CISA Governance and Management of IT Practice Question
Which THREE of the following are components of the COBIT 2019 governance system?
⚠ Common exam trap
Many exam-takers confuse COBIT governance components with ITIL operational functions (service desk, PMO) — candidates who have ITIL fresh in mind often select service desk or PMO because they sound 'governance-adjacent' but are not COBIT 2019 components.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Organizational structures
COBIT 2019 defines a governance system as comprising several distinct types of components, and among the listed choices the three that belong are A (Organizational structures), B (Information items), and C (Processes). Organizational structures are correct because COBIT 2019 explicitly names them as a component type, covering the various decision-making bodies and roles (such as boards, committees, and executive management) that carry out governance and management activities. Information items are correct because COBIT 2019 lists them as a component, referring to the information produced and used by the governance system to enable informed decision-making and effective operation. Processes are correct because COBIT 2019 identifies processes as a core component type, encompassing the organized sets of practices and activities (the governance and management objectives) used to achieve enterprise goals. The unmarked options do not belong: a service desk (D) is a specific IT service management function rather than a COBIT 2019 governance system component type, and a project management office (E) is a particular organizational entity or function, not one of the defined component categories in the COBIT 2019 governance system.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Organizational structures
Why this is correct
Organisational structures are one of COBIT 2019's governance system components, alongside processes, policies and procedures, information, culture and behaviour, people skills and competencies, services, infrastructure and applications. They define decision rights and accountability, satisfying the stem's requirement for governance system components.
- ✓
Information items
Why this is correct
Information items are a COBIT 2019 governance system component, covering the information produced and used by governance. This satisfies the stem's requirement, since information items are one of the six components that must be considered when designing governance.
- ✓
Processes
Why this is correct
Processes are one of the COBIT 2019 governance system components, representing organised sets of practises and activities that achieve governance and management objectives. This satisfies the stem's requirement, as processes form part of the six-component governance system alongside organisational structures.
- ✗
Service desk
Why it's wrong here
A service desk is an ITIL operational function, not one of the COBIT 2019 governance system components, which are processes, organisational structures, information flows, people, culture, services and infrastructure. It is tempting because service desks deliver IT services, but COBIT's components describe enablers of governance, not delivery functions.
- ✗
Project management office
Why it's wrong here
The COBIT 2019 governance system comprises governance and management objectives, components, focus areas, design factors and performance management; a PMO is an organisational structure, not a component. It is tempting because PMOs support governance implementation, but COBIT components are process, organisational, information, people, service and infrastructure enablers.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISA question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CISA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization is adopting COBIT 2019. Which TWO of the following are components of the governance system?
medium- ✓ A.Processes
- B.IT hardware inventory
- C.Information flows
- ✓ D.Organizational structures
- E.Employee satisfaction surveys
Why A: In COBIT 2019, the governance system is built from a set of governance system components (formerly called enablers), and Processes (A) is one of them — it covers the defined practices and activities that achieve governance and management objectives. Organizational structures (D) is also a core component, describing the decision-making entities such as boards, committees, and roles that carry out governance. The other listed items are not COBIT 2019 governance system components: IT hardware inventory (B) is an asset/infrastructure detail, Information flows (C) is not one of the defined components (COBIT addresses information as part of the 'Information' component, not 'information flows'), and Employee satisfaction surveys (E) are a measurement/feedback tool rather than a governance system component.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.