COBIT 2019 Foundation: Principles, Policies, and Frameworks - Complete Guide

Principles, Policies, and Frameworks in COBIT 2019

Why This Topic Is Important

Principles, Policies, and Frameworks form the foundational layer of the COBIT 2019 Governance System Components. Understanding this component is critical because:

• Establishes Direction: They set the tone and direction for how an organization will govern and manage its IT and enterprise resources
• Ensures Consistency: Policies and frameworks ensure consistent decision-making and behavior across the organization
• Provides Structure: They create a structured approach to governance, ensuring nothing is left to chance
• Supports Compliance: They help organizations meet regulatory and compliance requirements
• Foundation for Implementation: All other governance system components build upon these foundational elements

What Are Principles, Policies, and Frameworks?

In COBIT 2019, these three elements work together to form the governance foundation:

1. Principles

Principles are fundamental truths or statements that guide decision-making and behavior. In COBIT 2019 context:

• They are high-level statements that describe core values and beliefs
• They provide strategic direction for governance and management
• They are enduring and relatively stable over time
• They answer the question: "What do we believe in?"
• Example: "We believe IT should enable business value creation"

2. Policies

Policies translate principles into actionable rules and guidelines:

• They are specific directives that define what must, must not, or should be done
• They provide detailed guidance on how to implement principles
• They establish boundaries and rules for behavior and decisions
• They are enforceable and have consequences for non-compliance
• They answer the question: "What are our rules?"
• Example: "All IT projects over €100,000 must undergo formal business case review"

3. Frameworks

Frameworks provide structured approaches and methodologies:

• They are structured methods or systems for organizing and implementing governance
• They provide models and structures to guide implementation
• They help organize processes and responsibilities
• They offer best practice guidance and proven approaches
• They answer the question: "How do we organize this?"
• Example: ITIL, COBIT itself, or custom governance frameworks

How These Elements Work Together

Hierarchical Relationship:

1. Principles define the "what" and "why" (strategic intent and core beliefs)
2. Policies define the "what" and "must" (specific requirements and rules)
3. Frameworks define the "how" and "structure" (implementation approach and organization)

Example of Integration:

• Principle: "We prioritize cybersecurity in all IT operations"
• Policy: "All employees must change passwords every 90 days and use multi-factor authentication"
• Framework: "We implement the NIST Cybersecurity Framework to organize our security controls"

Key Characteristics of Each Element

Principles

• Strategic and visionary in nature
• Broad and universal application
• Stable and long-lasting
• Provide context and intent
• Guide all decisions and actions
• Often documented in governance charters

Policies

• Specific and detailed
• Prescriptive in nature
• Have defined scope and applicability
• Include sanctions for non-compliance
• Are regularly reviewed and updated
• Address "dos" and "don'ts"

Frameworks

• Provide methodology and structure
• Often based on industry standards
• Include roles and responsibilities
• Define processes and procedures
• Offer flexibility in implementation
• Support consistency and completeness

Why They Matter in COBIT 2019

In COBIT 2019's Governance System:

• Foundation Layer: Principles, Policies, and Frameworks form the base upon which all other governance system components rest
• Strategic Alignment: They ensure IT governance aligns with business strategy and objectives
• Performance Management: They establish what success looks like and how performance will be measured
• Culture Setting: They shape organizational culture around governance and management
• Risk Management: They define how risks should be identified, assessed, and managed
• Resource Allocation: They guide decisions about how resources should be invested and managed

Practical Implementation Considerations

For Principles

• Should be developed by senior leadership and board
• Must align with organizational mission and values
• Should be communicated organization-wide
• Need periodic review to ensure continued relevance

For Policies

• Should be derived from and support principles
• Must be specific, measurable, and enforceable
• Require clear ownership and accountability
• Need regular review and update cycles (typically annually)
• Must have documented exceptions and approval processes

For Frameworks

• Can be adopted from external sources or developed internally
• Should be adapted to organizational context
• Require clear documentation and communication
• Need integration with other organizational frameworks
• Require training and capability building

Common Exam Questions About This Topic

Question Type 1: Definitional Understanding

Example Question: "Which of the following best describes the role of policies in COBIT 2019?"
Key Answer Elements: Specific rules and directives, translate principles into action, enforceable guidelines

Question Type 2: Relationship and Integration

Example Question: "In what order should the following be developed: Frameworks, Policies, Principles?"
Key Answer Elements: Principles first (strategic), then Policies (rules based on principles), then Frameworks (implementation structure)

Question Type 3: Purpose and Importance

Example Question: "Why is it important to have documented principles for IT governance?"
Key Answer Elements: Provide direction, ensure alignment, guide decision-making, create consistency

Question Type 4: Practical Application

Example Question: "You are establishing IT governance for a financial institution. Which governance system component should you establish first?"
Key Answer Elements: Principles, Policies, and Frameworks - establishing the foundation

Question Type 5: Scenario-Based

Example Question: "A company has a principle of 'minimize IT risks' but no corresponding policies. What is the likely impact?"
Key Answer Elements: No clear rules or guidelines, inconsistent implementation, difficulty measuring compliance

Exam Tips: Answering Questions on Principles, Policies, and Frameworks

Tip 1: Understand the Hierarchy

Always remember the hierarchical relationship:

• Principles are strategic and foundational
• Policies are specific rules derived from principles
• Frameworks are structures for implementing policies
• Use this hierarchy to answer relationship questions correctly

Tip 2: Focus on Key Differentiators

Distinguish between the three elements by their characteristics:

• Principles: Ask "why?" - Strategic intent and core beliefs
• Policies: Ask "what rules?" - Specific enforceable directives
• Frameworks: Ask "how organized?" - Structured approaches and methodologies

Tip 3: Remember the Purpose

When answering exam questions, keep in mind:

• These elements provide direction, consistency, and structure
• They form the foundation of the COBIT 2019 Governance System
• They enable strategic alignment between IT and business

Tip 4: Look for Cause-and-Effect Relationships

Many exam questions present scenarios where one element affects another:

• Weak principles → Inconsistent policies and frameworks
• Missing policies → Inability to enforce principles
• Poor framework → Difficulty implementing policies
• Identify these relationships to answer correctly

Tip 5: Recognize Implementation Patterns

When you see implementation scenarios, remember:

• Organizations must establish principles before detailed policies
• Policies must be derived from and support principles
• Frameworks should be selected or designed to support policy implementation
• Alignment of all three is critical to success

Tip 6: Beware of Trap Answers

Watch out for questions that:

• Confuse principles with policies (principles are broader and strategic)
• Treat frameworks as if they are policies (frameworks organize; policies direct)
• Suggest frameworks replace the need for principles (all three are needed)
• Imply policies can be very broad and strategic (they must be specific)

Tip 7: Connect to Business Value

Remember that these elements ultimately serve business purposes:

• They enable value creation through IT
• They support risk management and compliance
• They facilitate resource optimization
• When answering, connect answers back to business impact when possible

Tip 8: Use Process of Elimination

For multiple-choice questions:

• Eliminate answers that describe only one element when the question asks about relationships
• Remove answers that suggest flexibility when the topic requires structure
• Discard answers that confuse strategic with operational
• Choose answers that recognize the integrated nature of all three elements

Tip 9: Practice with Case Studies

When studying, use real-world scenarios:

• How would you establish these for a healthcare organization?
• What principles would a fintech startup have?
• How would policies differ in a regulated industry?
• This contextual learning helps with scenario-based exam questions

Tip 10: Review COBIT 2019 Documentation

Pay special attention to:

• The definition of Governance System Components
• How Principles, Policies, and Frameworks are specifically described in COBIT 2019
• Examples of each element in the documentation
• Relationships with other governance system components

Summary Key Points for Exam Success

• Principles = Strategic beliefs (Why - what we believe)
• Policies = Specific rules (What and Must - our directives)
• Frameworks = Structured approaches (How - our methodology)
• They form the foundation of COBIT 2019 Governance System
• They must work together as an integrated system
• They enable strategic alignment and consistent behavior
• They provide direction, consistency, and structure
• Organizations must develop them sequentially: Principles → Policies → Frameworks
• All three are essential - none can be replaced by another
• They support business value creation and risk management