threat landscape | The external threat environment, normal or high | Environment the enterprise operates in | Using it for the enterprise's own risk categories |
| Risk profile | The enterprise's current I&T-related risk exposure across risk categories | Enterprise-specific risk assessment | Using it for sector-wide threat levels |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Invented design factor
- What candidates pick
- Industry sector as the design factor behind a bank's tailoring.
- Why it looks right
- Industry clearly shapes governance in practice.
- Why it's wrong
- Industry is not one of the eleven factors; its effects show through compliance requirements, threat landscape and risk profile.
Clue to watch for An option that names a factor not on the list of eleven.
-
Factory called strategic
- What candidates pick
- Strategic for an enterprise whose operations stop when IT fails but which does not use IT to innovate.
- Why it looks right
- IT is obviously critical.
- Why it's wrong
- Strategic requires IT to be critical for both running and innovating; critical for running only is factory.
Clue to watch for The scenario says IT is not a source of new products or strategy.
-
Wrong design stage
- What candidates pick
- Determine the initial scope for a step that weighs compliance requirements and enterprise size.
- Why it looks right
- Scope sounds like it covers everything.
- Why it's wrong
- Initial scope uses the first four factors; the other seven, including compliance and size, refine the scope in stage 3.
Clue to watch for Initial priorities already exist and are being adjusted.
-
Factors add objectives
- What candidates pick
- An option saying a high threat landscape adds new security objectives to the core model.
- Why it looks right
- More risk seems to require more objectives.
- Why it's wrong
- Design factors change the priority and target capability of existing objectives, and may add focus areas or component variants, not new core objectives.
Clue to watch for Options that say add objectives or create new domains.
-
Adoption versus implementation method
- What candidates pick
- Technology adoption strategy for a move from waterfall to DevOps delivery.
- Why it looks right
- Both involve change in how technology is used.
- Why it's wrong
- How solutions are delivered is IT implementation methods; how early new technology is adopted is technology adoption strategy.
Clue to watch for Words such as agile, DevOps, waterfall or delivery pipeline.
-
Automatic conflict resolution
- What candidates pick
- Letting the design toolkit average conflicting priorities without review.
- Why it looks right
- The toolkit produces numbers.
- Why it's wrong
- Stage 4 requires the team to resolve conflicts with judgment before concluding the design.
Clue to watch for Two factors point in opposite directions and the question asks for the next step.
Answer framework
For any design-factor or design-workflow question, use these steps in order.
- Identify the characteristic described and match it to one of the eleven design factors by exact name, rejecting any factor that is not on the list.
- Pin down the factor value, such as factory versus strategic or DevOps versus first mover, using its defining test.
- Predict the impact: objective priority and capability target, component variant, or focus area, without adding new core objectives.
- Place the activity in the workflow: context in stage 1, initial scope from the first four factors in stage 2, refinement with the other seven in stage 3.
- If factors conflict, choose the option that resolves the conflict with judgment and stakeholder input in stage 4 before implementation.
Practice question
Want more like this? The COBIT 2019 Foundation practice test has questions for every domain.
Checklist
0 of 11
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with the list of eleven design factors and learn it as two groups: the four that describe context and build the initial scope, and the seven that refine it. That grouping also answers most workflow-stage questions. Write the defined values beside each factor that has them.
Spend extra time on the role of IT, because the four values are easy to confuse. Draw a two-by-two grid with critical for running on one axis and critical for innovating on the other, then place support, factory, turnaround and strategic in it. Do the same for implementation methods versus technology adoption strategy, which candidates mix up.
Candidates underestimate the difference between design factors and focus areas and the rule that factors change priorities rather than adding objectives. Afterwards, revisit Performance Management for target capability levels, then study Implementation, which turns the concluded design into an improvement program, and drill factor-identification questions until each takes under a minute.
FAQ
How much of the exam is Designing a Tailored Governance System?
ISACA weights it at 7%, roughly five of the 75 questions on a planning basis. ISACA does not publish per-area question counts.
How many design factors are there?
Eleven: enterprise strategy, enterprise goals, risk profile, I&T-related issues, threat landscape, compliance requirements, role of IT, sourcing model for IT, IT implementation methods, technology adoption strategy and enterprise size.
What are the four stages of the design workflow?
Understand the enterprise context and strategy, determine the initial scope of the governance system, refine the scope of the governance system, and conclude the governance system design.
What does a design factor change?
It can change the priority and target capability level of objectives, call for component variants, or make specific focus areas relevant.
What is the difference between the factory and strategic roles of IT?
In a factory role, IT is critical to running the business but not to innovation. In a strategic role, IT is critical to both running and innovating.
Are focus areas a type of design factor?
No. Design factors are inputs describing the enterprise; focus areas are guidance packages that a factor value can make relevant, such as DevOps.
How does this area relate to the principles?
It puts the tailored to enterprise needs principle into practice, and the dynamic governance system principle requires revisiting the design when a factor changes.
Other Enterprise Architecture & IT Governance certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 6 knowledge
You have covered the eleven design factors, their effects and the four-stage design workflow. Check whether you can name factors and stages accurately from short scenarios.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the COBIT 2019 Foundation AI tutor Get any concept explained your way