Study guide
5.4 Three Governance Framework Principles
ISACA COBIT 2019 Foundation Certificate Exam
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current Exam Facts 1.2 Certificate Rules, Retakes, and How to Study
2 Chapter 2: Framework Introduction
2.1 Purpose of COBIT and EGIT 2.2 I&T Versus the IT Function 2.3 COBIT 2019 Product Family 2.4 Stakeholders, Audience, and Benefits
3 Chapter 3: Framework Positioning
3.1 Umbrella Framework and Related Standards 3.2 Evolution from COBIT 5 to COBIT 2019
4 Chapter 4: Governance System Principles I
4.1 Provide Stakeholder Value 4.2 Holistic Approach 4.3 Dynamic Governance System
5 Chapter 5: Governance System Principles II and Framework Principles
5.1 Governance Distinct from Management 5.2 Tailored to Enterprise Needs 5.3 End-to-End Coverage 5.4 Three Governance Framework Principles
6 Chapter 6: Governance System Components Overview
6.1 Seven Governance System Components 6.2 Generic Versus Variant Components 6.3 Focus Areas
7 Chapter 7: Process and Structure Components
7.1 Processes Component 7.2 Practices, Activities, and Metrics 7.3 Organizational Structures 7.4 Principles, Policies, and Frameworks
8 Chapter 8: Information and People Components
8.1 Information Component 8.2 Culture, Ethics, and Behavior 8.3 People, Skills, and Competencies 8.4 Services, Infrastructure, and Applications
9 Chapter 9: Integrating Governance System Components
9.1 How Components Work Together 9.2 RACI Charts and Key Roles 9.3 Components Supporting Objectives
10 Chapter 10: The Goals Cascade
10.1 The Goals Cascade 10.2 Enterprise Goals and Alignment Goals
11 Chapter 11: Core Model and EDM Governance Objectives
11.1 The 40-Objective Core Model 11.2 EDM Governance Objectives 11.3 Governance Versus Management Objectives
12 Chapter 12: APO Align, Plan, and Organize
12.1 APO Strategy, Architecture, and Innovation 12.2 APO Portfolio, Resources, and Relationships 12.3 APO Risk, Security, Data, and Quality
13 Chapter 13: BAI, DSS, and MEA Management Objectives
13.1 BAI Build, Acquire, and Implement 13.2 DSS Deliver, Service, and Support 13.3 MEA Monitor, Evaluate, and Assess
14 Chapter 14: Performance Management
14.1 Performance Management Principles 14.2 Capability Levels 0–5 and Maturity
15 Chapter 15: Designing a Tailored Governance System
15.1 Why Tailor: Design Factors 15.2 The Eleven Design Factors 15.3 Design Workflow and Toolkit
16 Chapter 16: Business Case
16.1 Business Case for EGIT 16.2 Benefits, Costs, Risk, and Tracking
17 Chapter 17: Implementation Lifecycle
17.1 Implementation Lifecycle Overview 17.2 Seven Implementation Phases 17.3 Roles, Pain Points, and Challenges 17.4 Design Guide and Implementation Guide Together
5.4 Three Governance Framework Principles
Key Takeaways Explain This Topic AI
The three governance framework principles describe how COBIT itself is built, not how an enterprise’s governance system should behave.
Based on a conceptual model means identifying key components and relationships, maximizing consistency, and allowing automation.
Open and flexible means new content and new issues can be added while integrity and consistency are preserved.
Aligned to major related standards is the umbrella claim: COBIT maps and integrates other bodies of knowledge rather than replacing them.
COBIT 5 had five principles and no framework-principle set; listing the three as system principles, or claiming COBIT 5 already had them, is an exam trap.
Last updated: August 2026
Quick Answer: COBIT 2019 adds three governance framework principles . They describe how COBIT itself is built, not how an enterprise’s governance system should behave. The three are: based on a conceptual model , open and flexible , and aligned to major related standards . They are not a second copy of the six system principles. COBIT 5 did not have this split and did not publish these three framework principles.
Candidates lose easy points in this 13% domain by dumping every COBIT “principle” into one mental list. COBIT 2019 is explicit about two families with two jobs. The six you have now finished — provide stakeholder value, holistic approach, dynamic governance system, governance distinct from management, tailored to enterprise needs, and end-to-end coverage — judge the enterprise’s EGIT system . The three in this section judge the product called COBIT.
A useful analogy is a building code versus a finished hospital. System principles describe the hospital you operate: who governs, how far coverage runs, how you tailor. Framework principles describe how the code book itself is written so new chapters can be added without rewriting the wiring diagram, and so the code can sit next to fire, electrical, and accessibility codes instead of pretending to replace them.
Two families, two jobs
Family Count Job Audience on exam day
Governance system principles 6 How the enterprise’s EGIT system should behave once it is in place Harborline’s board pack, Riverbend’s tailoring, Eastfield’s plant
Governance framework principles 3 How the COBIT guidance is structured so it stays consistent, extensible, and usable next to other standards The publication family, mappings, focus-area architecture
If a stem asks how a governance system should be designed, stay in the six. If it asks how COBIT the framework is constructed, stay in the three. If it offers a blended list of nine “system principles,” the blend is already wrong.
Principle 1 — Based on a conceptual model
The framework should identify key components and the relationships among them , maximize consistency , and allow automation .
That is why COBIT 2019 is not a pile of essays. It has a core model of 40 objectives, seven components , a goals cascade , design factors, and a performance-management scheme that reuse the same objects. Consistency is what lets an enterprise map a process to an objective, an objective to an alignment goal, and a goal to a stakeholder need without inventing a new language each time.
“Allow automation” is easy to misread. It does not mean “COBIT is a software product you install.” Chapter 2 already killed that idea. It means the model is regular enough that tools can store objectives, components, ratings, and mappings without each implementation inventing a private schema. A governance, risk, and compliance (GRC) tool can represent COBIT because COBIT is modeled. The tool is still not COBIT, and buying the tool does not satisfy this principle.
If a stem praises COBIT for having identified components and relationships so guidance stays consistent, you are on this framework principle — not on holistic approach , which is the system principle about using those components together inside an enterprise. Conceptual model = how the book is built. Holistic approach = how the hospital uses all the parts.
Principle 2 — Open and flexible
The framework should let practitioners add new content and address new issues while keeping integrity and consistency .
That is the design reason COBIT 2019 talks about an open-ended product architecture , focus areas , and variants . A new regulation, a new delivery method, or a new technology concern should be addable without breaking the 40-objective spine or renaming EDM.
Open is not sloppy. You cannot invent a forty-first core-model domain, collapse APO into EDM, or swap the seven components for a private list and still claim you are using COBIT. Flexibility lives inside the model: new focus-area guidance, new mappings, new variants of components. Integrity means the conceptual model still holds after the addition. The two framework principles reinforce each other: you can be open because you have a conceptual model worth protecting.
This principle is also why COBIT 2019 can grow after publication without waiting for a wholesale rewrite of every page. The exam cares about the idea — add content, address new issues, keep integrity — not a product-roadmap rumor and not a claim that enterprises may ignore the core model whenever they feel flexible.
Principle 3 — Aligned to major related standards
The framework should sit as an umbrella and stay aligned to major related standards, frameworks, and regulations .
You already met this idea in Framework Introduction: COBIT is specifically designed to play well with others . It maps to ITIL , ISO/IEC 27001 , NIST cybersecurity guidance, TOGAF , COSO , ISO 31000 , PMBOK , and similar bodies of knowledge. It does not retire them.
Alignment is a framework principle because it is a claim about how COBIT is built — mappings, shared vocabulary, explicit integration — not a claim about one enterprise’s system. An enterprise can still choose to be badly aligned. The framework itself is designed so alignment is possible. That is why “COBIT replaces ITIL” fails twice: it is factually false as positioning, and it violates a published framework principle.
Do not invent a hierarchy that says COBIT is always “above ISO” in every professional act. A security assessor still audits an ISMS against ISO/IEC 27001. A project manager still plans work with a project method. COBIT’s claim is enterprise I&T governance that can host those practices, not exclusive ownership of every professional practice.
The three in one view
Framework principle Official intent What it is not
Based on a conceptual model Name key components and relationships; maximize consistency; allow automation Not “buy a COBIT application”; not the system principle holistic approach
Open and flexible Add new content and address new issues without breaking integrity and consistency Not “change the 40-objective core at will”; not “skip design factors”
Aligned to major related standards Umbrella positioning; integrate and map related guidance Not “replace ITIL, ISO, or NIST”
Read the middle column as the scoring language. Read the right column as the distractor language.
COBIT 5 did not have framework principles
COBIT 5 (2012) published five principles as a single list: meeting stakeholder needs; covering the enterprise end to end; applying a single integrated framework; enabling a holistic approach; and separating governance from management.
COBIT 2019 , published in 2018 , evolved that list. It split the idea into six system principles plus three new framework principles . The three framework principles — conceptual model, open and flexible, aligned to major standards — are a 2019 addition . They are not a hidden COBIT 5 appendix, not a renaming of “applying a single integrated framework,” and not three extra system principles that COBIT 5 forgot to number.
Exam trap, stated plainly: do not say COBIT 5 already had framework principles. It did not use that split. Do not list the three framework principles as if they were three of the six system principles. Do not list the six system principles when a stem asks for framework principles. Do not “helpfully” add the old COBIT 5 fifth item, “applying a single integrated framework,” as a fourth 2019 framework principle.
A clean memory device:
System = 6 = how the enterprise’s EGIT system should behave.
Framework = 3 = how the COBIT product is built.
Five-plus-three is a COBIT 5 hangover. The 2019 counts are six and three.
Scenario: the consultant’s slide at Pinnacle Transit
Pinnacle Transit is refreshing its EGIT story before a board offsite. A consultant presents a slide titled “COBIT 2019’s nine system principles” and puts “based on a conceptual model,” “open and flexible,” and “aligned to major related standards” in the same column as “provide stakeholder value.” A footnote claims “COBIT 5 already stated the framework principles; 2019 only renamed them.”
That slide fails the Foundation exam twice.
The first three items on the mixed list are framework principles. They explain why COBIT can host a new DevOps focus area without rewriting EDM, and why a bank can keep ISO/IEC 27001 under an EGIT umbrella. They do not tell Eastfield’s board how to cover OT, and they do not tell Harborline’s board how to stay out of sprint management.
The footnote is historically false. COBIT 5 had five principles and no framework-principle family. COBIT 2019 created the split.
Fix the slide: six system principles on the left, three framework principles on the right, and a footnote that the right-hand column did not exist as a named set in COBIT 5. When Pinnacle’s chair asks, “Which of these do we have to live?” the answer is the left column. When the chair asks, “Why can we keep ITIL and still adopt COBIT?” the answer is the right column — especially aligned to major related standards, supported by a conceptual model that stays open without falling apart.
How items are written
System-design stem → six system principles.
Product-construction stem → three framework principles.
“COBIT 5 already stated the three framework principles” → reject.
“Aligned to major standards means replace ITIL” → reject.
“Conceptual model means install COBIT software” → reject.
“Open and flexible means rewrite the 40” → reject.
A list that mixes the two families under one heading → reject.
You now have the full Principles set: six for the system, three for the framework. Keep the lists in separate pockets. That habit is worth more than a mnemonic on exam day.