Overview
Governance and Management Objectives is 23% of the COBIT 2019 Foundation exam, the second-heaviest topic area. It covers the COBIT core model: 40 objectives, each with a purpose statement and a related process, described through the governance system components. The five governance objectives sit in Evaluate, Direct and Monitor (EDM). The 35 management objectives sit in Align, Plan and Organize (APO, 14), Build, Acquire and Implement (BAI, 11), Deliver, Service and Support (DSS, 6) and Monitor, Evaluate and Assess (MEA, 4).
The topic area also covers the goals cascade, which translates stakeholder drivers and needs into 13 enterprise goals, then into 13 alignment goals, and finally into the governance and management objectives to prioritize. You need to place a described activity in the right domain and objective, and to trace how a business need points to particular objectives.
How it's tested
Questions describe an activity, outcome or concern and ask which domain or objective covers it, or which goal level in the cascade a statement belongs to. Governance versus management is the first cut, then the domain verb, then the specific objective. Distractors are usually objectives with similar names in a different domain.
-
Which objective covers this
An activity such as defining risk appetite or handling a recurring outage is described, and you choose the objective that owns it, such as EDM03 or DSS03.
-
Which domain
You identify the domain from the activity type: setting direction is EDM, planning and organizing is APO, building and changing is BAI, operating is DSS, monitoring and assurance is MEA.
-
Goals cascade level
A statement is classified as a stakeholder need, an enterprise goal, an alignment goal or an objective, or you trace which comes first.
A question says the board wants assurance that the enterprise's I&T risk appetite is defined, communicated and respected, and asks which objective applies. Defining and directing on risk appetite is governance, which rules out APO12 Managed risk, the management objective that identifies, assesses and responds to risk day to day. The board-level evaluation and direction of risk appetite belongs to EDM03 Ensured risk optimization.
Framework topics 7
Official framework topics from the ISACA outline, in outline order.
4.1 Governance and management objectives and the COBIT core modelForty objectives, each with a purpose statement and a related process.
- What it means
- The COBIT core model contains 40 governance and management objectives in five domains. Each objective relates to one process of the same name and to a set of related components, and has a purpose statement explaining what it achieves.
- What to understand
- Governance objectives begin with Ensured and sit in EDM; management objectives begin with Managed and sit in APO, BAI, DSS and MEA. An objective is described through all seven components, not only through its process.
- How it shows up
- A question asks how many objectives the core model contains, how the domains split, or what an objective consists of.
- Common confusion
- Equating an objective with its process; the objective also covers structures, information, skills, policies, culture and supporting services.
4.2 Evaluate, Direct and Monitor (EDM)The five governance objectives.
- What it means
- EDM holds the five governance objectives: EDM01 Ensured governance framework setting and maintenance, EDM02 Ensured benefits delivery, EDM03 Ensured risk optimization, EDM04 Ensured resource optimization and EDM05 Ensured stakeholder engagement.
- What to understand
- The governance body evaluates strategic options, directs management and monitors achievement. EDM02, EDM03 and EDM04 mirror the three parts of value creation, which makes them easy to recall.
- How it shows up
- A board-level activity such as setting risk appetite or ensuring transparent stakeholder reporting is described, and you choose the EDM objective.
- Common confusion
- Choosing a management objective with a similar subject, such as APO12 Managed risk, for a board-level risk appetite decision.
4.3 Align, Plan and Organize (APO)Fourteen management objectives for organization, strategy and support.
- What it means
- APO covers the overall organization, strategy and supporting activities for I&T: APO01 Managed I&T management framework through APO14 Managed data, including strategy, enterprise architecture, innovation, portfolio, budget and costs, human resources, relationships, service agreements, vendors, quality, risk and security.
- What to understand
- APO is where management plans and organizes, so risk management (APO12) and the information security management system (APO13) sit here. APO14 Managed data is new in COBIT 2019.
- How it shows up
- A scenario about managing supplier performance, defining an enterprise architecture or running an information security management system points to an APO objective.
- Common confusion
- Confusing APO13 Managed security, which defines and maintains the security management system, with DSS05 Managed security services, which operates protections day to day.
4.4 Build, Acquire and Implement (BAI)Eleven management objectives for defining, acquiring and implementing solutions.
- What it means
- BAI covers the definition, acquisition and implementation of I&T solutions and their integration into business processes, from BAI01 Managed programs to BAI11 Managed projects, including requirements, solution build, availability and capacity, organizational change, IT changes, change acceptance, knowledge, assets and configuration.
- What to understand
- BAI06 Managed IT changes controls technical changes, BAI05 Managed organizational change handles the people side of change, and BAI07 covers acceptance and transition into production. BAI11 Managed projects is new and separate from BAI01 Managed programs.
- How it shows up
- A scenario about capacity planning for a new system, user resistance to a new process, or controlling production changes points to the right BAI objective.
- Common confusion
- Placing availability and capacity in DSS because it sounds operational; in COBIT 2019 it is BAI04.
4.5 Deliver, Service and Support (DSS)Six management objectives for operating I&T services.
- What it means
- DSS covers operational delivery and support: DSS01 Managed operations, DSS02 Managed service requests and incidents, DSS03 Managed problems, DSS04 Managed continuity, DSS05 Managed security services and DSS06 Managed business process controls.
- What to understand
- DSS02 restores normal service quickly, while DSS03 finds and removes root causes of recurring incidents. DSS06 covers controls within business processes, such as input validation and segregation of duties in transactions.
- How it shows up
- A scenario about a recurring outage needing root-cause analysis, or about business continuity testing, points to DSS03 or DSS04.
- Common confusion
- Choosing DSS02 for root-cause work on recurring incidents, which is DSS03 Managed problems.
4.6 Monitor, Evaluate and Assess (MEA)Four management objectives for monitoring, control and assurance.
- What it means
- MEA covers monitoring of performance and conformance: MEA01 Managed performance and conformance monitoring, MEA02 Managed system of internal control, MEA03 Managed compliance with external requirements and MEA04 Managed assurance.
- What to understand
- MEA is a management domain that monitors against internal performance targets, internal controls, external requirements and assurance plans. MEA04 Managed assurance is new in COBIT 2019 and covers planning and executing assurance initiatives.
- How it shows up
- A scenario about tracking regulatory requirements or planning an independent assurance review points to MEA03 or MEA04.
- Common confusion
- Treating MEA as governance because it monitors; governance monitoring sits in EDM, while MEA is management monitoring.
4.7 Goals cascadeFrom stakeholder drivers to the objectives that matter most.
- What it means
- The goals cascade translates stakeholder drivers and needs into enterprise goals (13), then into alignment goals (13), and then into governance and management objectives to prioritize. Enterprise and alignment goals are organized by balanced scorecard dimensions: financial, customer, internal, and growth.
- What to understand
- Enterprise goals describe business outcomes such as managed business risk; alignment goals describe I&T outcomes that support them, such as managed I&T-related risk. The cascade is a prioritization aid used with design factors, and alignment goals replaced COBIT 5's IT-related goals.
- How it shows up
- A question gives a goal statement and asks which level of the cascade it belongs to, or asks what links enterprise goals to objectives.
- Common confusion
- Calling alignment goals IT-related goals, or reversing the order of enterprise and alignment goals.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Core model domain counts
EDM 5, APO 14, BAI 11, DSS 6, MEA 4, for 40 objectives in total.
- Remember
- Five governance objectives and 35 management objectives.
- Tested as
- Direct recall and quick checks on distractors.
- Trap
- Quoting COBIT 5's 37 processes.
-
Ensured versus Managed
Governance objectives are named Ensured; management objectives are named Managed.
- Remember
- The name tells you whether an objective is in EDM.
- Tested as
- Lets you eliminate wrong-domain options instantly.
- Trap
- Assuming any monitoring objective is governance.
-
EDM03 Ensured risk optimization
Governance objective making sure risk appetite and tolerance are understood, articulated and communicated, and risk to enterprise value is identified and managed.
- Remember
- Board-level direction on risk.
- Tested as
- Risk appetite scenarios.
- Trap
- Choosing APO12 Managed risk.
-
APO12 Managed risk
Management objective that continually identifies, assesses and reduces I&T-related risk within the tolerance set by executive management.
- Remember
- Day-to-day risk management within limits set by governance.
- Tested as
- Risk register and risk response scenarios.
- Trap
- Choosing EDM03 for operational risk assessment.
-
APO13 vs. DSS05
APO13 Managed security defines, operates and monitors the information security management system; DSS05 Managed security services protects information through day-to-day security operations.
- Remember
- APO13 manages the security system; DSS05 delivers the protections.
- Tested as
- Security scenarios.
- Trap
- Choosing APO13 for malware protection or user access administration.
-
DSS02 vs. DSS03
DSS02 restores service after incidents and fulfils requests; DSS03 identifies root causes of problems and prevents recurrence.
- Remember
- Restore versus prevent recurrence.
- Tested as
- Recurring outage scenarios.
- Trap
- Choosing DSS02 for root-cause analysis.
-
BAI05 vs. BAI06
BAI05 Managed organizational change prepares people for business change; BAI06 Managed IT changes controls technical changes to systems.
- Remember
- People side versus technical side of change.
- Tested as
- Change scenarios.
- Trap
- Choosing BAI06 for user adoption problems.
-
New COBIT 2019 objectives
APO14 Managed data, BAI11 Managed projects and MEA04 Managed assurance.
- Remember
- One added in each of APO, BAI and MEA.
- Tested as
- Change from COBIT 5 questions.
- Trap
- Thinking EDM gained a new objective.
-
Goals cascade
Stakeholder drivers and needs lead to enterprise goals, then alignment goals, then governance and management objectives.
- Remember
- 13 enterprise goals and 13 alignment goals, organized by balanced scorecard dimensions.
- Tested as
- Level classification and order questions.
- Trap
- Putting alignment goals before enterprise goals.
-
Alignment goals
I&T-related outcomes that support enterprise goals, numbered AG01 to AG13.
- Remember
- The COBIT 2019 replacement for COBIT 5's IT-related goals.
- Tested as
- Cascade terminology questions.
- Trap
- Using the term IT-related goals.
-
Purpose statement
The short description in each objective of what it achieves.
- Remember
- Learn purposes for the confusable objectives rather than all practices.
- Tested as
- Questions that describe a purpose and ask for the objective.
- Trap
- Matching on a keyword in the objective name instead of the purpose.
-
MEA versus EDM monitoring
MEA monitors performance, internal control, external compliance and assurance as a management domain; EDM monitors as governance.
- Remember
- MEA is management, despite its name.
- Tested as
- Domain classification.
- Trap
- Calling MEA a governance domain.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
EDM03 Ensured risk optimization vs. APO12 Managed risk
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| EDM03 Ensured risk optimization | Governance makes sure risk appetite and tolerance are understood and communicated and risk to value is managed | Board-level evaluation and direction | Using it for maintaining a risk register |
| APO12 Managed risk | Management identifies, assesses and responds to I&T-related risk | Operational risk management within set tolerance | Using it for setting risk appetite |
APO13 Managed security vs. DSS05 Managed security services
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| APO13 Managed security | Define, operate and monitor an information security management system | Plans and manages the security system | Using it for daily malware or access operations |
| DSS05 Managed security services | Protect information through operational security services | Delivers protections such as endpoint security and identity management | Using it for the security strategy and management system |
DSS02 vs. DSS03 vs. BAI06
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| DSS02 Managed service requests and incidents | Restore normal service and fulfil user requests | Speed of restoration | Using it for root-cause elimination |
| DSS03 Managed problems | Identify root causes and prevent recurrence | Root cause and permanent fix | Using it for single isolated incidents |
| BAI06 Managed IT changes | Control changes to systems and infrastructure | Authorizes and controls the fix being deployed | Forgetting that a problem fix still goes through change control |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Same subject, wrong level
- What candidates pick
- APO12 Managed risk for a board decision on risk appetite.
- Why it looks right
- The objective name contains risk.
- Why it's wrong
- Setting and communicating risk appetite is governance, covered by EDM03 Ensured risk optimization.
Clue to watch for The board or a governance committee is deciding or directing.
-
Security system versus security operations
- What candidates pick
- APO13 for deploying endpoint protection and managing user access rights.
- Why it looks right
- APO13 is called Managed security.
- Why it's wrong
- Day-to-day protection services belong to DSS05 Managed security services; APO13 manages the security management system.
Clue to watch for Operational tasks such as malware protection, identity administration or monitoring security events.
-
Incident versus problem
- What candidates pick
- DSS02 for finding why the same outage recurs every month.
- Why it looks right
- The scenario mentions incidents.
- Why it's wrong
- Root-cause analysis and preventing recurrence belong to DSS03 Managed problems.
Clue to watch for Words such as recurring, root cause or permanent fix.
-
Technical change versus organizational change
- What candidates pick
- BAI06 for staff refusing to use a new system.
- Why it looks right
- The scenario involves a change.
- Why it's wrong
- Preparing and committing people to business change is BAI05 Managed organizational change.
Clue to watch for User resistance, adoption, communication or training needs.
-
MEA as governance
- What candidates pick
- MEA when asked for the governance domain.
- Why it looks right
- Monitor and evaluate sound like governance verbs.
- Why it's wrong
- EDM is the only governance domain; MEA is a management domain.
Clue to watch for The question asks for governance objectives or the board's role.
-
Cascade order
- What candidates pick
- Alignment goals as the step directly after stakeholder needs.
- Why it looks right
- Alignment sounds like the first link to the business.
- Why it's wrong
- Stakeholder drivers and needs cascade to enterprise goals first, then alignment goals, then objectives.
Clue to watch for Questions asking what comes next or which goal type describes a business outcome.
Answer framework
To place an activity in the right domain and objective, work from level to domain to objective.
- Decide whether the board-level governance body is evaluating, directing or monitoring; if so, choose among the five EDM objectives.
- Otherwise pick the management domain by verb: plan and organize for APO, build or change for BAI, operate and support for DSS, monitor and assure for MEA.
- Within the domain, match the purpose statement of the objective rather than a keyword that happens to appear in its name.
- Check the confusable pairs: EDM03 and APO12, APO13 and DSS05, DSS02 and DSS03, BAI05 and BAI06.
- For cascade questions, order the levels as stakeholder needs, enterprise goals, alignment goals, then objectives, and classify business outcomes as enterprise goals.
Practice question
Want more like this? The COBIT 2019 Foundation practice test has questions for every domain.
Checklist
0 of 12
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Begin with the shape of the core model: five domains, the verb behind each and the count of objectives, 5, 14, 11, 6 and 4. Then learn the five EDM objectives completely, since they are few and map neatly onto value creation and stakeholder engagement.
For the 35 management objectives, aim to recognize each one's name and domain, and learn the purpose of the confusable pairs in detail. Build a one-page table of EDM03 and APO12, APO13 and DSS05, DSS02 and DSS03, and BAI05 and BAI06 with a scenario clue for each side. Note the three objectives new in COBIT 2019 and that BAI04 availability and capacity sits in BAI, not DSS.
Candidates underestimate the goals cascade; learn the four levels in order, the 13 and 13 counts and the balanced scorecard dimensions. Afterwards, study Designing a Tailored Governance System, where design factors change which of these objectives to prioritize, and drill questions that describe an activity and ask for the objective.
FAQ
How much of the exam is Governance and Management Objectives?
ISACA weights it at 23%, the second-largest topic area. On a planning basis that is roughly 17 of the 75 questions, though ISACA does not publish per-area counts.
Do I need to memorize all 40 objectives?
You should recognize all 40 names and their domains, and know the purpose of the commonly confused ones. Detailed practices and activities are less important at Foundation level.
Which domain is governance?
Only Evaluate, Direct and Monitor (EDM), with five objectives. APO, BAI, DSS and MEA are management domains, including MEA despite its monitoring focus.
What is the difference between enterprise goals and alignment goals?
Enterprise goals describe business outcomes, such as managed business risk. Alignment goals describe I&T outcomes that support them, such as managed I&T-related risk, and then point to objectives.
Which objectives are new in COBIT 2019?
APO14 Managed data, BAI11 Managed projects and MEA04 Managed assurance, which take the COBIT 5 total of 37 processes to 40 objectives.
How do objectives relate to the seven components?
Each objective relates to one process and to a set of related components, including RACI-based organizational structures, information flows, skills, policies, culture and supporting services.
How does this area connect to tailoring?
Design factors and the goals cascade are used together to decide which objectives matter most and what capability level to target for each, which is covered in Designing a Tailored Governance System.
Other Enterprise Architecture & IT Governance certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 4 knowledge
You have covered the 40-objective core model, the five domains, the confusable objective pairs and the goals cascade. Check whether you can place activities in the right objective under exam timing.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the COBIT 2019 Foundation AI tutor Get any concept explained your way