Governance system components are the individual components that make up the governance system and include things like policies, standards, procedures, guidelines, and laws. The compliance regulations applicable to the enterprise fall under this category as they outline the rules and regulations that the enterprise must follow to ensure proper governance.

The enterprise should be prepared to deviate from previously identified priorities with justified reasons. According to the COBIT 2019 Design Guide , when finalizing a governance system design [1], it is important to consider the competing priorities and be prepared to deviate from the previously identified priorities with justified reasons. This is because the governance system design should be tailored to the specific characteristics of the enterprise, and any decisions made should be based on the best interests of the enterprise. It is also important to understand the implications of any changes in the design and to ensure any decisions made do not conflict with the enterprise's overall strategy.

When designing governance, it is important to consider the size of the enterprise, as this will allow you to target the capability levels of the governance and management objectives. The size of the enterprise will influence the scope and complexity of the governance frameworks that should be used, and the targeted capability levels of the governance and management objectives. For example, a large enterprise might require more complex and extensive governance frameworks, and the targeted capability levels of the governance and management objectives may be higher than those of a smaller enterprise. This is explained in the Official COBIT 2019 Study Manual from ISACA.

These components (of a governance system) can be either generic or "variants of generic." Generic components are described in the COBIT Core Model and apply in principle to any situation (although they "generally need customization before being practically implemented.") Whereas variants are based on the generic components but tailored for a specific purpose or context within a focus area.