COBIT 2019 APO domain (Align, Plan, Organise)

By Sam Rivera, Founder, SentinelPanda · June 20, 2026 · 1 min read · COBIT 2019

APO is where IT gets its act together before building anything — strategy, architecture, risk, and the planning that the build-and-run domains depend on.

The planning domain

APO — Align, Plan and Organise — is the management domain concerned with how IT is planned and organised to support the enterprise. It is the largest of the four management domains, covering the strategic and organisational groundwork that the building and running of IT depends on.

What it covers

APO objectives span IT strategy and the management framework, enterprise architecture, innovation, portfolio, budget and cost, human resources, relationships, service agreements, vendors, quality, risk, security, and data. It is the planning and organising layer — deciding what IT should do and how it should be structured before execution.

Risk and security live here

Notably, the management of risk and the management of security are APO objectives — for COBIT, these are planning-and-organising concerns at the management level. This is where COBIT connects to the security frameworks an organisation runs, mapping ISO 27001 or NIST work into the governance structure.

Direction for execution

APO sets the plans and structures that BAI builds against and DSS runs within. A weak APO domain means building and running IT without a coherent plan — which is exactly the governance problem COBIT exists to address.