CGEIT Flashcards — Free ISACA Certified in the Governance of Enterprise IT (CGEIT) (CGEIT) Study Cards

Conduct a re-evaluation of the business case to determine if the expected ROI is still valid.

When a program's benefits are being realized but costs have exceeded contingency by 20%, the benefits owner must determine whether the business case still holds — i.e., whether the expected ROI remains valid given the higher costs. Re-evaluating the business case (A) is the governance action that preserves the benefits focus while addressing the cost variance. It provides the evidence needed for any subsequent decision (continue, re-scope, or terminate).

A heat map showing the impact of top risks on business value drivers.

A heat map that maps top IT risks to business value drivers gives the board a prioritized, business-aligned view of risk — exactly what governance bodies need to make informed decisions about where to invest mitigation effort. It translates technical risk into impact on revenue, reputation, compliance, and strategic objectives, which is the language of the board. Raw vulnerability lists or incident counts lack this business context and do not support strategic prioritization.

Complexity in maintaining consistent security and compliance policies across virtualized environments

Software-defined infrastructure abstracts compute, storage, and network resources from physical hardware, enabling programmatic provisioning and policy-driven management. The key governance risk is that this abstraction layer creates policy sprawl: security, compliance, and data-residency controls must be enforced consistently across dynamic, multi-tenant virtualized environments where workloads move and configurations change rapidly. Without governance guardrails, inconsistent policy enforcement becomes the dominant risk.

Customizing the governance system based on the enterprise's unique design factors.

COBIT 2019 explicitly defines a governance system as dynamic when it is tailored to the enterprise's context through design factors (enterprise goals, risk profile, threat landscape, compliance requirements, IT role, sourcing model, etc.). Customizing based on these factors is the prescribed method for achieving a fit-for-purpose, adaptable governance system. This aligns with the COBIT principle 'Tailored to Enterprise Needs' and the design-factor-driven approach in the COBIT 2019 Design Guide.

Review the benefits realization plan to assess organizational change progress.

When technical deliverables are nearly complete but benefits realization is far behind, the gap typically lies in organizational change management, adoption, or process readiness rather than technical execution. The most appropriate management action is to review the benefits realization plan to diagnose why the anticipated benefits are not materializing and to address change management, training, or process issues.

The reduction in manual labor hours per transaction.

The reduction in manual labor hours per transaction directly measures the cost savings from automation, as labor hours are a primary cost driver. This metric quantifies the efficiency gain and translates directly into financial savings. It is a tangible, outcome-oriented indicator of the benefit.

Direct the CIO to present a remediation plan with timelines and interim risk mitigation controls at the next governance meeting.

A breach of the board-approved risk appetite requires the governance committee to act immediately by holding management accountable. Directing the CIO to deliver a remediation plan with timelines and interim controls restores oversight, keeps governance in its proper strategic role, and creates a traceable mechanism for monitoring until performance realigns with the stated tolerance.

Exceptions should be approved by a designated architecture authority with defined criteria and time limits.

Exception authority should sit with a designated architecture authority operating under explicit criteria, documented rationale, and time limits, which preserves both agility and control. Self-approval by requesters, case-by-case governance committee review, and external auditor approval all misplace authority, creating conflicts, bottlenecks, or independence breaches. ISACA CGEIT guidance supports delegated decision rights bounded by criteria and escalation for material impacts.

Compare actual benefit measurements against the baseline assumptions and trace the variance to specific benefit drivers and owners.

The disciplined benefits realization response to a variance is measurement against the agreed baseline followed by root-cause tracing to drivers and owners. Only after that diagnosis can the organization decide whether to correct execution, revise assumptions, or escalate. Rebaselining, premature failure declarations, and arbitrary target increases all bypass the evidence needed for sound governance decisions.

Adopt a hybrid model that keeps stable legacy workloads on controlled infrastructure and uses elastic cloud services for variable digital channels, governed by a demand forecasting and capacity review process.

Matching infrastructure commitment to workload demand profiles, with stable systems on controlled platforms and variable channels on elastic services, optimizes resource use under uncertainty. Adding demand forecasting and recurring capacity review turns the decision into a governed, revisable process rather than a one-time bet, which is what the board needs before a lease expiry.

Evaluation, direction, and monitoring of enterprise activities.

In COBIT 2019, governance is defined as the set of activities that ensure enterprise objectives are achieved by evaluating stakeholder needs, setting direction through prioritization and decision-making, and monitoring performance and compliance. This is captured in the governance framework's core model of Evaluate, Direct, and Monitor (EDM), which sits above the management objectives. Therefore, 'evaluation, direction, and monitoring of enterprise activities' is the precise COBIT definition.

Risk acceptance with documented compensating controls, executive approval, and a scheduled replacement roadmap.

Because the legacy system is essential and cannot be patched, avoidance and mitigation are infeasible, and transfer alone leaves operational and regulatory exposure unmanaged. Deliberate acceptance with compensating controls, executive approval, and a replacement roadmap keeps the residual risk visible, governed, and bounded while the business continues to meet its regulatory obligations.

Standardizing hardware and software platforms across the enterprise

Standardizing hardware and software platforms across the enterprise reduces operational cost by shrinking the variety of systems that must be patched, licensed, supported, and staffed. Fewer platforms mean lower licensing complexity, simplified training, consolidated support contracts, and reduced integration overhead. This is a foundational IT governance cost-optimization practice rooted in portfolio and architecture management.

Tailor the governance system by adjusting design factors.

COBIT 2019 explicitly supports tailoring the governance system by adjusting design factors — enterprise size, goals, risk profile, and culture — so the framework fits the organization rather than forcing the organization to fit the framework. For a small, agile firm, tailoring means scaling down process rigor, reducing documentation, and focusing on the governance objectives that matter most. This is the most appropriate action because it preserves governance intent while removing unnecessary burden.

Integrating Value Stream Key Performance Indicators (KPIs) into the portfolio governance cycle.

Value Stream-aligned funding requires governance mechanisms that measure and steer investment by the value delivered through each stream, so embedding Value Stream KPIs into the portfolio governance cycle creates the feedback loop that keeps funding tethered to realized enterprise value. This connects funding decisions to outcome metrics rather than project completion milestones. It is the only option that directly measures value realization and feeds it back into governance.

IT Strategic Plan

The IT Strategic Plan is the governing document that translates enterprise strategy into IT direction, including how IT resources (budget, people, technology) will be prioritized and allocated over the planning horizon. It provides the framework — principles, investment priorities, and capability roadmap — within which budgets and SLAs operate. The other documents are downstream artifacts that execute or constrain specific aspects of that framework.

To balance the investment mix between innovation, growth, and maintenance.

IT portfolio management categorizes investments so leadership can see the aggregate mix and deliberately balance spending across innovation (transformational), growth (evolutionary), and maintenance (operational) categories. This balance ensures the organization is not over-investing in keeping the lights on while starving future capability, and it aligns IT spend with strategic risk appetite. The primary benefit is therefore portfolio balance, not scheduling, vendor uniformity, or cost cutting.

Direct the CIO to develop a revised IT investment portfolio that gradually shifts resources towards strategic initiatives while maintaining essential operations.

The IT steering committee should direct the CIO to create a revised investment portfolio that gradually shifts resources toward strategic initiatives. This balances the need for digital transformation with the necessity of maintaining critical operations, ensuring governance oversight and strategic alignment without introducing undue operational risk.

Formally communicate the risk to the board and propose a risk treatment plan

When a major IT risk exceeds the enterprise's risk appetite, the governance body must escalate it formally to the board and propose a risk treatment plan (mitigate, transfer, avoid, or accept with justification). This fulfills the governance body's oversight duty and ensures informed decision-making at the highest level. Simply ignoring or redefining risk appetite to fit the situation undermines the integrity of the risk management framework.

Embedding IT governance roles and responsibilities into existing business management functions

Embedding IT governance roles and responsibilities into existing business management functions ensures governance is not a parallel silo but part of how the business already makes decisions. This approach leverages existing decision-making forums, reporting lines, and accountability structures, which is the most effective way to integrate IT governance into business processes per COBIT and ISO/IEC 38500.

To align IT strategy with business strategy and deliver value

The primary role of an IT governance framework is to align IT strategy with business strategy and ensure IT delivers value while managing risk and optimizing resources. This alignment is the core purpose defined by ISO/IEC 38500 and COBIT, ensuring IT investments support business objectives rather than operating as a separate technical function.

Escalate the appetite gap to the board risk committee with options to remediate the recovery capability or formally revise the appetite.

The board-approved appetite defines acceptable exposure, and the six-hour recovery objective exceeds the two-hour tolerance. The practitioner's first duty is to surface that gap to the board risk committee with remediation options and the alternative of formally revising the appetite. This preserves board ownership, enables an informed decision, and prevents either silent acceptance or unilateral spending.