8.1 Information Component
Key Takeaways
- Information is a COBIT 2019 component of every objective: both a product of the governance system and a resource the system needs in order to function.
- Teaching groups information quality into intrinsic, contextual/relevant, representational, and security/accessibility categories; ISACA details the criteria in the core publications rather than in a Foundation numbered statute.
- A board pack can be timely and still fail: timeliness is not the same test as reliability or accuracy.
- Treat the information cycle — plan, design, build/acquire, use/operate, monitor/dispose — as a recognition aid for managing information as a resource.
- The exam trap is shrinking this component to a data warehouse or to confidentiality only.
Quick Answer: In COBIT 2019, information is a first-class component of every governance and management objective. It is both a product of the governance system and a resource the system needs in order to function. Quality is not “the dashboard exists.” Teaching groups quality into intrinsic, contextual/relevant, representational, and security/accessibility categories, which ISACA details in the core publications — do not memorize an unofficial numbered statute. A board pack that arrives on time with unreconciled numbers fails intrinsic quality. The exam trap is shrinking this component to “the data warehouse” or to “confidentiality only.”
Governance System and Components is 30% of the Foundation exam. Chapter 6 mapped the seven components. Chapter 7 covered processes, organizational structures, and principles, policies and frameworks. This chapter covers the remaining four. Start here: information is not a side effect of a process narrative. It is a designed slot on every objective card.
Information is a product and a resource
An objective produces information — a risk register, a change calendar, a service-level report, a benefits-realization dashboard. That same objective consumes information — a risk-appetite statement, a configuration baseline, a customer-impact list. COBIT 2019 therefore describes information as both:
- a product of the governance system (outputs the system creates), and
- a resource that enables the system (inputs the system cannot work without).
If you remember only one sentence, remember that double role. A stem that says “information is whatever the data team stores in the warehouse” is too narrow. A stem that says “information is the DSS05 confidentiality control” is also too narrow. The component is all information produced and used by the enterprise, including the information the governance system itself needs to decide, direct, and monitor.
Every one of the 40 governance and management objectives is described with this component. EDM05 Ensured Stakeholder Engagement needs a stakeholder map and a reporting pack. APO12 Managed Risk needs risk data that decision-makers can trust. BAI06 Managed IT Changes needs a change record complete enough to reconstruct what happened. MEA01 Managed Performance and Conformance Monitoring is almost entirely about whether the right information exists and is used. Leaving the information slot empty is how a “complete” process still produces a meeting where nobody can answer the chair.
Quality categories — recognize them; do not invent a numbered law
Foundation items expect you to reason about whether information is fit for its purpose, not to recite a secret twelve-row official table. ISACA details the information component and its quality treatment in the core publications — notably COBIT 2019 Framework: Introduction and Methodology, and, for the older layered quality-goal treatment candidates still meet in teaching materials, COBIT 5 Enabling Information. Those publications go deeper than this certificate exam. What you must carry closed-book is the categories and what a failure in each category looks like.
| Quality category | What “good” means in practice | Typical failure |
|---|---|---|
| Intrinsic quality | Accurate, believable, and objectively grounded in its sources | Timely pack; unreconciled loss figures |
| Contextual / relevant quality | The right information, complete enough, current enough, and in the right amount for this decision | A 90-page dump when the board asked for the five risks that moved |
| Representational quality | Structured, consistent, and understandable to the people who must use it | Three teams report “severity” on three different scales |
| Security / accessibility | The right people can get it in time; the wrong people cannot | The CRO cannot open the pack — or a contractor can see every salary |
Notice the exam-useful split. Timely lives mainly under security/accessibility (availability when needed). Reliable / accurate lives under intrinsic quality. Those are not the same test. Northbridge Mutual can hit its “pack issued T-minus two days” service level and still fail the information component if two of five key figures cannot be tied back to the source systems.
Do not treat the four category names as a fake official statute of exactly four numbered “laws,” and do not invent a twelve-item list and call it ISACA’s Foundation answer key. If a stem asks you to apply a category, apply it. If a stem presses you for the official detailed quality-goal table, the honest move is to remember that ISACA publishes that detail in the core publications, not in a meme-sheet of twelve bullets.
The information cycle, conceptually
Information is not born complete at go-live. Teaching materials walk a simple cycle. Use it as a recognition aid, not as a seventh official domain:
- Plan — which information does this objective need, for whom, at what quality?
- Design — definitions, structures, sources, retention, and access.
- Build / acquire — create, extract, or buy the stores and the flows.
- Use / operate — people actually consume it to decide and act.
- Monitor / dispose — check that quality still holds; retire or archive what must not linger.
A warehouse that is built and never used fails at use/operate. A report that is used but never checked against source systems fails at monitor. A retention rule that keeps every badge swipe forever is a dispose failure with privacy consequences. The cycle is how you talk about information as a managed resource, not as a one-time extract.
Attributes by layer — recognition level only
Some teaching materials apply attributes through a semiotic stack. Recognize the layer names if they appear. Do not treat them as a second official “12-item” list.
| Layer | Recognition hook | Example |
|---|---|---|
| Physical | The medium — disks, packets, paper | The pack exists only as an emailed PDF |
| Empirical | Transmission, noise, whether the signal arrived intact | The overnight feed dropped 12 percent of rows |
| Syntactic | Format, schema, structure | Dates as MM/DD in one system and YYYY-MM-DD in another |
| Semantic | Meaning | “Open incident” means something different in IT and in Safety |
| Pragmatic | Usefulness for the intended decision | The CRO still cannot tell whether residual risk is inside appetite |
If a stem says the field is well-formed but nobody knows what it means, the break is semantic. If the meaning is clear but the chair still cannot act, the break is pragmatic. If the file will not parse, the break is syntactic. That is as deep as Foundation needs.
Scenario: Northbridge Mutual’s timely, unreliable board pack
Northbridge Mutual’s risk committee requires a quarterly I&T risk pack two business days before the meeting. The PMO hits the deadline every quarter. In March, two of the five “top residual risk” figures cannot be reconciled to the GRC tool or to Finance’s loss file. The CRO still presents the pack because “we cannot slip the board calendar.”
Process (a pack is produced), structure (a committee exists), and accessibility (it arrived on time) all look green. Intrinsic quality is red. Contextual quality is also shaky: the pack is 80 pages and does not flag that two numbers are unreconciled. Representational quality is mixed: pretty charts, inconsistent severity labels. The information component has failed even though the “data warehouse” is up and the file was not leaked.
The fix is not “buy another dashboard.” The fix is to treat the pack as a designed information item: define sources, reconciliation rules, a “do not present unreconciled figures” policy (that is the principles, policies and frameworks component supporting this one), and a culture that will delay a slide rather than brief a false number (that is culture, ethics and behavior). Holistic approach, again.
Exam traps for this component
- Warehouse-only: Information is not synonymous with a data platform. A verbal briefing, a RACI chart, a contract clause, and a handwritten change ticket are information.
- Confidentiality-only: Security/accessibility is one category, and confidentiality is one concern inside it. Accuracy, relevance, and understandability still count.
- Process substitute: A documented MEA01 process does not create the component. The component is the information itself and its fitness.
- Invented statutes: Do not “help” a stem by inventing a numbered official list of twelve quality attributes. Use the categories and apply them.
- Not a design factor: Information is a component, not a design factor, not a focus area, and not an eighth domain.
How items are written
- “What is the information component?” → all information produced and used; product and resource.
- Timely but wrong → an intrinsic (and maybe contextual) failure, not a pass.
- “Information equals the warehouse” or “information equals CIA” → reject.
- Layer name in the stem → match physical, empirical, syntactic, semantic, or pragmatic at recognition level.
- Quality detail beyond categories → ISACA’s core publications, not a bootcamp numbered law.
Lock the double role, the four categories, the cycle, and the Northbridge split between timely and reliable. Then culture will make more sense: even perfect information fails if nobody will speak to the unreconciled number.
Northbridge Mutual issues its quarterly I&T risk pack two days before the committee meeting, but two of the five residual-risk figures cannot be reconciled to the source systems. What does this teach about the information component?
On the COBIT 2019 Foundation exam, what is the information component?
A candidate treats the information component as “just CIA confidentiality.” Why is that wrong on a COBIT 2019 item?