Overview
Governance System and Components is 30% of the COBIT 2019 Foundation exam, the largest topic area. It covers the building blocks of a governance system for information and technology: processes; organizational structures; principles, policies and procedures; information; culture, ethics and behavior; people, skills and competencies; and services, infrastructure and applications. You need to know what each component contributes, how each is described inside a governance or management objective, and how the components depend on each other.
It also covers two ideas that make COBIT 2019 adaptable. Components can be generic, as described in the core model, or variants, adjusted for a specific purpose. Focus areas group objectives and components around a governance topic such as cybersecurity, DevOps or small and medium enterprises. This area puts the holistic approach principle into practice and supplies the vocabulary used in Governance and Management Objectives and in tailoring.
How it's tested
Questions describe a governance symptom or a piece of guidance and ask which component it belongs to or which component needs attention. Others test whether a described item is a generic component, a variant or a focus area. The reasoning is diagnostic: find the root weakness in the scenario rather than the component that merely appears in it.
-
Which component is weak
A symptom such as staff bypassing an approved process because managers reward speed points to a specific component, here culture, ethics and behavior.
-
Classify the artifact
An item such as a RACI chart, a data quality criterion or a monitoring tool is described, and you identify the component it belongs to.
-
Generic, variant or focus area
You decide whether guidance is the generic core model, a component adjusted for a context, or a collection of objectives and components addressing a topic.
A bank has a documented change process and a clear policy, yet emergency changes skip approval because senior managers praise teams that ship fastest. The question asks which component to address first. Processes and policies already exist and are sound, so rewriting them would not change behavior. The rewarded behavior is the root cause, which points to culture, ethics and behavior. The trap is choosing processes because the symptom appears in change management.
Framework topics 9
Official framework topics from the ISACA outline, in outline order.
3.1 Governance system and componentsWhat a component is and how components work together.
- What it means
- To satisfy governance and management objectives, an enterprise builds a governance system from components: factors that individually and collectively contribute to the good operation of governance over I&T. Components interact and can be generic or variants.
- What to understand
- Generic components are described in the core model and apply in principle to any situation but need adapting. Variants are generic components adjusted for a specific purpose or context, such as a security-oriented policy set.
- How it shows up
- A question asks what distinguishes a component variant from a generic component, or why improving one component alone failed.
- Common confusion
- Using the COBIT 5 term enabler; COBIT 2019 calls them components and treats them as generic or variant.
3.2 ProcessesOrganized practices and activities that achieve objectives.
- What it means
- A process is an organized set of practices and activities that achieves certain objectives and produces a set of outputs supporting overall I&T-related goals. Each COBIT objective contains a process component with practices, activities and example metrics.
- What to understand
- Processes are the component most directly measured with capability levels in Performance Management. A process says what is done and in what order, while policies say what is required and why.
- How it shows up
- A scenario lists management practices, activities and inputs and outputs, and asks which component is being described.
- Common confusion
- Assuming the process component is the whole governance system, when it is one of seven.
3.3 Organizational structuresThe key decision-making entities and their responsibilities.
- What it means
- Organizational structures are the key decision-making entities in an enterprise, such as the board, an executive committee, a steering committee or the CIO role. In COBIT objectives they are shown through RACI charts.
- What to understand
- RACI assigns Responsible (does the work), Accountable (owns the outcome, one per practice), Consulted and Informed. When accountability is unclear or split, decisions stall regardless of process quality.
- How it shows up
- A scenario describes conflicting approvals or nobody owning a decision, and asks which component to fix, or what the A in RACI means.
- Common confusion
- Mixing organizational structures with people, skills and competencies; structures define decision rights, while skills describe capability to perform.
3.4 Principles, policies and proceduresGuidance that translates desired behavior into day-to-day practice.
- What it means
- This component translates desired behavior into practical guidance for day-to-day management, from high-level principles through policies to detailed procedures.
- What to understand
- Policies state what is required and why; procedures state how to comply. Policies that are not communicated, enforced or reviewed lose effect, which is often a symptom examiners use.
- How it shows up
- A scenario shows staff unsure what is allowed, such as for personal cloud storage, and asks which component is missing.
- Common confusion
- Confusing the principles in this component, which an enterprise writes for itself, with COBIT's own governance system principles.
3.5 InformationThe information the governance system needs to function.
- What it means
- Information is pervasive in an enterprise and includes all information produced and used. For governance, COBIT focuses on the information needed for the governance system to work, such as risk profiles, performance reports and investment information.
- What to understand
- Information quality is judged by criteria grouped as intrinsic (for example accuracy and objectivity), contextual (for example relevance, completeness and currency) and security, privacy and accessibility (for example availability and restricted access). Each objective lists information flows and items as inputs and outputs.
- How it shows up
- A board receives late, incomplete performance reports and cannot direct properly, and you identify information as the weak component and name the quality criterion.
- Common confusion
- Treating information as the systems that store it, which belong to services, infrastructure and applications.
3.6 Culture, ethics and behaviorIndividual and enterprise behavior, often underestimated.
- What it means
- This component covers the culture, ethics and behavior of individuals and of the enterprise, which strongly affect whether governance and management activities succeed.
- What to understand
- Behavior is shaped by what leaders reward, tolerate and model. When documented processes and policies are bypassed, the root cause is often here, and fixing it requires leadership action, incentives and communication.
- How it shows up
- A scenario describes rules that exist but are routinely ignored because of incentives, and asks which component is the root cause.
- Common confusion
- Choosing policies or processes because they are where the symptom shows, rather than the behavior that drives it.
3.7 People, skills and competenciesThe capabilities needed to decide and act well.
- What it means
- People, skills and competencies are required for good decisions, corrective action and successful completion of activities. COBIT objectives list the skills relevant to each and reference skill frameworks such as SFIA and the European e-Competence Framework.
- What to understand
- A role can exist on the organizational chart yet be filled by someone without the needed skills; that is a skills gap, not a structure gap. Training, hiring and sourcing address it.
- How it shows up
- A newly appointed data governance lead cannot assess data quality issues, and you identify which component needs investment.
- Common confusion
- Picking organizational structures because a role is involved, when the issue is capability rather than decision rights.
3.8 Services, infrastructure and applicationsThe technology and services that support the governance system.
- What it means
- This component includes the infrastructure, technology, applications and services that provide the enterprise with the governance system for I&T processing, such as risk management tools, architecture repositories, monitoring and reporting platforms.
- What to understand
- Here the technology supports governance itself; it is not the business application portfolio in general. A dashboard tool that feeds board reporting is an example.
- How it shows up
- A question asks which component a governance, risk and compliance tool or service-monitoring platform belongs to.
- Common confusion
- Classifying the information a tool produces as part of this component, when the content itself is the information component.
3.9 Focus areasCollections of objectives and components around a governance topic.
- What it means
- A focus area is a governance topic, domain or issue addressed by a collection of governance and management objectives and their components, such as small and medium enterprises, cybersecurity, digital transformation, cloud computing, privacy or DevOps.
- What to understand
- Focus areas can combine generic components and variants, and the number of focus areas is open-ended; ISACA adds focus area guidance over time. They differ from design factors, which are inputs for tailoring.
- How it shows up
- A question asks what COBIT 2019 offers an enterprise that wants guidance on governing DevOps, and the answer is a focus area.
- Common confusion
- Treating focus areas as a fixed list or as design factors, or thinking each focus area adds new objectives to the core model.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Seven components
Processes; organizational structures; principles, policies and procedures; information; culture, ethics and behavior; people, skills and competencies; services, infrastructure and applications.
- Remember
- Each governance and management objective is described through these components.
- Tested as
- The single most-tested list in the topic area.
- Trap
- Listing them under the COBIT 5 name enablers or omitting procedures from the third component.
-
Generic component
A component as described in the COBIT core model, applicable in principle to any situation but needing adaptation.
- Remember
- Generic means starting point, not final design.
- Tested as
- Generic versus variant questions.
- Trap
- Thinking generic components are meant to be adopted unchanged.
-
Component variant
A generic component adjusted for a specific purpose or context, often within a focus area.
- Remember
- Variants are tailored versions, not new component types.
- Tested as
- Identifying security- or DevOps-specific guidance.
- Trap
- Calling a variant a new focus area.
-
Focus area
A governance topic or issue addressed by a collection of objectives and their components, such as cybersecurity or small and medium enterprises.
- Remember
- Open-ended in number and can mix generic components and variants.
- Tested as
- Questions on where topic-specific guidance comes from.
- Trap
- Confusing focus areas with design factors.
-
RACI chart
The way COBIT shows organizational structures in each objective: Responsible, Accountable, Consulted, Informed.
- Remember
- One Accountable role per practice owns the outcome; Responsible roles do the work.
- Tested as
- Organizational structures questions.
- Trap
- Swapping responsible and accountable.
-
Information quality criteria
Intrinsic, contextual, and security, privacy and accessibility criteria used to judge information.
- Remember
- Accuracy is intrinsic; currency and completeness are contextual; availability is security and accessibility.
- Tested as
- Information component scenarios about poor reporting.
- Trap
- Labeling late reports as an accuracy problem rather than currency.
-
Culture, ethics and behavior
Individual and organizational behavior that determines whether governance activities succeed.
- Remember
- Often the root cause when sound rules are bypassed.
- Tested as
- Root-cause scenarios.
- Trap
- Fixing the symptom by rewriting processes or policies.
-
People, skills and competencies
Capabilities needed for decisions and activities, linked to frameworks such as SFIA and e-CF.
- Remember
- A filled role without the skills is a skills gap.
- Tested as
- Capability gap scenarios.
- Trap
- Choosing organizational structures for a capability problem.
-
Services, infrastructure and applications
Technology and services that support the governance system, such as GRC or monitoring tools.
- Remember
- The tool is this component; the content it holds is information.
- Tested as
- Classifying tools and platforms.
- Trap
- Classifying report content as this component.
-
Principles, policies and procedures
Guidance translating desired behavior into practical day-to-day direction.
- Remember
- Policy says what and why; procedure says how.
- Tested as
- Scenarios of unclear rules.
- Trap
- Confusing enterprise principles here with COBIT's own nine principles.
-
Processes
Organized practices and activities producing outputs toward I&T-related goals.
- Remember
- Measured with capability levels 0 to 5.
- Tested as
- Component classification and link to performance management.
- Trap
- Treating processes as the entire governance system.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Generic component vs. variant vs. focus area
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Generic component | Component as described in the core model | Applies in principle anywhere; must be adapted | Adopting it unchanged as the final design |
| Component variant | Generic component adjusted for a specific purpose or context | A tailored version of one component | Calling it a focus area |
| Focus area | Collection of objectives and components around a governance topic | Topic-level package; open-ended list | Treating it as a design factor or as new objectives |
Organizational structures vs. people, skills and competencies vs. culture, ethics and behavior
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Organizational structures | Decision-making entities and decision rights, shown in RACI charts | Who decides and who is accountable | Using it for a skills gap |
| People, skills and competencies | Capabilities needed to decide and act | Whether people can do the work | Using it when the role is undefined |
| Culture, ethics and behavior | How individuals and the enterprise actually behave | Whether people choose to follow the rules | Overlooking it when rules exist but are ignored |
Information vs. services, infrastructure and applications
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Information | Content the governance system needs, judged by quality criteria | The data and reports themselves | Classifying the reporting tool here |
| Services, infrastructure and applications | Technology and services that support governance | The tools and platforms that hold or process information | Classifying report content here |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Symptom location as root cause
- What candidates pick
- Processes, because the failure appears in a process such as change management.
- Why it looks right
- The scenario is framed around a process.
- Why it's wrong
- If the process and policy are sound but people bypass them because of rewards or pressure, the weak component is culture, ethics and behavior.
Clue to watch for Phrases such as documented process exists, staff are praised for speed, or leaders tolerate exceptions.
-
Structure versus skills
- What candidates pick
- Organizational structures when an appointed role lacks expertise.
- Why it looks right
- A role is mentioned, and roles feel structural.
- Why it's wrong
- The role exists and has decision rights; the gap is capability, which belongs to people, skills and competencies.
Clue to watch for A named role holder cannot perform the analysis or decision expected.
-
Focus area equals design factor
- What candidates pick
- Design factors as the COBIT feature that provides cybersecurity-specific guidance.
- Why it looks right
- Both are COBIT 2019 tailoring concepts.
- Why it's wrong
- Design factors are inputs that influence the design; focus areas are packaged guidance on a topic.
Clue to watch for The enterprise wants guidance content on a topic, not an analysis of its own context.
-
Tool as information
- What candidates pick
- Information for a GRC platform implementation.
- Why it looks right
- The platform holds governance information.
- Why it's wrong
- The platform is services, infrastructure and applications; the risk register entries inside it are information.
Clue to watch for The noun in the question is a system, tool or service rather than a report or data set.
-
Accuracy for every bad report
- What candidates pick
- Accuracy when a board report arrives a month late.
- Why it looks right
- Bad reports feel inaccurate.
- Why it's wrong
- Timeliness is the contextual criterion currency; accuracy is intrinsic and concerns correctness.
Clue to watch for The data is correct but late, incomplete or irrelevant.
-
Generic means mandatory
- What candidates pick
- Adopting generic components exactly as described in the core model.
- Why it looks right
- The core model looks like a ready-made standard.
- Why it's wrong
- Generic components need adaptation, and variants exist precisely to tailor them to context.
Clue to watch for Options stating components must be implemented unchanged.
Answer framework
When a scenario asks which governance component is involved or needs attention, use these steps.
- Name the symptom precisely: unclear rules, unclear ownership, missing capability, rules ignored, poor information, or missing tooling.
- Check whether the documented process and policy are already sound; if they are and are bypassed, look at culture, ethics and behavior.
- Separate decision rights from capability: unclear ownership points to organizational structures, while inability to perform points to people, skills and competencies.
- Separate content from tools: data and reports are information, platforms and services are services, infrastructure and applications.
- If the question asks for topic guidance such as cybersecurity or DevOps, choose a focus area; if it asks about adapting one component, choose a variant.
Practice question
Want more like this? The COBIT 2019 Foundation practice test has questions for every domain.
Checklist
0 of 12
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Give this topic area the largest share of your study time, about 30% to match its weight. Start by memorizing the seven components with their exact names, then write one sentence on what each contributes and one symptom that shows it is weak. That symptom list is the core exam skill.
Next, work on the three confusable pairs: structures versus skills, information versus tools, and culture versus policies and processes. Practice root-cause reasoning: if a scenario says the rule exists and is sound, look past processes and policies. Learn the RACI letters precisely and the three groups of information quality criteria, because both turn into quick factual questions.
Candidates underestimate focus areas and the generic versus variant distinction; spend a short session on them and on how they differ from design factors. Afterwards, study Governance and Management Objectives, where each objective is described through these components, then practice mixed diagnostic questions until you can identify the weak component from the symptom alone.
FAQ
How much of the exam is Governance System and Components?
ISACA weights it at 30%, the largest topic area. On a planning basis that is roughly 23 of the 75 questions, though ISACA does not publish per-area counts.
What are the seven components?
Processes; organizational structures; principles, policies and procedures; information; culture, ethics and behavior; people, skills and competencies; and services, infrastructure and applications.
Are components the same as COBIT 5 enablers?
They are the COBIT 2019 successor to the enablers, with refined names and the addition of generic components, variants and focus areas. Use the COBIT 2019 term components on the exam.
What is a focus area?
A governance topic, domain or issue, such as cybersecurity or small and medium enterprises, addressed by a collection of governance and management objectives and their components. The list is open-ended.
How do I tell which component is weak in a scenario?
Find the root cause rather than where the symptom appears. Sound rules that are bypassed point to culture; unclear ownership points to structures; inability to perform points to skills.
Do I need to memorize the information quality criteria?
Know the three groups, intrinsic, contextual, and security, privacy and accessibility, and a few examples in each, such as accuracy, currency and availability.
How does this area link to the objectives topic area?
Each of the 40 governance and management objectives is described through these components: process practices, RACI charts, information flows, skills, policies, culture and supporting services.
Other Enterprise Architecture & IT Governance certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 3 knowledge
You have covered the seven components, how generic components become variants and how focus areas package guidance. Check whether you can diagnose the weak component from a scenario under exam timing.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the COBIT 2019 Foundation AI tutor Get any concept explained your way