6.1 Seven Governance System Components
Key Takeaways
- COBIT 2019 builds a governance system from seven components: processes; organizational structures; principles, policies and frameworks; information; culture, ethics and behavior; people, skills and competencies; and services, infrastructure and applications.
- COBIT 5 called the same seven enablers; on a 2019 item the default word is components unless the stem asks about the rename.
- Each of the 40 governance and management objectives is described using all seven components; they must work together (holistic approach).
- POP-I-CPS is an exam-useful counting hook — recite the full official names, not the letters.
- Objectives, design factors, focus areas, principles, and domains are nearby ideas, not an eighth component.
Quick Answer: A COBIT 2019 governance system is assembled from seven components: processes; organizational structures; principles, policies and frameworks; information; culture, ethics and behavior; people, skills and competencies; and services, infrastructure and applications. COBIT 5 called the same seven enablers. Every one of the 40 governance and management objectives is described with all seven, and they must work together — that is the holistic approach principle. On a 2019 item, say components unless the stem is about the rename.
Governance System and Components is 30% of the COBIT 2019 Foundation exam — roughly 23 of 75 items, the heaviest official domain. This chapter is the map of that domain. Later chapters teach each component in depth, then show how they integrate. If you leave this section with only one picture, make it this: every objective has seven slots, the 2019 name for those slots is components, and leaving a slot empty is how a documented process still fails in production.
Why a governance system needs seven building blocks
A governance or management objective is an outcome. EDM01 Ensured Governance Framework Setting and Maintenance is not a binder. DSS02 Managed Service Requests and Incidents is not a ticket tool. The objective is a result the enterprise should achieve.
Results do not appear because someone published a process narrative. The enterprise also needs a body that can decide, a policy that states expected behavior, information that shows whether the work is happening, a culture that will escalate bad news, people who can actually do the work, and services that host it. COBIT 2019 therefore describes each of the 40 objectives through seven components.
Treat the seven as slots on a card, not as a menu. You do not pick processes this quarter and culture next year. The holistic approach governance-system principle exists to stop that menu reading. A system works when the components interact. Perfecting one component in isolation is how enterprises end up with a world-class process document that nobody follows.
This section does not teach process practices, RACI charts, information quality goals, or skills frameworks. Those are later chapters. Here you learn the official list, a purpose one-liner for each, a mnemonic you can use closed-book, and the rename trap.
The official seven, with a purpose one-liner
Learn the names in this order. ISACA's materials present them this way; exam options often preserve the same wording.
| # | Component | Purpose one-liner (exam-ready) |
|---|---|---|
| 1 | Processes | An organized set of practices and activities that achieve objectives and produce outputs supporting IT-related goals. |
| 2 | Organizational structures | The key decision-making entities in the enterprise — committees, functions, and roles that can actually decide. |
| 3 | Principles, policies and frameworks | The vehicles that translate desired behavior into practical day-to-day management guidance. |
| 4 | Information | All information produced and used by the enterprise; the governance system itself needs information to function. |
| 5 | Culture, ethics and behavior | Individual and collective behavior; often underestimated, and often why a "complete" design still fails. |
| 6 | People, skills and competencies | The human capacity required to make correct decisions and to complete activities successfully. |
| 7 | Services, infrastructure and applications | The I&T processing and services that give the governance system a technology foundation. |
Keep the one-liners short on exam day. If a stem asks what organizational structures are, answer key decision-making entities, not "the organization chart" and not "RACI" — RACI is how structures get documented later. If it asks what principles, policies and frameworks do, answer translate desired behavior into practical guidance. If it asks why culture, ethics and behavior is listed, answer that behavior determines whether the other components actually operate.
An exam-useful mnemonic: POP-I-CPS, then three clusters
Cute sentences that do not reconstruct the official names waste time. Use POP-I-CPS only as a counting hook, then recite the full official names:
- P — Processes
- O — Organizational structures
- P — Principles, policies and frameworks
- I — Information
- C — Culture, ethics and behavior
- P — People, skills and competencies
- S — Services, infrastructure and applications
Immediately re-check completeness with three clusters. If a cluster is empty, you dropped a component:
- How work is designed: processes + organizational structures + principles, policies and frameworks
- How people know and behave: information + culture, ethics and behavior + people, skills and competencies
- What they run it on: services, infrastructure and applications
The letters never appear on the answer key. The official names do. A distractor that says "human resources," "the data warehouse," "ITIL," or "the steering committee" is naming an example inside a slot, not the component. The component names are the seven phrases above.
One more sentence worth locking: every objective uses all seven. Processes are not more "official" than culture. Information is not a synonym for a security-standard information domain. Services, infrastructure and applications are not "just the IT operations team."
Enablers versus components
COBIT 5 called these seven enablers. COBIT 2019 renamed them components. The ISACA comparison is explicit: enablers are included in COBIT 5; enablers are renamed as components in COBIT 2019. The seven items did not disappear. They were not replaced by focus areas, design factors, or the 40 objectives.
Exam trap: answering enablers on a 2019 item unless the question is about the rename. If the stem asks "What does COBIT 2019 call the building blocks of a governance system?" the word is components. If the stem asks "What happened to the COBIT 5 enablers?" the answer is they were renamed components. Using "enabler" as your default 2019 vocabulary is how candidates lose otherwise easy items in this 30% domain.
They must work together
Holistic is not a slogan. Picture DSS02 Managed Service Requests and Incidents at a community hospital. A process document can be excellent and the objective can still fail if:
- no on-call organizational structure exists after 17:00,
- no policy requires severity-1 escalation to the administrator on call,
- the status board is empty (information),
- staff hide outages to avoid blame (culture, ethics and behavior),
- nobody is trained on the paging tool (people, skills and competencies),
- monitoring was never brought into production (services, infrastructure and applications).
That is one objective and six empty slots around a lonely process. The exam will offer "write a better process" as comfort. The COBIT-shaped reply is: fill every component and make them interact.
Scenario: Harborline Community Hospital
Harborline's board approved a patient-portal program. The CIO's first move is to "write the COBIT processes." The chief nursing officer asks who owns after-hours clinical-message decisions. Privacy counsel asks which policy states consent and break-glass rules. The CISO asks where portal logs will live and who reads them. The chief people officer asks who is qualified to run a 24x7 digital channel that nurses will actually use.
Those questions are the seven components arriving in the room. Processes alone will not answer them. Harborline does not invent an eighth component called "hospital stuff." It uses the same seven slots a global health system uses. What may differ later is the variant expression of those slots — a thinner committee, a combined role, a health-privacy policy overlay. Variants are the next section. The map does not change.
Notice what the CIO should not say. She should not say culture is "soft" and out of scope. She should not say services are "an IT operations problem, not governance." She should not say COBIT is only the process guide. Those sentences fail both EGIT and the exam.
What is not a component
Keep a reject list. Distractors in this domain are built from nearby official ideas:
- A governance or management objective (EDM01, APO12, DSS05, MEA04) is an outcome, not a component.
- A design factor (strategy, risk profile, threat landscape, enterprise size) is an input to tailoring, not a building block.
- A focus area (SME, DevOps, cybersecurity) is a topical collection, not a component.
- A principle (holistic approach, tailored to enterprise needs, end-to-end coverage) explains why the system is built this way; it is not one of the seven.
- A domain (EDM, APO, BAI, DSS, MEA) groups objectives; it is not a component.
- The word enabler is the COBIT 5 name, not the 2019 default.
How this shows up on the exam
Expect three item shapes. First, list recognition: which of the following is a component? Prefer the official seven-phrase names. Second, rename items: enablers became components. Third, holistic items: an objective described with only a process is incomplete. Prefer the answer that (1) names all seven official components, (2) says every objective is described with them, (3) says they work together, and (4) uses components in 2019 language unless the stem is about the rename.
This is the map. Chapters 7 and 8 walk each component. Chapter 9 puts them back together. Do not start memorizing practice lists or role tables yet. Recite POP-I-CPS with the official names until you can do it without looking.
On the COBIT 2019 Foundation exam, what are the seven building blocks of a governance system called?
Which statement correctly describes how the seven components relate to a governance or management objective?
A candidate answers a COBIT 2019 item by naming the seven building blocks as enablers. When is that wording acceptable?