COBIT 2019 Foundation · Domain 5 of 8

COBIT 2019 Foundation Domain 5: Performance Management

A small topic area with exact answers: the CMMI-based capability levels used for processes, the rating scale for achieving them, and the maturity levels used for focus areas.

Exam weight
4%
Official framework topics estimate
5
Estimated questions estimate
~3
Suggested study time estimate
2–3 hrs

About 14 min read Reviewed October 2026

Overview

Performance Management is 4% of the COBIT 2019 Foundation exam and covers COBIT performance management (CPM): how an enterprise judges how well its governance system and components work, and where to improve. COBIT 2019 uses a capability scheme inspired by CMMI. Processes receive capability levels from 0 to 5, each process activity is associated with a capability level, and the achievement of a level is rated as fully, largely, partially or not achieved. Focus areas receive maturity levels from 0 to 5, reached when all processes in the focus area reach the matching capability level.

The topic area also covers how other components are assessed, such as information through quality criteria, and how this differs from the COBIT 5 assessment approach based on ISO/IEC 15504. It connects to Designing a Tailored Governance System, where target capability levels are set, and to Implementation, where gaps are measured.

How it's tested

Questions describe a process or focus area and ask which level it has reached, what distinguishes two adjacent levels, or which rating applies to a percentage of achievement. Some ask whether a concept is capability or maturity. The reasoning is to find the highest level whose description fully matches the evidence in the scenario.

  • Name the level

    A process is described, such as one that is documented and standardized across the enterprise but not measured, and you choose the capability level, here 3.

  • Adjacent level difference

    You identify what separates level 2 from level 3, or level 4 from level 5, using the defining characteristic of each.

  • Capability or maturity

    You decide whether a rating applies to a single process or to a focus area made of several processes.

Reasoning it through

A question says incident management is performed with a complete basic set of activities in every team, but each team follows its own approach and nothing is standardized across the enterprise. It asks for the capability level. The purpose is met with a complete set of activities, so it is above level 1. Level 3 requires a defined, organized approach using organizational assets, which is missing. The answer is level 2.

Framework topics 5

Official framework topics from the ISACA outline, in outline order.

5.1 COBIT performance management overviewHow COBIT judges how well the governance system works.
What it means
COBIT performance management covers how well the governance and management system and its components work and how they can be improved, using concepts such as capability levels and maturity levels.
What to understand
CPM is designed to be consistent with the COBIT conceptual model, simple to use, to give reliable and repeatable results, and to support both formal and informal assessments. It replaced the COBIT 5 approach based on ISO/IEC 15504 with a CMMI-based scheme.
How it shows up
A question asks what CPM measures, or what model the COBIT 2019 capability scheme is based on.
Common confusion
Answering with ISO/IEC 15504 process attributes, which belong to the COBIT 5 assessment approach.
5.2 Process capability levelsLevels 0 to 5 for processes, based on CMMI concepts.
What it means
Processes are rated from 0 to 5. Level 0 lacks basic capability. Level 1 more or less achieves its purpose through an incomplete, intuitive set of activities. Level 2 achieves its purpose through a basic but complete set of activities. Level 3 achieves it in an organized way using organizational assets and is well defined. Level 4 is also measured quantitatively. Level 5 adds continuous improvement.
What to understand
Each process activity in the core model is associated with a capability level from 2 to 5, so reaching a level means performing the activities tied to it. The key cut lines are complete (2), defined (3), measured (4) and improving (5).
How it shows up
A process description is given and you select the level, or you identify the characteristic that separates two adjacent levels.
Common confusion
Placing a standardized but unmeasured process at level 4, or a complete but non-standard process at level 3.
5.3 Rating process activitiesFully, largely, partially or not achieved.
What it means
The achievement of a capability level is rated on a four-point scale: fully achieved (more than 85%), largely achieved (roughly 50% to 85%), partially achieved (roughly 15% to 50%) and not achieved (less than 15%).
What to understand
The scale lets assessors express partial achievement rather than a yes or no answer. Exam items use values that sit clearly inside a band, so learn the three thresholds of 15%, 50% and 85%.
How it shows up
An assessor finds that about 70% of the activities for level 3 are in place, and you choose largely achieved.
Common confusion
Treating largely achieved as a failed level; it is a positive rating, just short of fully achieved.
5.4 Focus area maturity levelsMaturity levels 0 to 5 for focus areas.
What it means
Focus areas, such as information security or DevOps, are rated with maturity levels from 0 (incomplete) through 1 (initial), 2 (managed), 3 (defined), 4 (quantitative) and 5 (optimizing).
What to understand
A focus area reaches a maturity level when all the processes it contains reach that capability level. Maturity is therefore limited by the weakest process in the focus area.
How it shows up
A focus area contains processes at capability levels 3, 3 and 2, and you determine its maturity level, which is 2.
Common confusion
Averaging the process levels to get maturity, or using maturity for a single process.
5.5 Performance management of other componentsAssessing information, structures and culture.
What it means
Components other than processes are assessed with their own methods. Information items are assessed against the information quality criteria, and organizational structures and culture, ethics and behavior can be assessed in less formal ways.
What to understand
Capability levels are the formal scheme for processes only. For information, ask whether it is accurate, relevant, complete, current and appropriately secured; for culture and structures, look at whether the desired behaviors and decision rights are present.
How it shows up
A question asks how the quality of a governance report should be assessed, and the answer uses information quality criteria rather than capability levels.
Common confusion
Applying process capability levels to an information item or to culture.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • COBIT performance management (CPM)

    COBIT 2019's approach to judging how well the governance system and its components work and where to improve.

    Remember
    CMMI-based capability for processes, maturity for focus areas.
    Tested as
    Overview and model-origin questions.
    Trap
    Naming ISO/IEC 15504 as the COBIT 2019 basis.

  • Capability level 1

    The process more or less achieves its purpose through an incomplete set of activities that are initial or intuitive.

    Remember
    Incomplete and intuitive.
    Tested as
    Distinguishing ad hoc processes from performed ones.
    Trap
    Rating an incomplete process at level 2.

  • Capability level 2

    The process achieves its purpose through a basic but complete set of activities.

    Remember
    Complete and performed, not yet standardized.
    Tested as
    The most common level-identification question.
    Trap
    Rating it level 3 because it works well.

  • Capability level 3

    The process achieves its purpose in a more organized way using organizational assets and is well defined.

    Remember
    Defined and standardized across the enterprise.
    Tested as
    Level 2 versus 3 questions.
    Trap
    Requiring measurement for level 3.

  • Capability level 4

    The process achieves its purpose, is well defined and its performance is quantitatively measured.

    Remember
    Measured.
    Tested as
    Level 3 versus 4 questions.
    Trap
    Assuming any metric means level 4 even if the process is not defined.

  • Capability level 5

    The process achieves its purpose, is well defined, is measured and pursues continuous improvement.

    Remember
    Improving based on measurement.
    Tested as
    Level 4 versus 5 questions.
    Trap
    Calling a measured but static process level 5.

  • Rating scale

    Fully more than 85%, largely about 50% to 85%, partially about 15% to 50%, not achieved less than 15%.

    Remember
    The three thresholds are 15%, 50% and 85%.
    Tested as
    Percentage-to-rating questions.
    Trap
    Reading largely as a failing rating, or mixing up the order of largely and partially.

  • Focus area maturity levels

    0 incomplete, 1 initial, 2 managed, 3 defined, 4 quantitative, 5 optimizing.

    Remember
    A focus area reaches a level only when all its processes reach that capability level.
    Tested as
    Maturity calculation questions.
    Trap
    Averaging process levels.

  • Capability versus maturity

    Capability applies to individual processes; maturity applies to focus areas.

    Remember
    One process, capability; several processes in a focus area, maturity.
    Tested as
    Terminology questions.
    Trap
    Using the terms interchangeably.

  • Activity capability levels

    Each process activity in the core model is associated with a capability level from 2 to 5.

    Remember
    Reaching a level means performing the activities tied to it.
    Tested as
    How capability is determined.
    Trap
    Thinking capability is judged only from documentation.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Capability level 2 vs. 3 vs. 4 vs. 5

ConceptMeaningKey differenceCommon trap
Level 2 Purpose achieved through a basic but complete set of activities Complete and performed Calling it defined because results are good
Level 3 Purpose achieved in an organized way using organizational assets Defined and standardized Expecting quantitative measurement
Level 4 Well defined and performance quantitatively measured Measured Assigning it to an undefined process with a few metrics
Level 5 Measured and continuously improved Improving Assigning it to any measured process

Process capability vs. focus area maturity

ConceptMeaningKey differenceCommon trap
Process capability How well a single process achieves its purpose, rated 0 to 5 Applies to one process Using it for a focus area
Focus area maturity How mature a focus area is, rated 0 to 5 from incomplete to optimizing Reached when all processes in the focus area reach that level Averaging the processes' levels

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Good results equal defined

    What candidates pick
    Level 3 for a process that achieves its purpose well but differs between teams.
    Why it looks right
    The process seems mature because outcomes are good.
    Why it's wrong
    Level 3 requires an organized, defined approach using organizational assets; complete but non-standard is level 2.

    Clue to watch for Each team follows its own approach, or nothing is documented enterprise-wide.

  2. Metrics equal level 4

    What candidates pick
    Level 4 for a process that tracks a couple of metrics but is not standardized.
    Why it looks right
    Measurement is the level 4 keyword.
    Why it's wrong
    Level 4 builds on a well-defined process; without level 3 characteristics the process cannot be level 4.

    Clue to watch for Measurement is mentioned but the process is not defined across the enterprise.

  3. Measured equals optimizing

    What candidates pick
    Level 5 for a process whose performance is measured each month.
    Why it looks right
    Detailed measurement sounds like the top level.
    Why it's wrong
    Level 5 requires using measurement to pursue continuous improvement.

    Clue to watch for No mention of improvement actions driven by the measurements.

  4. Average maturity

    What candidates pick
    Maturity level 3 for a focus area with processes at 4, 3 and 2.
    Why it looks right
    Averaging feels fair.
    Why it's wrong
    A focus area reaches a maturity level only when all its processes reach that capability level, so the answer is 2.

    Clue to watch for Several processes with different capability levels inside one focus area.

  5. COBIT 5 assessment model

    What candidates pick
    ISO/IEC 15504 process attributes as the COBIT 2019 basis.
    Why it looks right
    COBIT 5 used that model and many materials still describe it.
    Why it's wrong
    COBIT 2019 uses a CMMI-based capability scheme.

    Clue to watch for The question asks specifically about COBIT 2019.

  6. Maturity for one process

    What candidates pick
    A maturity level such as defined to describe a single process.
    Why it looks right
    Maturity and capability are used interchangeably in everyday speech and in older models.
    Why it's wrong
    COBIT 2019 rates individual processes with capability levels and reserves maturity levels for focus areas.

    Clue to watch for The question asks about one named process rather than a focus area such as information security.

Answer framework

For any Performance Management question, use these steps to reach the precise level or rating.

  1. Decide what is being rated: one process uses capability levels, a focus area uses maturity levels, and information uses quality criteria.
  2. For a process, test the evidence upward: incomplete is level 1, complete is level 2, defined and standardized is level 3.
  3. Continue only if the lower level is fully met: quantitative measurement makes level 4, and improvement driven by measurement makes level 5.
  4. For a focus area, take the lowest capability level among its processes as the maturity level reached.
  5. For percentages, apply the scale using its thresholds: above 85% is fully, about 50% to 85% largely, about 15% to 50% partially, and below 15% not achieved.

Practice question

An enterprise's change management process is documented as an enterprise standard, every business unit follows it using shared templates and tools, and it reliably achieves its purpose. No performance metrics are collected. Which COBIT 2019 capability level best describes this process?

Want more like this? The COBIT 2019 Foundation practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

This area carries only 4% of the marks, so keep it short but precise; two focused hours are usually enough. Start with the six capability levels and reduce each to one word: lacking, incomplete, complete, defined, measured, improving. Then practice placing ten short process descriptions on the scale, always testing from the bottom up, and stop at the first level whose description the evidence does not fully meet.

Next, memorize the rating scale with its three thresholds, 15%, 50% and 85%, and the order of the four ratings. Learn the focus area maturity labels, incomplete through optimizing, and the rule that maturity is limited by the weakest process in the focus area.

Candidates underestimate the capability versus maturity distinction and carry over COBIT 5 assessment language based on ISO/IEC 15504. Afterwards, study Designing a Tailored Governance System, where target capability levels are set for each objective, then return here briefly before the exam for a quick recall check of the level descriptions.

FAQ

How much of the exam is Performance Management?

ISACA weights it at 4%, roughly three of the 75 questions on a planning basis. ISACA does not publish per-area question counts.

What model are COBIT 2019 capability levels based on?

They are based on CMMI concepts. COBIT 5 used an assessment model based on ISO/IEC 15504, which no longer applies.

What is the difference between capability level 2 and level 3?

Level 2 means the process achieves its purpose with a basic but complete set of activities. Level 3 means it does so in an organized, well-defined way using organizational assets.

How is a focus area's maturity level determined?

A focus area reaches a maturity level when all the processes it contains reach that capability level, so its weakest process limits it.

What does largely achieved mean?

It is the second-highest rating on the four-point scale, covering achievement above about 50% and up to 85%. Fully achieved requires more than 85%.

Are capability levels used for every component?

No. They are the formal scheme for processes. Information is assessed using quality criteria, and structures and culture are assessed in less formal ways.

How does this connect to other topic areas?

Designing a Tailored Governance System sets target capability levels for objectives, and Implementation measures the gap between current and target levels.

Other Enterprise Architecture & IT Governance certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 5 knowledge

You have covered CMMI-based capability levels, the rating scale and focus area maturity. Check whether you can assign the precise level from a short process description.

Take the COBIT 2019 Foundation practice test Check your COBIT 2019 Foundation readiness

Keep going