5.1 Governance Distinct from Management

Quick Answer: Governance belongs to the board (or other governing body): Evaluate stakeholder needs, conditions, and options; Direct through prioritization and decision-making; and Monitor performance and compliance. That triad is the Evaluate, Direct and Monitor (EDM) domain — five objectives whose titles start with “Ensured …”. Management plans, builds, runs, and monitors activities in line with that direction. That work is Align, Plan and Organize (APO), Build, Acquire and Implement (BAI), Deliver, Service and Support (DSS), and Monitor, Evaluate and Assess (MEA) — 35 objectives whose titles start with “Managed …”. A CIO who is running projects is doing management, not governance.

Principles is 13% of the 75-question COBIT 2019 Foundation exam — roughly ten items. Chapter 4 covered the first three governance-system principles. This chapter finishes the remaining three and then teaches the three framework principles. Start with the split candidates confuse most: governance is distinct from management.

Why COBIT insists on the split

Boards and executive teams both say “IT governance” in hallway language. COBIT refuses to let that blur stand. If the same people set direction, execute the work, and then grade their own homework, the enterprise has lost the independent evaluate-direct-monitor loop that corporate governance requires.

Picture a city council versus a public-works department. The council evaluates whether a new transit line is needed, directs which line gets funded, and monitors ridership and cost. Public works plans the route, builds the track, runs the trains, and monitors daily operations. When the same crew does both jobs without a separate governing loop, overruns hide inside the meeting that approved them.

COBIT applies that pattern to enterprise governance of information and technology (EGIT). The governing body — usually the board of directors, sometimes a public-sector equivalent or an owner-managed board — owns governance. Executive management, including the chief information officer (CIO) and business executives, owns management. Officers can inform the board. They do not become the board by being busy, senior, or technically fluent.

This principle is not an insult to the CIO. It is a protection for the enterprise. The CIO organization is often the only group that can translate options into cost, risk, and delivery consequences. That translation feeds Evaluate, Direct, and Monitor. It does not replace them.

Governance: Evaluate, Direct, Monitor

ISACA’s official governance verb set is Evaluate, Direct, and Monitor. Those three words are the domain name EDM.

• Evaluate stakeholder needs, enterprise conditions, and options. The board asks whether a digital program is even the right bet, what risk appetite applies, and which trade-offs among benefits, risk, and resources are acceptable.
• Direct through prioritization and decision-making. The board does not write user stories. It sets priorities, assigns decision rights, approves appetite and investment envelopes, and tells management what “good” looks like.
• Monitor performance and compliance. The board checks whether direction is being followed, whether value is appearing, and whether legal, regulatory, and policy constraints are being met.

EDM contains five governance objectives. Every official title starts with Ensured:

“Ensured” is a Foundation tell. If the title starts with Ensured, you are in governance. If a stem asks which domain is governance, the answer is EDM, not APO. Do not invent a sixth EDM objective, and do not rename EDM as a management domain because the word Monitor appears in the title.

Management: Plan, Build, Run, Monitor

Management’s verb set is plan, build, run, and monitor. Management takes the board’s direction and turns it into work.

• Plan — strategy, architecture, portfolios, budgets, relationships, risk treatments, security and data approaches (the APO domain, 14 objectives).
• Build — programs, requirements, solutions, change, knowledge, assets, configuration, projects (the BAI domain, 11 objectives).
• Run — operations, incidents, problems, continuity, security services, business-process controls (the DSS domain, 6 objectives).
• Monitor — performance and conformance, internal control, external compliance, assurance (the MEA domain, 4 objectives).

Those four domains hold 35 management objectives. Every official title starts with Managed — Managed Strategy, Managed Vendors, Managed Projects, Managed Operations, Managed Assurance, and so on. “Managed” is the management tell the same way “Ensured” is the governance tell.

Notice that monitor appears on both sides. That is intentional, and it is an exam trap. Governance monitors whether direction is being followed and whether value, risk, and resources stay in balance. Management monitors whether the work itself is performing — service levels, control operation, project progress, compliance tasks. Same English word. Different altitude. MEA is still a management domain even though its name begins with Monitor.

Five plus 35 is the 40-objective core model. A stem that says “the four EDM objectives” or “the 40 management objectives” is already wrong on the count.

Comparison you should memorize

Keep the left column as the board. Keep the right column as management. Do not slide EDM into the right column because it contains the word Monitor.

Scenario: Harborline Mutual’s board and CIO

Harborline Mutual is a regional insurer. The board has approved a three-year “claims in minutes” program: a mobile first-notice-of-loss app, a vendor claims engine, and a data platform for fraud scoring. Two weeks later the CIO presents a colorful roadmap and says, “Governance is covered. I am chairing the weekly project stand-up, I am approving every sprint, and I personally reassigned three analysts to the vendor.”

That sentence fails this principle three ways.

First, chairing a stand-up is management. Planning capacity, building the app, running the vendor, and monitoring sprint burn-down sit in APO, BAI, DSS, and MEA. They are necessary. They are not Evaluate-Direct-Monitor. Approving a change ticket is not EDM01. Reassigning analysts is not EDM04. Those are management acts that should follow resource direction the board already set.

Second, the board has not yet done its governance job if the only artifact is a CIO roadmap. Evaluate: is “claims in minutes” still the right bet given capital, conduct-risk, and the existing policy-admin debt? Direct: what risk appetite applies to a third-party claims engine that will hold claimant data, and which other investments get deferred? Monitor: what benefits, risk, and resource signals will come back to the board, and how often?

Third, the CIO cannot “become” the governing body by being diligent. Diligence is praiseworthy management. Governance still belongs to the board. The CIO supports EDM by giving the board options, consequences, and honest monitoring data. Support is not substitution.

A Foundation-shaped rewrite of the CIO’s line would be: “Management will plan, build, run, and monitor the program inside the priorities and appetite you set. Here are the options, the trade-offs, and the signals we will bring back so you can evaluate, direct, and monitor.”

The opposite failure is just as testable. If Harborline’s chair starts assigning developers or rewriting the vendor statement of work, the governing body has dropped into management and can no longer monitor independently. Distinction runs both ways.

Exam traps for this principle

• The CIO “does governance” by running projects. Running projects is BAI11 Managed Projects and related management work. Governance is EDM.
• Calling EDM a management domain. EDM is the only governance domain. APO, BAI, DSS, and MEA are management.
• Mixing the verb sets. Evaluate / Direct / Monitor is governance. Plan / Build / Run / Monitor is management. Shared use of “monitor” does not merge the lists.
• Counting. Five Ensured objectives, 35 Managed objectives, 40 total.
• Title language. Ensured = governance. Managed = management. Do not “fix” an official title on the exam.

If a stem describes a board setting risk appetite for a cloud migration, you are in EDM. If it describes a service-desk manager restoring an incident, you are in DSS. If it describes a project manager closing a release, you are in BAI. Role title is a hint. The verb is the proof.

Prefer the answer that keeps the board in Evaluate-Direct-Monitor, keeps the CIO in Plan-Build-Run-Monitor, and refuses to rename EDM as management.