5.4 Three Governance Framework Principles

Quick Answer: COBIT 2019 adds three governance framework principles. They describe how COBIT itself is built, not how an enterprise’s governance system should behave. The three are: based on a conceptual model, open and flexible, and aligned to major related standards. They are not a second copy of the six system principles. COBIT 5 did not have this split and did not publish these three framework principles.

Candidates lose easy points in this 13% domain by dumping every COBIT “principle” into one mental list. COBIT 2019 is explicit about two families with two jobs. The six you have now finished — provide stakeholder value, holistic approach, dynamic governance system, governance distinct from management, tailored to enterprise needs, and end-to-end coverage — judge the enterprise’s EGIT system. The three in this section judge the product called COBIT.

A useful analogy is a building code versus a finished hospital. System principles describe the hospital you operate: who governs, how far coverage runs, how you tailor. Framework principles describe how the code book itself is written so new chapters can be added without rewriting the wiring diagram, and so the code can sit next to fire, electrical, and accessibility codes instead of pretending to replace them.

Two families, two jobs

If a stem asks how a governance system should be designed, stay in the six. If it asks how COBIT the framework is constructed, stay in the three. If it offers a blended list of nine “system principles,” the blend is already wrong.

Principle 1 — Based on a conceptual model

The framework should identify key components and the relationships among them, maximize consistency, and allow automation.

That is why COBIT 2019 is not a pile of essays. It has a core model of 40 objectives, seven components, a goals cascade, design factors, and a performance-management scheme that reuse the same objects. Consistency is what lets an enterprise map a process to an objective, an objective to an alignment goal, and a goal to a stakeholder need without inventing a new language each time.

“Allow automation” is easy to misread. It does not mean “COBIT is a software product you install.” Chapter 2 already killed that idea. It means the model is regular enough that tools can store objectives, components, ratings, and mappings without each implementation inventing a private schema. A governance, risk, and compliance (GRC) tool can represent COBIT because COBIT is modeled. The tool is still not COBIT, and buying the tool does not satisfy this principle.

If a stem praises COBIT for having identified components and relationships so guidance stays consistent, you are on this framework principle — not on holistic approach, which is the system principle about using those components together inside an enterprise. Conceptual model = how the book is built. Holistic approach = how the hospital uses all the parts.

Principle 2 — Open and flexible

The framework should let practitioners add new content and address new issues while keeping integrity and consistency.

That is the design reason COBIT 2019 talks about an open-ended product architecture, focus areas, and variants. A new regulation, a new delivery method, or a new technology concern should be addable without breaking the 40-objective spine or renaming EDM.

Open is not sloppy. You cannot invent a forty-first core-model domain, collapse APO into EDM, or swap the seven components for a private list and still claim you are using COBIT. Flexibility lives inside the model: new focus-area guidance, new mappings, new variants of components. Integrity means the conceptual model still holds after the addition. The two framework principles reinforce each other: you can be open because you have a conceptual model worth protecting.

This principle is also why COBIT 2019 can grow after publication without waiting for a wholesale rewrite of every page. The exam cares about the idea — add content, address new issues, keep integrity — not a product-roadmap rumor and not a claim that enterprises may ignore the core model whenever they feel flexible.

Principle 3 — Aligned to major related standards

The framework should sit as an umbrella and stay aligned to major related standards, frameworks, and regulations.

You already met this idea in Framework Introduction: COBIT is specifically designed to play well with others. It maps to ITIL, ISO/IEC 27001, NIST cybersecurity guidance, TOGAF, COSO, ISO 31000, PMBOK, and similar bodies of knowledge. It does not retire them.

Alignment is a framework principle because it is a claim about how COBIT is built — mappings, shared vocabulary, explicit integration — not a claim about one enterprise’s system. An enterprise can still choose to be badly aligned. The framework itself is designed so alignment is possible. That is why “COBIT replaces ITIL” fails twice: it is factually false as positioning, and it violates a published framework principle.

Do not invent a hierarchy that says COBIT is always “above ISO” in every professional act. A security assessor still audits an ISMS against ISO/IEC 27001. A project manager still plans work with a project method. COBIT’s claim is enterprise I&T governance that can host those practices, not exclusive ownership of every professional practice.

The three in one view

Read the middle column as the scoring language. Read the right column as the distractor language.

COBIT 5 did not have framework principles

COBIT 5 (2012) published five principles as a single list: meeting stakeholder needs; covering the enterprise end to end; applying a single integrated framework; enabling a holistic approach; and separating governance from management.

COBIT 2019, published in 2018, evolved that list. It split the idea into six system principles plus three new framework principles. The three framework principles — conceptual model, open and flexible, aligned to major standards — are a 2019 addition. They are not a hidden COBIT 5 appendix, not a renaming of “applying a single integrated framework,” and not three extra system principles that COBIT 5 forgot to number.

Exam trap, stated plainly: do not say COBIT 5 already had framework principles. It did not use that split. Do not list the three framework principles as if they were three of the six system principles. Do not list the six system principles when a stem asks for framework principles. Do not “helpfully” add the old COBIT 5 fifth item, “applying a single integrated framework,” as a fourth 2019 framework principle.

A clean memory device:

• System = 6 = how the enterprise’s EGIT system should behave.
• Framework = 3 = how the COBIT product is built.
• Five-plus-three is a COBIT 5 hangover. The 2019 counts are six and three.

Scenario: the consultant’s slide at Pinnacle Transit

Pinnacle Transit is refreshing its EGIT story before a board offsite. A consultant presents a slide titled “COBIT 2019’s nine system principles” and puts “based on a conceptual model,” “open and flexible,” and “aligned to major related standards” in the same column as “provide stakeholder value.” A footnote claims “COBIT 5 already stated the framework principles; 2019 only renamed them.”

That slide fails the Foundation exam twice.

The first three items on the mixed list are framework principles. They explain why COBIT can host a new DevOps focus area without rewriting EDM, and why a bank can keep ISO/IEC 27001 under an EGIT umbrella. They do not tell Eastfield’s board how to cover OT, and they do not tell Harborline’s board how to stay out of sprint management.

The footnote is historically false. COBIT 5 had five principles and no framework-principle family. COBIT 2019 created the split.

Fix the slide: six system principles on the left, three framework principles on the right, and a footnote that the right-hand column did not exist as a named set in COBIT 5. When Pinnacle’s chair asks, “Which of these do we have to live?” the answer is the left column. When the chair asks, “Why can we keep ITIL and still adopt COBIT?” the answer is the right column — especially aligned to major related standards, supported by a conceptual model that stays open without falling apart.

How items are written

• System-design stem → six system principles.
• Product-construction stem → three framework principles.
• “COBIT 5 already stated the three framework principles” → reject.
• “Aligned to major standards means replace ITIL” → reject.
• “Conceptual model means install COBIT software” → reject.
• “Open and flexible means rewrite the 40” → reject.
• A list that mixes the two families under one heading → reject.

You now have the full Principles set: six for the system, three for the framework. Keep the lists in separate pockets. That habit is worth more than a mnemonic on exam day.