The COBIT® 2019 Design Guide defines Step 2: Determine the Initial Scope of the Governance System, which explicitly includes considering the risk profile of the enterprise as a formal design factor. The enterprise risk profile identifies the types of IT-related risks that are most significant and therefore influence which governance and management objectives should be prioritized.

Enterprise culture and market position are contextual elements but are not listed as formal design factors in the initial scoping workflow. Similarly, the risk profile of the IT portfolio is a narrower operational view, whereas COBIT requires an enterprise-wide perspective to ensure governance decisions reflect overall business exposure.

By analyzing the enterprise risk profile early, governance designers can identify critical areas requiring stronger controls, assurance, or capability levels. This directly impacts the initial scope by determining which objectives fall inside or outside the governance system boundary.

Therefore, considering the enterprise risk profile is a core workflow component for determining the initial governance scope.