4.2 Holistic Approach
Key Takeaways
- Holistic approach is the second governance system principle: several components of different types must work together.
- The seven components are processes; organizational structures; principles, policies and frameworks; information; culture, ethics and behavior; people, skills and competencies; and services, infrastructure and applications.
- Implementing processes alone is not a governance system.
- A company with excellent process documents, no skilled people, and a toxic culture has failed the holistic principle even if the binders look complete.
- Holistic is a system principle about component types — not a framework principle, and not the same idea as end-to-end coverage.
Quick Answer: The second governance system principle is holistic approach. A governance system is not a process binder. Several components of different types must work together. COBIT 2019 names seven components: processes; organizational structures; principles, policies and frameworks; information; culture, ethics and behavior; people, skills and competencies; and services, infrastructure and applications. Implementing processes alone is not a governance system.
If provide stakeholder value answers why a governance system exists, holistic approach answers what it is made of. ISACA’s official idea is simple and easy to fail on the exam: components of different types have to operate as one system. A stack of process documents is one type. One type is not a system.
This is still the Principles (13%) domain. You are not yet designing a RACI chart or writing a capability target. You are learning why COBIT refuses to call a process rollout “we implemented COBIT.” The 30% Governance System and Components domain will unpack each component. Here you need the inventory, the “different types” phrase, and the process-only trap.
System principle, not a framework principle
Keep the split from 4.1. Holistic approach is a governance system principle. It tells the enterprise how its EGIT system must be assembled. It is not one of the three governance framework principles (based on a conceptual model; open and flexible; aligned to major related standards). Those sentences describe how COBIT the product is built. This sentence describes how your system must behave: it must use several component types together.
Do not confuse holistic with two nearby system principles you will meet in Chapter 5. End-to-end coverage is about where I&T lives across the enterprise — not only the IT department. Tailored to enterprise needs is about fitting the system to this enterprise instead of copying a generic model. Holistic is about which kinds of things you put in the system and whether they actually work together. Different questions. A system can cover the whole enterprise and still be non-holistic if the only thing covering that enterprise is a process PDF.
COBIT 5 called the same family enablers. COBIT 2019 renamed them components. Foundation items still punish anyone who treats the rename as a new inventory. The inventory is seven types. The principle is that they work together. Do not answer a holistic item with “enablers were retired, so culture no longer counts.” Culture still counts. It changed names with the rest of the set.
The seven components — preview, not the full component chapters
Memorize the official names. Later chapters in the Governance System and Components (30%) domain unpack each type. This principle-level preview is what Principles items expect.
| Component | What it is | What “process-only” misses |
|---|---|---|
| Processes | An organized set of practices and activities to achieve objectives and produce outputs | Nothing, if this is all you built — and that is the problem |
| Organizational structures | Key decision-making entities: boards, executive committees, architecture boards, risk committees | A process with no owner, no forum, and no escalation path |
| Principles, policies and frameworks | The vehicles that translate desired behavior into practical guidance | A process that contradicts unofficial policy, or policy that nobody can find |
| Information | All information produced and used by the governance system — not only “the data warehouse” | A process that cannot see the report, metric, or decision record it needs |
| Culture, ethics and behavior | The often-underestimated factor that determines whether any of the above actually happen | A perfect binder that people route around |
| People, skills and competencies | The human capacity required for good decisions and successful actions | A process written for a role the enterprise does not know how to staff |
| Services, infrastructure and applications | The I&T estate that processes information and delivers services | A governance design that assumes tools, environments, and services that do not exist |
Read the table as a system, not as a shopping list you implement in order. Processes without structures have no decision rights. Structures without information decide in the dark. Information without people who can interpret it is a dashboard nobody trusts. People without the right culture will not escalate. Culture without services and applications cannot see or enforce anything. Services without principles and policies become shadow tooling.
The exam loves one sentence: several components of different types must work together. Underline different types. Seven copies of “process” is still one type. A 400-page process library plus a second 400-page process library is still not holistic.
Generic versus variant components, focus areas, and how components support each of the 40 objectives are later topics. Do not drag them into a Principles answer. If the stem asks why a process program failed, the principle-level answer is missing component types, not a missing focus-area publication.
Why process documents feel like a system — and are not
Enterprises start with processes because processes are visible. You can print them, audit them, and put them in a GRC tool. That visibility is useful. It is also the trap.
A process tells people what flow to follow. It does not create a committee that will make the decision the process assumes. It does not create the skill to perform the activity. It does not create the ethical climate in which someone will stop an unsafe release. It does not create the application that holds the evidence. If those other components are missing, you do not have a weak process. You have an incomplete governance system.
This is why ISACA will not let you equate “we wrote the COBIT processes” with “we have EGIT.” Processes are one component. A governance system is the set of components working together to satisfy stakeholder needs and create value — the principle you just studied in 4.1. Holistic is how that value-creating system is assembled. Stakeholder value is why you assembled it. Do not answer a missing-culture stem with “they failed to provide stakeholder value” unless the stem is actually about the triad. If the stem is about binders versus people, the scoring principle is holistic approach.
Scenario: Pinnacle Claims Co.
Pinnacle Claims Co. spent nine months writing process documentation for change, incident, vendor intake, and risk acceptance. The binders are excellent. Every flow has a number, an input, an output, and a metric. Internal audit is almost impressed.
Then three things happen in the same month.
- The change-advisory slot on the RACI is assigned to a role that does not exist. There is no change board. The organizational structures component is empty.
- Two senior engineers leave. The remaining staff can follow the incident process only until the incident leaves the runbook. People, skills and competencies were never built; the process assumed experts the enterprise no longer has.
- A release manager who raises a risk is told, in a staff meeting, to “stop blocking revenue.” Nobody is surprised. Culture, ethics and behavior punish the very escalation the process requires.
Pinnacle has great process docs, no skilled people, and a toxic culture. On the Foundation exam, that is not “a process-maturity problem to fix next year.” It is a holistic approach failure. The governance system is not a system. One component type is dressed up as EGIT.
What would a holistic response look like? Not another rewrite of the incident procedure. Stand up the missing structure so decisions have a home. Hire or train the skills the processes assume. And treat the staff-meeting punishment as a governance defect, not as “soft stuff.” Culture is a named component. If it works against the process, the system is fighting itself.
A fourth missing piece often hides in the same story. Pinnacle’s processes require a configuration record and a vendor-risk file. Those files live in a spreadsheet on one laptop. Information and services, infrastructure and applications are also incomplete. The point of the principle is not to make you recite seven definitions in a vacuum. It is to make you look at a scenario and see which types are absent.
Pinnacle’s CEO asks whether buying a GRC application will “complete COBIT.” It will not. A tool can support the services component and can store information. It does not create a decision forum, a skill, or a culture in which people tell the truth about risk. COBIT is not a software product. A GRC install is not a holistic governance system.
Exam traps
Trap: implementing processes alone is a governance system. False. Processes are necessary and insufficient. The official corrective is the seven-component list and the phrase “different types.”
Trap: buy a GRC application and the system is holistic. False. A tool can support services, infrastructure and applications and can store information. It does not create culture, skills, or a decision-making structure.
Trap: culture can wait. False. Culture, ethics and behavior is a first-class component, not a change-management afterthought. A stem that postpones culture until “after we finish the processes” is describing a non-holistic system.
Trap: holistic means implement all 40 objectives. False. Completeness of the core model is a different conversation, and it is tempered by tailoring. Holistic means completeness of component types working together, not maximum process scope.
When a stem gives you a company with beautiful documentation and a failing outcome, look for the missing component type. That is this principle doing exam work.
A firm finishes a complete set of COBIT-aligned process documents and declares that its governance system is implemented. What is the best Foundation response?
Which list is the official set of seven COBIT 2019 governance-system components previewed by the holistic-approach principle?
Pinnacle Claims has excellent process documents, no remaining skilled engineers, and a culture that punishes anyone who raises risk. Which principle-level conclusion is correct?