COBIT 2019 Foundation common mistakes
COBIT 2019 Foundation · Understand the traps and how to avoid them.
Calling an on-time technical deployment proof of realized stakeholder value.
An isolated metric, label or approval does not establish the complete actual service, risk and authority conditions.
What to do instead
Review the actual intended business outcomes, benefit ownership and resource/risk assumptions.
Declaring management execution to be independent governance oversight.
Direction, accountability and evidence review do not disappear because the same project team reports its completion.
What to do instead
Clarify actual decision rights, outcome ownership and appropriate independent assurance.
Maximizing every capability target without reference to enterprise need.
An isolated metric, label or approval does not establish the complete actual service, risk and authority conditions.
What to do instead
Prioritize justified objectives and actual value/risk/dependency evidence.
Choosing the answer that describes the 'best practice' control rather than the answer that reflects what the business has decided it can tolerate.
Candidates transfer an audit or security-engineering mindset into CRISC, where the risk practitioner's job is to inform and enable a business decision, not to impose the safest option. Options containing words like 'eliminate', 'ensure', 'mandate', or 'all risk is avoided' feel rigorous but are usually wrong.
What to do instead
Before answering, classify the question: is it asking what the risk practitioner should DO next, or what the business should DECIDE? If the stem involves tolerance, appetite, or trade-offs, eliminate any option that removes the business's choice and prefer the option that quantifies, communicates, and escalates.
Jumping to a response (mitigate, transfer, avoid, accept) before establishing or confirming the risk context and performing the assessment.
Experienced practitioners recognise the response immediately in the scenario and answer it, skipping the earlier step the question actually asks about. CRISC questions are sequence-sensitive; the 'next' step is almost always the earliest incomplete step in the risk process.
What to do instead
Apply a fixed sequence check on every stem: identify/context, then analyse/assess, then evaluate against appetite, then respond, then monitor and report. Ask 'what has explicitly already happened in this stem?' and select the first action that comes after it.
Choosing quantitative risk analysis over qualitative without testing whether the data needed for quantification exists or whether the decision requires it.
Quantification is presented as more mature, so candidates assume it is always the better answer. In practice, forcing quantification on sparse or unreliable data produces false precision and is a poor recommendation.
What to do instead
Ask what data is available and what decision is being made. If the stem shows missing historical data, a novel risk, or a fast screening decision, select qualitative or semi-quantitative; select quantitative when reliable loss data or actuarial input exists and the decision involves material financial trade-offs.
Answering incident response questions with the containment step when the stem describes detection, triage, or evidence preservation, and skipping the ordering of the response phases.
Containment feels like the most decisive action, and candidates have not internalised that the phases are sequential and that premature containment can destroy forensic evidence.
What to do instead
Identify the action and the framework specified in the scenario. Detection, analysis, containment, evidence collection and recovery can overlap under urgency; preserve safety and authority while following the applicable playbook. Do not infer one universally correct action solely from the presence of a word such as logs.
Confusing recovery point objective with recovery time objective, and choosing a backup frequency when the stem is about acceptable downtime, or vice versa.
Both are two-letter objectives expressed in time units, and candidates memorise the acronyms without anchoring them to the business question each one answers.
What to do instead
Anchor each to a question: RPO asks 'how much data can we afford to lose?' and drives backup frequency; RTO asks 'how long may we be down?' and drives recovery capability and staffing. In any scenario, underline the phrase about lost data or about elapsed downtime before selecting an answer.