COBIT Design Factors: All 11 Explained With a Worked Example

Last updated 19 September 2026

The COBIT design factors are the eleven inputs COBIT 2019 uses to turn a generic framework of 40 governance and management objectives into a governance system for one specific enterprise, and they are the part of the framework that answers the objection every previous COBIT version attracted: that nobody can implement all of it. Nobody is meant to.

The Design Guide — one of the four core COBIT 2019 publications — works the eleven factors through a four-stage design workflow whose output is a prioritised set of objectives, each with a target capability level and, where a factor demands it, a focus-area variant. This guide lists the eleven COBIT design factors with the values each can take and the objectives each tends to raise or lower, walks the four design stages, gives a worked example for a mid-sized regulated company, and lists the ways a design workshop produces a governance system nobody can afford.

The eleven COBIT design factors

The factors are not weighted equally by the framework; they are weighted by the enterprise. The Design Guide’s toolkit assigns each factor’s values to objectives through published mapping tables, and the sum across factors produces a relative importance score per objective — which the design team then reviews rather than accepts. Our guide to COBIT 2019 covers the objectives the factors act on; the COBIT domains lists all 40.

The four stages: applying the COBIT design factors

Stage 4 is where the design becomes a document: the argument for why this enterprise prioritises these objectives at these levels. That argument is what the board approves, what the implementation programme scopes from, and what an auditor or regulator reads to understand why, say, BAI03 is at level 2 and APO12 at level 4. Our guide to COBIT capability levels covers the scale the targets are set on.

A worked example of the COBIT design factors

A 400-person financial services firm, regulated, with a client-service strategy, a hybrid sourcing model heavy on SaaS, agile delivery, a follower adoption stance and a high compliance requirement.

Where COBIT design factor workshops go wrong

• Everything is critical. Every enterprise goal rated 5, every risk high, every issue serious — the mapping then prioritises all 40 objectives and the design has designed nothing.
• The strategy is invented in the room. Factor 1 must come from the enterprise’s actual strategy documents; a design team choosing “innovation” because it sounds better than “cost leadership” produces a governance system for a different company.
• Risk profile copied from a generic register. The 19 categories are rated for this enterprise’s impact and likelihood, with the risk function in the room.
• Target capability set at 5 by default. Level 5 is optimising and continuously improving; most objectives in most enterprises are appropriately targeted at 2 or 3, and the design factors say which deserve more.
• Focus areas ignored. Agile, DevOps, SME and cloud variants exist so that the generic objectives fit the enterprise; applying the generic components to a DevOps shop produces controls the shop will route around.
• No reasoning recorded. The output is not the list; it is the argument. Our guide to COBIT 2019 implementation covers what happens to the design next.

Frequently asked questions

What are the COBIT design factors?
Eleven inputs in COBIT 2019’s Design Guide — enterprise strategy, enterprise goals, risk profile, I&T-related issues, threat landscape, compliance requirements, role of IT, sourcing model, IT implementation methods, technology adoption strategy and enterprise size — that determine which of the 40 objectives an enterprise prioritises, at what capability, and with which focus-area variants.

Do you have to use all eleven?
The Design Guide’s workflow uses all of them across its four stages, but their influence differs: the first four set the initial scope through the goals cascade and the risk and issues mappings; the remaining seven refine it. Skipping a factor leaves an objective’s priority unjustified.

What is the goals cascade?
The mechanism behind design factor 2: enterprise goals map to alignment goals, which map to governance and management objectives, so a rated enterprise goal raises the priority of the objectives that support it.

What does the design produce?
A tailored governance system: the objectives in scope, a target capability level for each, the focus areas applied, and the documented reasoning. It is the input to the seven-phase implementation lifecycle.

Do the design factors change in COBIT 7?
ISACA has announced COBIT 7 certificates replacing the 2019 certificates from 27 October 2026, with the 2019 certificates sunset on 26 April 2027, but has not yet published the framework’s content. Until it does, the eleven factors and the four-stage workflow are the current design method.

Where this leaves you

Use the COBIT design factors as the framework intends: take the strategy, goals, risks and issues from the enterprise rather than the workshop, let the mappings produce the initial scope, refine it with the seven contextual factors and the focus areas, set capability targets that vary, and write the reasoning down. A governance system with fourteen justified objectives will be run; one with forty asserted ones will be shelved.

References

• ISACA — COBIT 2019 Design Guide: Designing an Information and Technology Governance Solution — The eleven design factors, the mapping tables and the four-stage design workflow (ISACA publication page).
• ISACA — COBIT Design and Implementation certificate — The certificate covering the design workflow, and the COBIT 7 replacement notice.

More on COBIT

• COBIT design factors — you are here
• COBIT 2019: the complete guide
• COBIT 2019 implementation: the seven phases
• COBIT domains: EDM, APO, BAI, DSS and MEA
• COBIT capability levels: the 0–5 scale
• IT governance framework: the three layers

The design factor workbook with the eleven factors and their mapping to objectives, the governance system design document template, the goals cascade worksheet and the target capability register are in the COBIT 2019 IT Governance Toolkit, or start with the free templates.