Study guide
7.2 Practices, Activities, and Metrics
ISACA COBIT 2019 Foundation Certificate Exam
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current Exam Facts 1.2 Certificate Rules, Retakes, and How to Study
2 Chapter 2: Framework Introduction
2.1 Purpose of COBIT and EGIT 2.2 I&T Versus the IT Function 2.3 COBIT 2019 Product Family 2.4 Stakeholders, Audience, and Benefits
3 Chapter 3: Framework Positioning
3.1 Umbrella Framework and Related Standards 3.2 Evolution from COBIT 5 to COBIT 2019
4 Chapter 4: Governance System Principles I
4.1 Provide Stakeholder Value 4.2 Holistic Approach 4.3 Dynamic Governance System
5 Chapter 5: Governance System Principles II and Framework Principles
5.1 Governance Distinct from Management 5.2 Tailored to Enterprise Needs 5.3 End-to-End Coverage 5.4 Three Governance Framework Principles
6 Chapter 6: Governance System Components Overview
6.1 Seven Governance System Components 6.2 Generic Versus Variant Components 6.3 Focus Areas
7 Chapter 7: Process and Structure Components
7.1 Processes Component 7.2 Practices, Activities, and Metrics 7.3 Organizational Structures 7.4 Principles, Policies, and Frameworks
8 Chapter 8: Information and People Components
8.1 Information Component 8.2 Culture, Ethics, and Behavior 8.3 People, Skills, and Competencies 8.4 Services, Infrastructure, and Applications
9 Chapter 9: Integrating Governance System Components
9.1 How Components Work Together 9.2 RACI Charts and Key Roles 9.3 Components Supporting Objectives
10 Chapter 10: The Goals Cascade
10.1 The Goals Cascade 10.2 Enterprise Goals and Alignment Goals
11 Chapter 11: Core Model and EDM Governance Objectives
11.1 The 40-Objective Core Model 11.2 EDM Governance Objectives 11.3 Governance Versus Management Objectives
12 Chapter 12: APO Align, Plan, and Organize
12.1 APO Strategy, Architecture, and Innovation 12.2 APO Portfolio, Resources, and Relationships 12.3 APO Risk, Security, Data, and Quality
13 Chapter 13: BAI, DSS, and MEA Management Objectives
13.1 BAI Build, Acquire, and Implement 13.2 DSS Deliver, Service, and Support 13.3 MEA Monitor, Evaluate, and Assess
14 Chapter 14: Performance Management
14.1 Performance Management Principles 14.2 Capability Levels 0–5 and Maturity
15 Chapter 15: Designing a Tailored Governance System
15.1 Why Tailor: Design Factors 15.2 The Eleven Design Factors 15.3 Design Workflow and Toolkit
16 Chapter 16: Business Case
16.1 Business Case for EGIT 16.2 Benefits, Costs, Risk, and Tracking
17 Chapter 17: Implementation Lifecycle
17.1 Implementation Lifecycle Overview 17.2 Seven Implementation Phases 17.3 Roles, Pain Points, and Challenges 17.4 Design Guide and Implementation Guide Together
7.2 Practices, Activities, and Metrics
Key Takeaways Explain This Topic AI
The Foundation stack is objective → process → practices → activities; practices group activities, and a practice is not an objective.
Activities can be tagged to capability levels — higher capability means more complete, organized, and measured activities, not a new process ID.
Each objective also has example metrics linked to alignment and enterprise goals; a metric measures, it is not a process.
EDM03.02 Direct risk management is a practice with activities such as directing appetite communication and accept-or-treat decisions; APO12 sits underneath as the management process.
The exam does not require memorizing about 1,202 activities; it requires recognizing the stack and refusing to treat a metric as a process.
Last updated: August 2026
Quick Answer: COBIT 2019 stacks work as objective → process → practices → activities . Practices group activities . Activities can be tagged to capability levels — higher capability needs more complete, organized, and measured work. Each objective also has example metrics tied to alignment and enterprise goals . The Foundation exam tests recognition of this stack, not memorization of about 1,202 activities.
The stack you must recognize closed-book
Candidates lose easy items when they flatten the stack. An objective is the outcome. The process is the organized work for that outcome. Inside the process, practices are the named chunks of work (EDM03.01, EDM03.02, EDM03.03). Inside each practice, activities are the concrete things people do. Metrics sit beside the stack as example measures; they are not a fifth layer of work and they are not a process.
Recite it once: objective, then process, then practices, then activities . A practice is not an objective. An activity is not a practice. A metric is not a process.
Practices exist so the process is teachable and assignable. “Manage risk” is too large to put on a RACI row. “Direct risk management” is a practice a governing body can own. “Maintain a risk profile” is a practice a risk function can own. Activities then unpack the practice into work a team can actually schedule: collect incidents, update the profile after a major change, brief the risk committee.
COBIT 2019 publishes on the order of 1,202 activities across the 40 processes. Foundation does not expect you to memorize them. If an item quotes an activity, your job is to place it: it belongs under a practice, inside a process, supporting an objective. If an item asks what you must memorize, the answer is the stack , the idea of capability-tagged activities , and the idea of example metrics — not the catalog.
Capability tags on activities
Performance management (Chapter 14) scores capability on the process . The process becomes more capable when its activities are more complete, more organized, and more measured.
A level-1 reading of a practice might include the essential activities — the work that means “we did it.” A level-2 or level-3 reading adds activities that plan the work, assign it, document it, and apply a standard way of working. Higher levels add measurement, prediction, and improvement activities. The practice ID does not change. EDM03.02 is still EDM03.02. What changes is how fully the activities under it are performed.
That is why “we have the practice on a slide” is not evidence of capability. Capability asks whether the activities actually happen in an organized, measured way. It is also why copying another firm’s practice list does not copy their capability. The IDs travel. The performed, managed, and established work does not.
Example metrics are not processes
Each objective offers example metrics . Those metrics are illustrative measures that show whether alignment goals and enterprise goals — and the process goals that support them — are moving. They are teaching aids, not a mandatory KPI standard and not a forty-first process.
A metric such as “percent of I&T risk exceeding agreed appetite” tells you whether EDM03 and APO12 are working. It is not the EDM03 process. It is not a practice. It does not have inputs and outputs. Confusing a metric with a process is a published Foundation trap: the number is a signal, the process is the work that produces outputs.
Metrics also do not replace the other six components. A green dashboard with no risk committee, no appetite policy, and no skilled analysts is decoration. And a metric is not an alignment goal. Alignment goals are the I&T-related goals in the cascade. Metrics are example ways to observe those goals.
Worked example: EDM03, with APO12 underneath
Use EDM03 Ensured Risk Optimization as the governance picture and APO12 Managed Risk as the management counterpart. Governance evaluates, directs, and monitors . Management collects data, analyzes risk, maintains a profile, articulates risk, defines a risk-action portfolio, and responds.
EDM03’s process typically groups three practices that match the EDM verbs:
Practice (conceptual) What the governing body is doing Example activities — not a list to memorize
EDM03.01 Evaluate risk management Judge whether the risk approach, appetite, and thresholds still fit stakeholder value Review appetite against strategy; evaluate whether current risk information is decision-grade
EDM03.02 Direct risk management Set direction for how management will treat I&T risk Direct communication of appetite; direct which risks require treatment versus acceptance
EDM03.03 Monitor risk management Watch whether risk stays inside directed limits Monitor residual risk versus appetite; monitor whether treatments actually closed the exposure
Take EDM03.02 Direct risk management . The practice is not the objective — the objective is ensured risk optimization. The practice is not a metric — “percent of risks with an explicit accept-or-treat decision” might be an example metric sitting beside the stack. The practice groups activities such as: communicate the approved appetite to management; require that material I&T risks come to the governing body with a recommended response; forbid silent acceptance of risk above threshold; and insist that risk direction is written so APO12 can execute it.
Those activities can be tagged to capability. At a low capability the board mentions risk once a year. At a higher capability the same EDM03.02 activities happen on a defined cadence, with recorded decisions, with escalation rules, and with measures that show whether direction was followed.
APO12 Managed Risk sits underneath that direction. Its practices conceptually include collecting data, analyzing risk, maintaining a risk profile, articulating risk, defining a risk-action portfolio, and responding to risk. APO12.03 Maintain a risk profile is a practice , not an objective and not a metric. Activities under it might include updating the profile after incidents, after major projects, and after vendor changes. The output is a current risk profile. The input often includes EDM03’s directed appetite plus incident and monitoring data from DSS or MEA processes.
Walk one sentence of the stack out loud: the objective is EDM03 Ensured Risk Optimization; the process is the related EDM03 process; EDM03.02 is a practice ; “direct communication of appetite” is an activity ; “percent of residual risk above appetite” is an example metric . If you can place those five nouns, you can place almost any Foundation item in this family.
Exam traps on the stack
Two traps dominate. Treating a metric as a process — the candidate sees a percentage and names it APO12. Treating a practice as an objective — the candidate sees EDM03.02 and calls it a governance objective, or sees “maintain a risk profile” and thinks it replaced APO12.
A third, quieter miss is treating the 1,202 activities as the study plan. You will not be asked to list them. You will be asked whether an activity belongs under a practice, whether a higher capability means more complete activities, and whether a metric is something other than work. Keep the units separate and the items become mechanical.