A financial services firm has a mature IT governance framework, but recent audits revealed that IT risk decisions are often made without considering the enterprise's overall risk appetite. The board wants to ensure that IT risk management is fully integrated with enterprise risk management (ERM). Which of the following actions should the CIO take FIRST to address this gap?
The enterprise is reviewing its IT governance structure. Which THREE of the following are primary responsibilities of the Board of Directors regarding IT governance?
A newly appointed CIO is integrating COBIT 2019 into the existing governance framework. Which action best ensures that the governance system is dynamic?
A multinational corporation is struggling with IT strategic alignment. The board wants to ensure IT investments directly correlate to business value. Which metric should the governance committee prioritize?
The IT steering committee is evaluating a high-cost digital transformation project. What should the committee prioritize to ensure strategic alignment?
A newly appointed CIO is establishing an IT governance framework. Which approach best ensures that IT governance is integrated into the enterprise's existing management structure?
A large multinational corporation is transitioning to COBIT 2019. The governance board needs to prioritize governance objectives. Which action should the IT governance lead take first?
A firm is experiencing 'governance drift' where IT initiatives are no longer aligned with corporate strategy. Which action should the governance committee take first?
An organization is evaluating its governance structure against the COBIT 2019 framework. Where should the authority for IT governance decisions reside?
A firm identifies that its IT governance framework is too burdensome for its agile, small-team structure. What is the most appropriate governance action?
A conflict arises between the IT department's desire for innovation and the business unit's desire for operational stability. What is the role of governance?
An organization's governance committee decides to stop funding a legacy IT system that is still critical for a specific department. What should be done?
During a strategic alignment review, the governance committee identifies that IT investments are not delivering expected value. What is the most effective first step for the committee?
A newly appointed CIO is establishing an IT governance framework. Which approach best ensures that IT governance activities are integrated into existing business decision-making processes?
An enterprise is transitioning to a hybrid cloud environment. Which governance mechanism is most critical to ensure compliance with data sovereignty regulations?
A company is experiencing friction between IT and business units regarding project priorities. What governance structure should be strengthened to resolve this?
An organization has decentralized its IT operations, leading to fragmented governance. Which action will best restore governance oversight while retaining operational agility?
A global retailer's board has approved a three-year strategy to shift 40% of revenue to an AI-driven subscription model. The CIO reports that business units are independently procuring SaaS analytics tools, creating overlapping data pipelines and inconsistent customer records. The board asks the governance council to ensure technology decisions remain aligned with the strategic intent without halting business agility. Which action should the governance council take FIRST?
A multinational retailer's board has approved an enterprisewide risk appetite statement. The CIO now needs to ensure that the IT risk management process is aligned with this appetite. Which action should the CIO take FIRST?
A healthcare organization is establishing an IT governance framework to improve alignment between IT and business strategy. The governance body must define key roles and responsibilities. Which TWO of the following are essential governance mechanisms to ensure effective IT decision-making? (Choose two.)
A retail company's IT governance committee is reviewing the performance of its IT investments. The committee wants to ensure that IT is delivering value in line with business expectations. Which of the following is the MOST effective way to demonstrate IT value delivery?
A global retailer's board has approved an enterprise strategy that includes expanding into three new markets over 18 months. The CIO must ensure the IT governance framework is structured so that IT investment decisions, risk tolerances, and performance reporting align directly with this expansion. Which action should the CIO take FIRST to establish this alignment?
A global manufacturing firm's IT governance board is evaluating the performance of its IT governance framework. The board wants to ensure that the framework remains effective as the business environment changes. Which of the following should be the board's PRIMARY consideration?
A financial services firm's board has delegated IT oversight to a technology committee. The committee learns that a critical core-banking platform upgrade is six months behind and that the CIO has been authorizing change requests outside the approved investment threshold without escalation. The committee wants to correct the governance failure while preserving the CIO's operational authority. Which action should the committee take?
A multinational bank's board has approved an enterprise risk appetite that explicitly prohibits any single IT system outage exceeding four hours. The CIO reports that the core banking platform has experienced three outages of six hours each in the past quarter. Which action should the IT governance committee take FIRST?
A healthcare insurer is revising its IT governance framework after a series of regulatory findings. The board wants assurance that IT governance will provide effective oversight of compliance, risk, and resource optimization across clinical and claims systems. Which TWO governance mechanisms should the CIO implement to provide this assurance? (Choose two.)
A global retailer operates in 14 countries, each with its own IT steering committee making independent technology investment decisions. The board has noticed duplicated spending, inconsistent security standards, and no consolidated view of IT risk. Which governance mechanism should the enterprise establish to address these issues while preserving regional responsiveness?
A multinational retailer's board has approved an enterprise risk appetite statement that explicitly limits financial exposure from any single IT outage to $2 million. The CIO reports that a core payment system runs on unsupported infrastructure with an estimated single-event loss of $8 million. The board asks the IT governance committee to respond. Which action BEST aligns with ISACA CGEIT governance principles?
A manufacturing company's IT governance policy states that the CIO reports to the CEO and that the board's audit committee reviews IT risk. During a governance review, it is found that the audit committee has not received an IT risk report in over a year and that the CIO has been reporting IT risk only to the CEO. What is the MOST likely consequence of this governance gap?
An insurance company's IT governance committee is reviewing a proposal to migrate all customer policy data to a public cloud provider. The Chief Risk Officer notes that the provider cannot contractually guarantee data residency in the company's home jurisdiction. Which governance consideration should weigh MOST heavily in the committee's decision?
A global insurance firm is designing its enterprise IT governance operating model. The board wants clarity on which decision rights must remain at the governance level versus being delegated to IT management. Which TWO decision areas should REMAIN with the governance body rather than be delegated? (Choose two.)
A multinational energy company operates in jurisdictions with conflicting data protection requirements. The CIO proposes a single global data governance standard to simplify compliance. The board's risk committee is concerned that a single standard could create regulatory exposure in some jurisdictions. Which action should the CIO take to balance governance consistency with local compliance?
A retail enterprise has grown through acquisitions, resulting in three separate IT organizations, each with its own project intake process, architecture review board, and budget approval cycle. The board has mandated a single, unified governance model across the group. As the newly appointed enterprise IT governance lead, which action should you take FIRST to establish effective governance across the merged IT function?
A hospital group's IT governance committee wants to ensure that clinical staff have a formal voice in prioritizing electronic health record (EHR) enhancements. Which governance structure is MOST appropriate?
A hospital network's IT governance committee is establishing its oversight structure. The committee needs a mechanism that provides independent, objective assurance to the board on whether IT controls are designed and operating effectively. Which mechanism should the committee establish?
An enterprise's IT steering committee has approved a portfolio of digital initiatives, but six months later, value delivery is unclear and business sponsors report that IT priorities do not reflect strategic objectives. A review finds that initiatives were approved based on technical feasibility rather than business case alignment. Which governance action should the committee take to correct this?
An energy utility's board is reviewing whether its IT governance framework remains effective after a major merger doubled the size of the organization. Which TWO actions should the governance committee take to reassess the framework's effectiveness? (Choose two.)
An enterprise is revising its IT governance framework and wants to strengthen how it assigns and enforces accountability for IT-related decisions. Executive leadership has asked the governance team to recommend mechanisms that make accountability explicit and enforceable across business and IT. Which TWO of the following should the governance team recommend? (Choose two.)
A financial services firm's IT governance committee is reviewing its performance measurement approach. Executives report that current IT metrics focus on uptime and help-desk volumes, and the board cannot tell whether IT is delivering strategic value. The committee wants metrics that demonstrate IT's contribution to enterprise objectives. Which approach should the committee adopt?
A government agency's IT governance committee is finalizing its governance framework. A dispute arises over who should approve exceptions to the enterprise architecture standards when a business unit needs a rapid technology deployment. Which principle should guide the committee's decision on where to place exception approval authority?
A mid-sized insurance company has no formal IT governance structure. The board wants assurance that IT is delivering value and managing risk appropriately. The CIO proposes creating a governance framework based on a recognized standard. Which action should be taken FIRST when establishing this framework?
An enterprise's IT governance committee meets quarterly and reviews a dashboard of operational metrics such as server uptime, ticket volumes, and patch compliance. The board has expressed concern that governance is not providing strategic oversight of IT. Which change to the committee's agenda would BEST address the board's concern?
An enterprise's board has tasked the CIO with implementing a governance framework that ensures IT investments deliver value while balancing risk and resource optimization. The CIO decides to use COBIT 2019 as the guiding framework. The board now asks how to measure whether the governance system is effective. Which of the following is the MOST appropriate way to measure governance effectiveness?
An enterprise is updating its IT governance framework to better support digital transformation. The CIO wants to ensure that the framework enables effective decision-making across the enterprise. Which TWO of the following are key components of an IT governance framework that enable effective decision-making? (Choose two.)
An enterprise's IT governance committee has approved a new cloud-first strategy, but six months later a post-implementation review finds that several business units procured on-premises infrastructure outside the approved strategy. The committee wants to prevent recurrence while keeping the strategy intact. Which action BEST addresses the governance gap?
A financial services enterprise is designing its IT governance system using COBIT 2019. The board wants assurance that IT-related risk is managed within the enterprise risk appetite, but the CIO is concerned that overly rigid controls will slow digital product launches. Which design factor consideration BEST balances these competing objectives?
An enterprise is establishing a benefits realization process for a portfolio of IT-enabled investments. The governance committee wants to ensure that benefits are tracked and that underperforming investments are addressed. Which TWO practices are MOST essential to embed in the benefits realization process? (Choose two.)
An enterprise's IT governance framework defines decision rights for IT investment, but a recent review shows that business unit leaders routinely make technology commitments that bypass the defined approval authority. Which governance component is MOST directly deficient?
A global manufacturer operates in multiple jurisdictions with differing data protection requirements. The IT governance committee must decide how to structure oversight so that local compliance is maintained while enterprise-wide IT risk is managed consistently. Which approach BEST achieves this?