Governance and risk: two sides of the same coin
Boards want to know two things about technology: is it creating value, and are the risks under control? IT governance frameworks such as COBIT and ISO/IEC 38500 answer the first question. Risk management frameworks such as ISO 31000 and M_o_R answer the second. This guide compares WiseLearner's governance and risk courses so you can choose the right one, or the right combination.
Governance and risk courses compared
| Course | Framework | Focus | Best for | Exam |
|---|---|---|---|---|
| COBIT 2019 Foundation | ISACA COBIT 2019 | Governance system design, governance and management objectives, performance management | IT auditors, CIOs, risk, compliance and security leaders | 75 questions, 120 minutes, 65% to pass |
| COBIT 5 Foundation | ISACA COBIT 5 | The earlier COBIT framework, principles and enablers | Teams still using COBIT 5 | 50 questions, 40 minutes, 50% to pass |
| ISO 38500 IT Governance Manager | ISO/IEC 38500 | Board-level governance of IT: evaluate, direct, monitor | IT governance teams, risk and project managers, senior leaders | 40 questions, 60 minutes, 65% to pass, online |
| ISO 31000 Risk Manager | ISO 31000 | Enterprise risk framework: context, identification, analysis, evaluation, treatment | Risk managers, consultants, process owners, compliance managers | 40 questions, 60 minutes, 65% to pass, online |
| M_o_R Foundation & Practitioner | AXELOS/PeopleCert M_o_R | Risk principles, approach, processes, embedding and reviewing risk management | Risk, programme and project professionals in governance roles | Foundation and Practitioner exams included |
COBIT 2019 vs COBIT 5
COBIT 2019 replaced COBIT 5 as ISACA's framework. It adds design factors and focus areas so organisations can tailor their governance system, updates the governance and management objectives, and introduces a performance management approach. New learners should choose COBIT 2019. COBIT 5 remains useful only where an organisation still runs a COBIT 5-based governance model.
COBIT 2019 vs ISO 38500
ISO/IEC 38500 is short and principle-based. It tells the board how to govern IT through the evaluate–direct–monitor model and six principles. COBIT 2019 is detailed and operational. It tells management how to build the governance system that delivers on those principles. Many organisations use ISO 38500 to frame board responsibilities and COBIT to implement them.
ISO 31000 vs M_o_R
Both are general risk management frameworks. ISO 31000 is the international standard, widely used across industries and the basis for specialist standards such as ISO/IEC 27005 (information security risk) and ISO/IEC 23894 (AI risk). M_o_R is a practical best-practice guide that is popular in the UK, Europe and public-sector organisations, and pairs well with PRINCE2 and MSP. Choose ISO 31000 for broad, international recognition; choose M_o_R if your organisation uses the PRINCE2 and MSP family.
Which course fits your role?
| Your role | Start with | Add |
|---|---|---|
| IT auditor or IS assurance | COBIT 2019 Foundation | CISA |
| CIO, IT director or board adviser | ISO 38500 IT Governance Manager | COBIT 2019 |
| Enterprise or operational risk manager | ISO 31000 Risk Manager | M_o_R |
| Information security risk manager | ISO 31000 Risk Manager | ISO 27005 Risk Manager |
| AI governance or AI risk lead | ISO 31000 Risk Manager | ISO 42001 Lead Implementer |
| Programme or portfolio manager | M_o_R | MSP |
Frequently asked questions
Is COBIT 5 still valid?
COBIT 5 certificates remain valid, but ISACA's current framework is COBIT 2019. New learners should take COBIT 2019 Foundation.
What is the COBIT 2019 Foundation exam format?
75 questions in 120 minutes, with a 65% pass mark.
What is the difference between ISO 31000 and ISO 27005?
ISO 31000 is the general risk management framework for any type of risk. ISO 27005 applies those principles specifically to information security risk within an ISO 27001 ISMS.
Is ISO 38500 certifiable for organisations?
ISO/IEC 38500 is a guidance standard, so organisations are not certified against it. Professionals can earn the ISO 38500 IT Governance Manager certification to show they can apply it.
Which risk framework is best for AI?
ISO 31000 provides the base framework, ISO/IEC 23894 applies it to AI, and ISO/IEC 42001 builds a certifiable AI management system around it. Read our ISO 42001 certification guide.
Is governance and risk training available online?
Yes. WiseLearner runs live, instructor-led online batches for all of these courses, plus corporate batches.
Strengthen governance and risk
Choose the course that fits your role, or call +91 99084 55513 for advice and the next batch dates.
