ISC2 Governance, Risk and Compliance (CGRC) Practice Question

In COBIT 2019, design factors (for example, enterprise strategy, risk profile, threat landscape, compliance requirements, and technology adoption strategy) are assessed at the outset to understand organizational context and decide which governance and management objectives matter most. Capability level scoring is part of post-implementation performance management, while focus areas offer topic-specific guidance that depends on prior design-factor analysis. The goals cascade translates stakeholder needs into goals but does not itself provide tailoring criteria. Therefore, the team should begin with the design factors.