Overview
Principles is 13% of the COBIT 2019 Foundation exam and covers two separate sets of requirements. The six governance system principles describe what an enterprise's own governance system for information and technology should achieve: provide stakeholder value, take a holistic approach, stay dynamic, keep governance distinct from management, be tailored to enterprise needs, and cover the enterprise end to end. The three governance framework principles describe what a framework used to build that system, such as COBIT itself, should be: based on a conceptual model, open and flexible, and aligned to major standards.
The exam expects you to match a scenario to the principle it illustrates or violates. Each principle also points forward: holistic approach leads to the seven components, tailored and dynamic lead to design factors, and governance distinct from management leads to the EDM versus management domain split.
How it's tested
Principles questions are usually short scenarios that describe a governance decision, a weakness or a design choice and ask which principle it reflects, or which principle is not being followed. Some ask you to sort a principle into the governance system list or the governance framework list. The right answer comes from the precise wording of the principle, not a loose association.
-
Which principle applies
A scenario describes an action, such as revisiting the governance system after a merger, and you name the principle it illustrates, here dynamic governance system.
-
Which principle is violated
A weakness is described, such as governance that only covers the IT department, and you identify the principle it breaks, here end-to-end governance system.
-
System or framework principle
You decide whether a statement is a requirement for the enterprise's governance system or for the framework used to build it.
An enterprise adopts a cloud-first sourcing model, but its governance arrangements stay unchanged for two years and gaps appear. The question asks which principle was not applied. Sourcing model is a design factor, and the dynamic governance system principle says a change in design factors must trigger a review of the governance system. Tailored to enterprise needs is the tempting distractor, but it concerns the initial customization, not reacting to change.
Framework topics 9
Official framework topics from the ISACA outline, in outline order.
2.1 Provide stakeholder valueGovernance exists to satisfy stakeholder needs and generate value from I&T.
- What it means
- Each enterprise needs a governance system that satisfies stakeholder needs and generates value from information and technology, where value is a balance of benefits, risk and resources.
- What to understand
- Stakeholder value is achieved through an actionable strategy and a governance system that converts stakeholder drivers into enterprise goals, which is the starting point of the goals cascade. Value is not simply benefit; it requires risk and resource optimization too.
- How it shows up
- A scenario shows I&T investments chosen without reference to stakeholder needs, and asks which principle is missing.
- Common confusion
- Candidates recall the COBIT 5 wording meeting stakeholder needs and miss that the COBIT 2019 principle is framed as providing stakeholder value.
2.2 Holistic approachA governance system is built from components of different types working together.
- What it means
- A governance system for I&T is built from a number of components of different types, such as processes, structures, information and culture, that work together as a whole.
- What to understand
- This principle is why COBIT defines seven components. Improving one component alone, such as writing a process without assigning roles or building skills, rarely changes outcomes because the components depend on each other.
- How it shows up
- A scenario describes a governance initiative that delivered process documents but changed nothing because nobody was accountable or trained, and asks which principle was ignored.
- Common confusion
- Confusing holistic approach (many component types) with end-to-end governance system (all of the enterprise's I&T, wherever it sits).
2.3 Dynamic governance systemThe governance system adapts when design factors change.
- What it means
- When one or more design factors change, for example a new strategy, a new sourcing model or a new technology, the impact on the governance system must be considered so it remains viable.
- What to understand
- The trigger is change after the system is in place. The principle links directly to design factors and to the continual improvement life cycle in implementation.
- How it shows up
- A merger, regulatory change or move to the cloud is described, followed by unchanged governance arrangements, and you identify the principle at stake.
- Common confusion
- Choosing tailored to enterprise needs, which concerns the initial customization, rather than dynamic, which concerns adapting to later change.
2.4 Governance distinct from managementGovernance and management activities and structures are clearly separated.
- What it means
- A governance system should clearly distinguish governance activities and structures from management activities and structures.
- What to understand
- Governance evaluates, directs and monitors; management plans, builds, runs and monitors. The separation is reflected in the core model as the EDM domain versus the APO, BAI, DSS and MEA domains, and it protects oversight from being performed by those it oversees.
- How it shows up
- A scenario shows the CIO both setting I&T direction and judging their own performance without board involvement, and asks which principle is weak.
- Common confusion
- Reading the principle as meaning governance and management must be done by unrelated people with no interaction; they interact closely but have different roles.
2.5 Tailored to enterprise needsDesign factors are used to customize and prioritize the governance system.
- What it means
- A governance system should be tailored to the enterprise's needs, using design factors as parameters to customize and prioritize its components.
- What to understand
- There is no single correct COBIT implementation. Factors such as enterprise strategy, risk profile, compliance requirements and enterprise size change which objectives matter most and what capability levels to target.
- How it shows up
- A small enterprise copies a large bank's governance model and struggles, and the question asks which principle was neglected.
- Common confusion
- Thinking tailoring means dropping objectives at will; it means prioritizing and adjusting based on design factor analysis.
2.6 End-to-end governance systemGovernance covers all the enterprise's I&T, not just the IT function.
- What it means
- A governance system should cover the enterprise end to end, including all technology and information processing the enterprise uses to achieve its goals, wherever that processing is located.
- What to understand
- Business-owned applications, cloud services and outsourced processing are all in scope. Governance that stops at the IT department boundary leaves unmanaged risk in shadow IT and third parties.
- How it shows up
- A scenario describes marketing running its own cloud tools outside any governance oversight, and you identify the principle not followed.
- Common confusion
- Mixing it with holistic approach; end to end is about organizational and locational coverage, holistic is about component types.
2.7 Based on a conceptual modelA governance framework identifies key components and their relationships.
- What it means
- A governance framework should be based on a conceptual model that identifies the key components and the relationships among them, to maximize consistency and allow automation.
- What to understand
- This is a framework principle, a requirement on COBIT itself, not on the enterprise's governance system. COBIT meets it through its defined components, objectives and goals cascade.
- How it shows up
- A question asks which framework principle supports consistent automation of governance content, or classifies the statement as a framework principle.
- Common confusion
- Placing it among the governance system principles because it mentions components, which also appear in the holistic approach.
2.8 Open and flexibleA framework can absorb new content while staying consistent.
- What it means
- A governance framework should be open and flexible, allowing new content to be added and new issues to be addressed while keeping integrity and consistency.
- What to understand
- COBIT 2019 shows this through focus area content and community contributions that extend the core model without rewriting it.
- How it shows up
- A question describes adding focus area guidance for an emerging topic without changing the core model, and asks which framework principle this demonstrates.
- Common confusion
- Choosing dynamic governance system, which is about an enterprise's governance system reacting to change, not about the framework accepting new content.
2.9 Aligned to major standardsA framework aligns with relevant standards, frameworks and regulations.
- What it means
- A governance framework should align with relevant major standards, frameworks and regulations.
- What to understand
- COBIT maps to standards such as ISO/IEC 38500, ITIL, ISO/IEC 27000, TOGAF and CMMI so enterprises can use it as an umbrella without duplicating work.
- How it shows up
- A question asks why an enterprise using ISO/IEC 27001 can adopt COBIT without conflict, pointing to this framework principle.
- Common confusion
- Reading alignment as COBIT replacing those standards; it references and integrates them.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Governance system principles
Six requirements for an enterprise's governance system for I&T: provide stakeholder value, holistic approach, dynamic governance system, governance distinct from management, tailored to enterprise needs, end-to-end governance system.
- Remember
- Six principles apply to the enterprise's own system.
- Tested as
- Most principle questions start by deciding which list applies.
- Trap
- Placing a framework principle such as open and flexible in this list.
-
Governance framework principles
Three requirements for a framework used to build a governance system: based on a conceptual model, open and flexible, aligned to major standards.
- Remember
- Three principles apply to the framework, such as COBIT itself.
- Tested as
- Sorting and identification questions.
- Trap
- Confusing them with the governance system principles because both mention components or change.
-
Provide stakeholder value
Governance must satisfy stakeholder needs and generate value from I&T through an actionable strategy.
- Remember
- Value balances benefits, risk and resources.
- Tested as
- Scenarios where investments ignore stakeholder needs.
- Trap
- Using the COBIT 5 wording meet stakeholder needs as if it were the 2019 principle name.
-
Holistic approach
The governance system is built from several types of components working together.
- Remember
- It is the reason the seven components exist.
- Tested as
- Scenarios where one component was improved in isolation.
- Trap
- Selecting end-to-end governance system instead.
-
Dynamic governance system
Changes in design factors must prompt a review of the governance system.
- Remember
- Trigger is change after the system is in place, such as a new strategy or sourcing model.
- Tested as
- Merger, restructuring or technology shift scenarios.
- Trap
- Choosing tailored to enterprise needs.
-
Governance distinct from management
Governance and management activities and structures are clearly separated.
- Remember
- Shown in the core model as EDM versus APO, BAI, DSS and MEA.
- Tested as
- Scenarios where one role both directs and evaluates itself.
- Trap
- Thinking the two must never interact.
-
Tailored to enterprise needs
Design factors are parameters used to customize and prioritize governance components.
- Remember
- No single standard implementation fits every enterprise.
- Tested as
- Copy-paste governance scenarios.
- Trap
- Treating tailoring as freedom to skip governance entirely.
-
End-to-end governance system
Governance covers all technology and information processing, wherever it is located.
- Remember
- Includes business-owned, outsourced and cloud processing.
- Tested as
- Shadow IT and third-party scenarios.
- Trap
- Limiting scope to the IT function.
-
Based on a conceptual model
The framework identifies key components and their relationships to support consistency and automation.
- Remember
- A framework principle, not a governance system principle.
- Tested as
- Classification questions.
- Trap
- Confusing it with holistic approach.
-
Open and flexible
The framework allows new content and new issues to be added while staying consistent.
- Remember
- Focus area content is the COBIT 2019 example.
- Tested as
- Questions about extending COBIT for new topics.
- Trap
- Choosing dynamic governance system.
-
Aligned to major standards
The framework aligns with relevant standards, frameworks and regulations.
- Remember
- COBIT integrates other standards rather than replacing them.
- Tested as
- Questions on using COBIT with ITIL or ISO standards.
- Trap
- Reading alignment as replacement.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Holistic approach vs. end-to-end governance system
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Holistic approach | Governance built from components of different types working together | About the variety of component types, such as processes, structures and culture | Applying it to a scope gap such as shadow IT |
| End-to-end governance system | Governance covers all I&T the enterprise uses, wherever it is processed | About organizational and locational coverage | Applying it to a scenario where only one component type was addressed |
Tailored vs. dynamic vs. open and flexible
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Tailored to enterprise needs | Design factors customize and prioritize the governance system | Initial fit of the enterprise's system | Using it for a later change in strategy |
| Dynamic governance system | Changes in design factors trigger review of the governance system | Ongoing adaptation of the enterprise's system | Using it for adding content to COBIT |
| Open and flexible | The framework can take new content and issues while staying consistent | A property of the framework, not of an enterprise | Using it for an enterprise adapting its own governance |
Governance system principles vs. governance framework principles
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Governance system principles (6) | Requirements on an enterprise's governance system for I&T | Apply to what the enterprise builds and runs | Expecting conceptual model or alignment to standards here |
| Governance framework principles (3) | Requirements on a framework used to build the governance system | Apply to COBIT or any comparable framework | Expecting stakeholder value or end-to-end coverage here |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Tailored instead of dynamic
- What candidates pick
- Tailored to enterprise needs for a scenario where strategy changed after governance was set up.
- Why it looks right
- Both principles involve design factors.
- Why it's wrong
- Tailoring is the initial customization; reviewing governance because a design factor changed is the dynamic governance system principle.
Clue to watch for Time words such as after the merger, following the move to the cloud, or since the new strategy.
-
Holistic instead of end to end
- What candidates pick
- Holistic approach for business units running technology outside governance.
- Why it looks right
- Holistic sounds like covering everything.
- Why it's wrong
- Holistic means multiple component types working together; covering all the enterprise's I&T wherever it sits is end-to-end governance system.
Clue to watch for Shadow IT, business-owned cloud tools or outsourced processing left out of scope.
-
Framework principle for an enterprise
- What candidates pick
- Open and flexible for an enterprise adapting its own governance.
- Why it looks right
- Adapting sounds flexible.
- Why it's wrong
- Open and flexible is a requirement on the framework; an enterprise adapting its system to change is the dynamic governance system principle.
Clue to watch for The subject is an enterprise's own governance arrangements, not the COBIT framework.
-
COBIT 5 principle names
- What candidates pick
- Applying a single integrated framework or enabling a holistic approach as COBIT 2019 principle names.
- Why it looks right
- They are familiar from COBIT 5 materials.
- Why it's wrong
- COBIT 2019 uses six governance system principles and three framework principles with different wording.
Clue to watch for The question asks for a COBIT 2019 principle by name.
-
Separation means no interaction
- What candidates pick
- An option saying governance bodies should not receive management information.
- Why it looks right
- Distinct sounds like isolated.
- Why it's wrong
- Governance needs management reporting to monitor; the principle separates roles and structures, not communication.
Clue to watch for Options that cut off reporting or communication between the board and management.
-
Process-only fix
- What candidates pick
- Writing a new process as the full answer to a governance weakness.
- Why it looks right
- Processes are the most visible component.
- Why it's wrong
- The holistic approach requires the related structures, skills, information and culture as well.
Clue to watch for The scenario says a documented process exists but behavior has not changed.
Answer framework
To match a scenario to the right COBIT 2019 principle, work through these steps in order.
- Decide whether the scenario is about an enterprise's own governance system or about a governance framework such as COBIT itself.
- For a framework, choose among conceptual model, open and flexible, and aligned to major standards based on what the framework is doing.
- For an enterprise, check for a change over time; if a design factor changed after setup, choose dynamic governance system.
- Separate coverage problems from component problems: missing business units or locations point to end to end, missing component types point to holistic.
- Test the remaining options against value balance, role separation and tailoring, and pick the principle whose exact wording the scenario breaks or demonstrates.
Practice question
Want more like this? The COBIT 2019 Foundation practice test has questions for every domain.
Checklist
0 of 11
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Learn the two lists as separate sets, six and three, and write each principle with a one-line example scenario of your own. The quickest gain is the sorting rule: if the subject is the enterprise's own governance arrangements, the answer comes from the six; if the subject is the framework, it comes from the three.
Spend most of your time on the pairs that look alike: holistic approach versus end-to-end governance system, and tailored to enterprise needs versus dynamic governance system. For each pair, write the one word that separates them: component types versus coverage, and initial fit versus later change. Also note how each principle connects forward, because later topic areas use them as justifications.
Candidates underestimate how often COBIT 5 wording appears in distractors; read options for exact COBIT 2019 phrasing. Afterwards, study Governance System and Components, where the holistic approach becomes the seven components, then return to mixed scenario questions that ask which principle applies or is violated.
FAQ
How much of the exam is Principles?
ISACA weights Principles at 13%, the third-largest topic area, which is roughly ten of the 75 questions on a planning basis; ISACA does not publish per-area counts.
How many principles does COBIT 2019 have?
Nine in total: six governance system principles for an enterprise's governance system and three governance framework principles for the framework used to build it.
Are these the same as the COBIT 5 principles?
No. COBIT 5 had five principles. COBIT 2019 rewrote them into six governance system principles and added three framework principles, so COBIT 5 names are wrong answers.
What is the difference between holistic and end to end?
Holistic approach means the governance system is made of several component types that work together. End-to-end governance system means it covers all the enterprise's technology and information processing, wherever it happens.
How do the principles connect to design factors?
Tailored to enterprise needs uses design factors to customize the system, and dynamic governance system requires a review when a design factor changes.
Do I need to memorize the exact wording?
You need the principle names exactly and the core idea of each, because distractors often use near-miss wording or COBIT 5 terms.
Which topic areas build on Principles?
Governance System and Components expands the holistic approach, Designing a Tailored Governance System expands tailoring and dynamics, and Governance and Management Objectives reflects the separation of governance from management.
Other Enterprise Architecture & IT Governance certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 2 knowledge
You have covered the six governance system principles, the three framework principles and the clues that separate look-alike pairs. Check whether you can match scenarios to the right principle under time pressure.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the COBIT 2019 Foundation AI tutor Get any concept explained your way