11.1 The 40-Objective Core Model

Quick Answer: The COBIT 2019 core model is 40 governance and management objectives in five domains: EDM Evaluate, Direct and Monitor (5 governance objectives), APO Align, Plan and Organize (14), BAI Build, Acquire and Implement (11), DSS Deliver, Service and Support (6), and MEA Monitor, Evaluate and Assess (4). 5+14+11+6+4 = 40. Each objective has a purpose statement, a related process, alignment-goal and enterprise-goal links, and seven component descriptions. Foundation items test domain purpose and count, not recitation of every practice. 37 processes is COBIT 5.

Governance and Management Objectives is 23% of the COBIT 2019 Foundation exam — roughly 17 of 75 items, the second-heaviest official domain. Chapter 10 taught the goals cascade that feeds this catalog. This chapter is the map of the 40 themselves: the five-domain core model, then a deep pass on the five EDM governance objectives, then the recognition pattern that separates Ensured governance titles from Managed management titles.

What the core model is

An objective is a governance or management outcome the enterprise should achieve. It is not a software module, not a standing team, and not a binder on a shelf. EDM01 Ensured Governance Framework Setting and Maintenance is the outcome that the governance system itself is designed, owned, and kept current. A later management title such as a project or incident objective is likewise an outcome — projects are directed, incidents are restored — not the name of a ticket tool.

ISACA calls the catalog the core model because these 40 are the stable, generic set. Focus areas can add variant guidance on top (small and medium enterprises, DevOps, information security, and others). Design factors tell you which of the 40 to emphasize. The Foundation exam still wants the core 40, the five-domain grouping, and what each domain is for.

Keep the core model distinct from nearby official ideas. The seven components are the building blocks that describe each objective. The goals cascade is how stakeholder needs become enterprise goals, then alignment goals, then these objectives. Design factors are inputs that tailor emphasis. COBIT 5's 37 processes are the retired count. Mixing any of those into the definition of the core model is how candidates miss a clean recognition item.

Five domains and the official counts

Write this table from a blank page until you can do it closed-book.

The arithmetic is itself an exam item. 5+14+11+6+4 = 40. Wrong totals you will see as distractors: 37 (COBIT 5 processes), five governance plus 37 management, four EDM objectives, eight objectives in each domain, or “36 management objectives.” The only 2019 split that adds to 40 is 5 governance + 35 management.

APO is the largest domain (14). MEA is the smallest (4). EDM has 5, which is more than MEA and fewer than every other management domain except MEA. If a stem asks which domain holds the most objectives, answer APO. If it asks which domain is governance, answer EDM — not MEA, even though MEA’s name begins with Monitor.

Domain purpose, not a practice dump

Foundation candidates are not asked to recite every practice, activity, or metric under all 40 objectives. That is implementation-level detail. You must be able to do five things:

1. Name the five domains with their full official titles.
2. Know which domain is governance (EDM only) and which four are management (APO, BAI, DSS, MEA).
3. Know the five counts and that they sum to 40.
4. Match a scenario to a domain: a board setting risk appetite is EDM; a portfolio or architecture planning meeting is APO; a go-live, data conversion, or project close is BAI; a severity-1 incident or security-operations shift is DSS; an internal-control or assurance assessment is MEA.
5. Know that every objective is specified the same way — purpose, related process, goal links, and seven components.

The verbs in the domain names are a shortcut. Evaluate, Direct and Monitor is board work. Align, Plan and Organize is management planning. Build, Acquire and Implement is management change. Deliver, Service and Support is management run. Monitor, Evaluate and Assess is still management monitoring — the next sections will beat that trap until it is automatic.

What every objective carries

Open any objective in the COBIT 2019 framework and you see the same card, not 40 different formats:

• A purpose statement — why the objective exists; the outcome in one official sentence.
• A related process — the process component that organizes practices and activities for that objective.
• Alignment-goal and enterprise-goal links — the goals-cascade mapping that shows which enterprise and alignment goals the objective supports.
• Seven component descriptions — processes; organizational structures; principles, policies and frameworks; information; culture, ethics and behavior; people, skills and competencies; and services, infrastructure and applications.

That last bullet is the holistic approach principle applied to the catalog. The objective is not “a process.” The process is one of seven components that make the objective real. On the exam, an option that says “each objective is only a process flow” is incomplete. An option that says “objectives replace components” is backwards. An option that says “goal links are optional decoration” misses the cascade.

You do not need to memorize the purpose statement of all 40 for Foundation. You do need the five EDM purpose ideas in the next section, and you need to know that the structure of an objective is purpose + related process + goal links + seven components. Later chapters walk APO, BAI, DSS, and MEA by cluster. This section is the map, not the encyclopedia.

Why 40, not 37

COBIT 5 organized work as 37 processes across the same five domain names. COBIT 2019 rebuilt the catalog as 40 governance and management objectives. The domain names stayed. The object type and the count changed. Processes still exist — they are a component of each objective — but the unit you count on a 2019 item is the objective.

The classic Foundation trap is an option that says “COBIT 2019 has 37 processes.” That sentence describes COBIT 5. An option that says “40 processes” is also sloppy: 2019 speaks of 40 objectives, each of which includes a process component. Prefer the wording 40 governance and management objectives.

Related count traps to reject on sight:

• “Five domains of eight objectives each” — invented arithmetic (5×8 = 40, but the official split is not even).
• “EDM is one of four management domains” — EDM is the governance domain.
• “MEA is the sixth domain” — there are five domains.
• Treating a focus-area overlay as a 41st core objective — focus areas specialize the core model; they do not change the count of 40.

Scenario: Harborline maps the catalog

Harborline Mutual’s new EGIT sponsor prints a leftover COBIT 5 poster that lists 37 processes and tells the steering committee, “We will implement all 37 this year, starting with the help desk, because that is governance.” Three errors sit in that sentence.

First, the 2019 core model is 40 objectives, not 37 processes. Using a COBIT 5 inventory will miss the 2019 additions and the objective-versus-process language the exam uses.

Second, “implement all 40 this year” ignores tailoring. The core model is a catalog, not a mandatory implementation sequence. Design factors and the goals cascade tell you which objectives to emphasize. Foundation still requires you to know the catalog. Knowing the catalog is not the same as boiling the ocean.

Third, starting at the help desk and calling it governance mixes DSS run-work with EDM board-work. The help desk lives in Deliver, Service and Support. Governance starts with Evaluate, Direct and Monitor. A restored incident can be excellent management and still leave the board with no framework, no benefits conversation, no appetite, no resource envelope, and no stakeholder reporting.

A corrected sponsor line: “The 2019 core model is 40 objectives in five domains. We will use the goals cascade and design factors to decide which objectives to emphasize. The board owns the five EDM objectives. Management owns the 35 in APO, BAI, DSS, and MEA. Every objective we select will be described with all seven components, not with a process narrative alone.”

How this shows up on the exam

Expect three item shapes. First, count items: 40 total, 5/14/11/6/4, 5 governance plus 35 management. Second, rename items: 2019 objectives versus COBIT 5’s 37 processes. Third, domain-purpose items: match a verb, an owner, or a short scenario to EDM, APO, BAI, DSS, or MEA.

Prefer the answer that (1) says 40 governance and management objectives, (2) keeps the five official domain names and counts, (3) treats each objective as purpose + related process + alignment and enterprise goal links + seven components, and (4) refuses COBIT 5’s 37. Recite the table until the arithmetic is automatic. Do not start memorizing APO practice lists yet — that is the next chapter.