1.2 Certificate Rules, Retakes, and How to Study

The second half of this introduction is the part most candidates skip and then pay for: certificate rules, retakes, and a study plan that follows ISACA's weights instead of a random playlist. This exam is closed-book and remotely proctored. The framework is full of named lists. If you do not decide now what to memorize, what to practice, and how a no-show or a fail actually works, you will waste the 6-month voucher.

Why rules and strategy are exam content

Foundation items do not ask you to recite PSI's privacy policy. They do ask whether you understand that COBIT is a framework an enterprise tailors, that Foundation is a certificate, and that governance is distinct from management. The same mindset that mixes up certificate and certification will mix up a principle, a component, and an objective ID. Learn the product rules first so later chapters have a place to hang.

Certificate versus CISA, CISM, and CGEIT

ISACA sells two different products that people casually call "certs."

A certificate — COBIT Foundation, and later COBIT Design & Implementation — is a knowledge exam. There is no experience requirement. You can register the day you decide to study. After you pass, ISACA does not publish a CPE (Continuing Professional Education) cycle or an expiration date for Foundation. You earned a certificate that documents knowledge of COBIT 2019. You do not enter a three-year maintenance window the way a CISA holder does.

A certification such as CISA (Certified Information Systems Auditor), CISM (Certified Information Security Manager), or CGEIT (Certified in the Governance of Enterprise IT) is a professional credential with experience requirements, an application, and ongoing CPE. CGEIT is the closest cousin in subject matter — governance of enterprise IT — but it is not a harder version of this same exam. It is a different product. Do not tell yourself you must have five years of governance work before you sit Foundation. Do not tell yourself Foundation will automatically satisfy CGEIT experience. And do not invent a Foundation CPE number because you saw one on a CISA page.

Why the distinction is an exam trap

If a question offers "maintain 20 CPE hours per year to keep Foundation active," treat that as a distractor unless ISACA later publishes such a rule. As of the February 2026 candidate guide, it has not. Foundation asks whether you understand roles, principles, and objectives. It does not ask you to log audit hours.

Exam-day rules from the February 2026 candidate guide

Delivery is computer-based and remotely proctored via PSI. You will install and launch the PSI Secure Browser. That browser locks down the machine: no other applications, no extra displays, no copying questions out of the item.

Before the clock starts, expect a room scan. The proctor will ask you to pan the camera around the room, under the desk, and across the walls. The room must be a private space. No other people may enter. A partner walking through with coffee is a rule break, not a cute interruption.

No reading questions aloud. Even if you normally talk through stems, the proctor will stop you. The exam is silent.

Power and stable internet are your problem, not PSI's. A laptop on 8% battery or a café Wi-Fi drop can become a no-show. Plug in. Use a wired connection if you can. Run ISACA/PSI's system check days before, not 20 minutes before.

Other hard rules from the same guide and the live Foundation page:

• Clean desk. No notes, books, whiteboards, second phones, smartwatches, or COBIT manuals.
• Closed-book. You will not open another window to look up EDM02.
• No breaks. There is no scheduled pause and no pausing the timer to walk away.
• Government photo ID must match the name on your ISACA profile.
• Start within 15 minutes of the scheduled start or you are marked a no-show and the fee is forfeited.

If you need to move the appointment, reschedule at least 48 hours ahead, still inside the 6-month eligibility window. Inside 48 hours, assume the sitting is real.

A scenario that fails people

Jordan schedules a 9:00 sitting, logs in at 9:12, and cannot find the ID because it is in a work bag in the car. By the time Jordan is back, it is 9:18. That is a no-show. The US$175 is gone. The retake clock and a new purchase both apply. Build a 30-minute pre-start buffer: ID on the desk, browser installed, room cleared, phone out of reach, charger in the wall.

Retake policy

ISACA allows 4 attempts in a rolling 12-month period. The waits are not symmetric:

You pay the full US$175 fee for every attempt. There is no discounted retake. Purchases remain non-refundable and non-transferable. A new purchase does not erase the wait. If you fail on 1 March, you cannot legally sit again on 10 March just because you bought another voucher.

Plan as if you will pass on the first or second attempt. The 90-day waits after the second and third attempts will collide with a 6-month eligibility window on a later voucher if you are not careful. Do not treat retakes as a study strategy.

Study path aligned to official weights

Spend time the way ISACA spends items. The two heaviest domains — Governance System and Components plus Governance and Management Objectives — are 53% of the exam. That is where most of your calendar belongs.

The 60-hour column is a study heuristic, not an ISACA-published requirement. Many candidates use a 4–8 week runway. The point is proportion. If your flashcards are 80% business-case trivia, you are studying the wrong test.

How this free OpenExamPrep guide is built

This guide follows the eight official domains rather than a vendor course outline.

• Framework Introduction chapters cover purpose, EGIT versus the IT function, the product family, audience, umbrella standards, and the move from COBIT 5 to COBIT 2019.
• Principles chapters take the six system principles one at a time, then the three framework principles.
• Governance System and Components is the longest stretch: the seven components, generic versus variant components, focus areas, RACI and key roles, and how components support objectives.
• Governance and Management Objectives walk the goals cascade, the 40-objective core model, EDM, then APO, BAI, DSS, and MEA.
• Later chapters cover implementation, designing a tailored system, performance management, and the business case.

Use the guide to learn names, relationships, and exam traps. Then switch to practice.

When to use /practice/cobit-2019

Open /practice/cobit-2019 after you finish a domain cluster, not only on the last weekend.

1. After components: mixed component items until you stop missing the seven-name list.
2. After objectives: recognition items on EDM01–MEA04 style IDs.
3. After principles and intro: "which principle is being violated?" stems.
4. In the final 7–10 days: full mixed sets under a 120-minute clock.

The practice bank is for retrieval. The guide is for first teaching. Do not only read. A closed-book exam punishes recognition that only exists while the page is open.

Closed-book implication: the lists you must memorize

Because you cannot open the framework, Foundation is a named-list exam at recognition level. You do not need every activity metric. You do need to know that the following lists exist, how long they are, and what belongs on each:

• 6 + 3 principles — six governance-system principles and three governance-framework principles
• 7 components of a governance system
• 5 domains — EDM, APO, BAI, DSS, MEA
• 40 objective IDs at recognition level (you should know that APO12 is Managed Risk, not invent a 41st objective)
• 11 design factors used to tailor the system
• 7 implementation phases
• Capability levels 0–5

If you can write those seven bullets from memory, you have the skeleton of the exam. Everything else in later chapters hangs on that skeleton.

A final study scenario

Ava reads every chapter once, highlights heavily, and never drills the 40 IDs. On the sitting she can explain "holistic approach" in her own words but cannot say whether a stem is pointing at a component, a principle, or an APO objective. That is a fail pattern. Ben writes the lists on a whiteboard every morning for two weeks, then spends most remaining hours on components and objectives at /practice/cobit-2019. Ben is studying the 53% that ISACA actually weights.

Set a first-attempt date inside the 6-month window. Work backward. Give the 30% and 23% domains the majority of the calendar. Use this guide for teaching, practice for retrieval, and treat exam-day rules as part of the content — because a no-show scores the same as a zero.