CGEIT Governance OF Enterprise IT Practice Test 7 — 15 Questions

Question 1

A global retailer operates in 14 countries, each with its own IT steering committee making independent technology investment decisions. The board has noticed duplicated spending, inconsistent security standards, and no consolidated view of IT risk. Which governance mechanism should the enterprise establish to address these issues while preserving regional responsiveness?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A federated IT governance model with an enterprise-level governance council that sets mandatory principles, standards, and decision rights, while regional committees retain authority within those boundaries.. A federated governance model is the right fit because it establishes enterprise-level principles, standards, and decision rights while allowing regional committees to operate within those boundaries. This resolves duplicated investment, inconsistent security, and fragmented risk reporting without discarding the local responsiveness that a 14-country retailer requires to remain competitive and compliant.

Answer

Outsourcing IT governance to a third-party consultancy that will define standards for all regions.

Answer

A decentralized model that strengthens each regional committee's autonomy and adds a quarterly reporting requirement to the board.

Answer

A centralized IT governance model in which all technology investment decisions are made by a single corporate committee.

Question 2

A multinational retailer's board has approved an enterprise risk appetite statement that explicitly limits financial exposure from any single IT outage to $2 million. The CIO reports that a core payment system runs on unsupported infrastructure with an estimated single-event loss of $8 million. The board asks the IT governance committee to respond. Which action BEST aligns with ISACA CGEIT governance principles?

Accepted Answer

Escalate the gap to the board with options to remediate, transfer, or formally approve a time-bound exception.. Governance bodies own risk appetite, so when an identified exposure exceeds the approved threshold, the committee must escalate to that owner with viable response options rather than accept, defer, or redefine the limit. Escalation preserves accountability, ensures the decision sits with the authority that set the tolerance, and produces a documented, time-bound resolution aligned with ISACA CGEIT governance expectations.

Answer

Ask the CIO to revise the risk appetite statement so the payment system falls within tolerance.

Answer

Direct management to accept the risk because the system has operated without failure for five years.

Answer

Instruct internal audit to add the payment system to next year's audit plan and wait for findings.

Question 3

A manufacturing company's IT governance policy states that the CIO reports to the CEO and that the board's audit committee reviews IT risk. During a governance review, it is found that the audit committee has not received an IT risk report in over a year and that the CIO has been reporting IT risk only to the CEO. What is the MOST likely consequence of this governance gap?

Accepted Answer

The board lacks visibility into IT risk, so its ability to challenge management's risk decisions and fulfill its oversight duty is weakened.. The governance policy assigns IT risk review to the audit committee, so the absence of reporting means the board cannot perform its oversight role or challenge management's risk decisions. The CEO's awareness does not replace board oversight, and accountability remains with the board. Reporting-line changes or restructuring do not follow from a missing report.

Answer

The CIO's reporting line becomes invalid, requiring an immediate restructure of the IT organization.

Answer

IT risk becomes the sole responsibility of the CEO, which automatically transfers accountability away from the board.

Answer

IT risk is effectively mitigated because the CEO has direct line of sight to the CIO and can act without board involvement.

Question 4

An insurance company's IT governance committee is reviewing a proposal to migrate all customer policy data to a public cloud provider. The Chief Risk Officer notes that the provider cannot contractually guarantee data residency in the company's home jurisdiction. Which governance consideration should weigh MOST heavily in the committee's decision?

Accepted Answer

Whether the migration aligns with the enterprise's regulatory compliance obligations and risk appetite for data residency.. Regulatory compliance and alignment with the board-approved risk appetite are threshold governance criteria. If the cloud provider cannot guarantee data residency, the migration cannot be approved as proposed, because cost, skills, and peer trends are secondary to the legal and risk obligations that govern an insurer's handling of customer policy data.

Answer

Whether the IT team has the technical skills to manage the cloud environment.

Answer

Whether competitors in the insurance sector have already adopted public cloud platforms.

Answer

Whether the cloud provider offers a lower total cost of ownership than the current data center.

Question 5

A global insurance firm is designing its enterprise IT governance operating model. The board wants clarity on which decision rights must remain at the governance level versus being delegated to IT management. Which TWO decision areas should REMAIN with the governance body rather than be delegated? (Choose two.)

Accepted Answer

Approval of the enterprise IT risk appetite and tolerance thresholds.. Governance retains decision rights over matters that set boundaries and allocate enterprise value, specifically risk appetite and strategic investment priorities. Operational choices such as hardware models, firewall rules, and ticket routing belong to management executing within governance-set constraints. This separation ensures the governing body focuses on direction and oversight while management handles execution, aligning with ISACA CGEIT's governance-versus-management distinction.

Answer

Configuration of firewall rule sets for the perimeter security platform.

Answer

Selection of specific server hardware models for the data center refresh.

Answer

Assignment of daily incident response tickets to on-call engineers.

Question 6

A multinational energy company operates in jurisdictions with conflicting data protection requirements. The CIO proposes a single global data governance standard to simplify compliance. The board's risk committee is concerned that a single standard could create regulatory exposure in some jurisdictions. Which action should the CIO take to balance governance consistency with local compliance?

Accepted Answer

Develop a global data governance framework with mandatory enterprise principles and a documented process for assessing and accommodating local regulatory requirements.. The balanced approach is a global framework with mandatory enterprise principles plus a defined process for assessing and accommodating local regulatory requirements. This maintains consistency and board oversight while managing jurisdictional compliance risk. Waiting for objections, full decentralization, or delegating to local counsel each sacrifices either consistency or proactive risk management.

Answer

Delegate data governance decisions to local legal counsel and require them to report only material breaches to the board.

Answer

Adopt the single global standard and require all jurisdictions to comply, documenting exceptions only where regulators formally object.

Answer

Abandon the global standard and allow each jurisdiction to define its own data governance requirements independently.

Question 7

A retail enterprise has grown through acquisitions, resulting in three separate IT organizations, each with its own project intake process, architecture review board, and budget approval cycle. The board has mandated a single, unified governance model across the group. As the newly appointed enterprise IT governance lead, which action should you take FIRST to establish effective governance across the merged IT function?

Accepted Answer

Establish a governing body with defined decision rights, mandates, and a common set of governance processes and metrics.. Fragmented governance from acquisitions is resolved by establishing clear decision rights, mandates, and shared processes through a governing body. That structure creates the authority and accountability needed to harmonize budgets, methodologies, and oversight. The other actions are downstream or supporting activities that depend on a governance foundation being in place first. Without agreed decision rights, technical and financial consolidation efforts lack legitimacy and enforcement.

Answer

Mandate that all three IT organizations immediately adopt the same project management methodology and tooling.

Answer

Commission an external maturity assessment of all three IT organizations against a recognized framework.

Answer

Consolidate all three IT budgets into a single central budget controlled by the enterprise CIO.

Question 8

A hospital group's IT governance committee wants to ensure that clinical staff have a formal voice in prioritizing electronic health record (EHR) enhancements. Which governance structure is MOST appropriate?

Accepted Answer

Establish a clinical informatics advisory council that includes physicians, nurses, and IT representatives to review and prioritize EHR change requests.. A clinical informatics advisory council provides the formal, cross-functional structure needed to incorporate clinical perspectives into EHR prioritization. It connects clinicians and IT in a documented review process, giving the governance committee reliable input on patient-care value while preserving clear accountability for final decisions at the governance level.

Answer

Create an anonymous suggestion box for clinical staff and have the IT help desk triage submissions.

Answer

Allow the IT department to prioritize EHR enhancements based on technical effort and system stability.

Answer

Delegate all EHR prioritization to the hospital's finance committee to ensure budget alignment.

Question 9

A hospital network's IT governance committee is establishing its oversight structure. The committee needs a mechanism that provides independent, objective assurance to the board on whether IT controls are designed and operating effectively. Which mechanism should the committee establish?

Accepted Answer

An internal audit function with a reporting line to the board or audit committee.. Independent assurance over IT control design and operating effectiveness is delivered by internal audit when it reports to the board or audit committee, free from management influence. Steering committees, operations reviews, and vendor scorecards all serve valid purposes but are management-aligned activities that cannot objectively attest to controls. ISACA CGEIT emphasizes this separation as fundamental to effective governance oversight.

Answer

A weekly operations review meeting with IT managers to track incident metrics.

Answer

An IT steering committee chaired by the CIO to prioritize project requests.

Answer

A vendor scorecard process that rates third-party service providers quarterly.

Question 10

An enterprise's IT steering committee has approved a portfolio of digital initiatives, but six months later, value delivery is unclear and business sponsors report that IT priorities do not reflect strategic objectives. A review finds that initiatives were approved based on technical feasibility rather than business case alignment. Which governance action should the committee take to correct this?

Accepted Answer

Institute a formal investment decision process that requires business case justification and explicit linkage to strategic objectives before approval.. The steering committee's failure was approving initiatives on technical feasibility rather than strategic value. Correcting this requires a formal investment process that mandates business case justification and traceable linkage to enterprise objectives. Such a process ensures decisions are grounded in value and alignment, which is the core governance purpose of IT investment oversight. Monitoring and delegation changes do not address the flawed selection criteria that produced the misalignment.

Answer

Delegate initiative prioritization to the enterprise architecture team, since they understand technical dependencies.

Answer

Increase the frequency of status reporting from project managers to the steering committee.

Answer

Require all new initiatives to be approved exclusively by the CIO to speed up decision-making.

Question 11

An energy utility's board is reviewing whether its IT governance framework remains effective after a major merger doubled the size of the organization. Which TWO actions should the governance committee take to reassess the framework's effectiveness? (Choose two.)

Accepted Answer

Re-evaluate whether the existing decision rights, committee structures, and escalation paths still match the merged organization's size and complexity.. A merger materially changes scale, strategy, and regulatory exposure, so effectiveness must be reassessed in two directions: whether the governance design still fits the new organizational structure, and whether it still aligns with updated strategic objectives and compliance obligations. Together, these checks confirm the framework remains relevant and workable rather than merely existing on paper.

Answer

Suspend governance activities until the post-merger integration is fully complete to avoid conflicting decisions.

Answer

Delegate all governance reassessment to the external auditor and implement its recommendations without internal review.

Answer

Replace the entire governance framework with a generic industry-standard template to simplify the transition.

Question 12

An enterprise is revising its IT governance framework and wants to strengthen how it assigns and enforces accountability for IT-related decisions. Executive leadership has asked the governance team to recommend mechanisms that make accountability explicit and enforceable across business and IT. Which TWO of the following should the governance team recommend? (Choose two.)

Accepted Answer

Documented decision rights that specify who is accountable for each category of IT decision.. Accountability becomes explicit and enforceable when decision rights are documented and accountable roles are tied to governance outcomes through performance objectives and reporting. The first establishes who owns what; the second ensures ownership carries consequences and visibility. Together they form the accountability backbone of an IT governance framework. Tooling, training, and budget changes may support operations but do not by themselves define or enforce decision accountability.

Answer

Adoption of a single project management tool across all IT delivery teams.

Answer

A requirement that all IT staff complete annual security awareness training.

Answer

Increasing the IT operations budget to reduce the likelihood of service outages.

Question 13

A financial services firm's IT governance committee is reviewing its performance measurement approach. Executives report that current IT metrics focus on uptime and help-desk volumes, and the board cannot tell whether IT is delivering strategic value. The committee wants metrics that demonstrate IT's contribution to enterprise objectives. Which approach should the committee adopt?

Accepted Answer

Implement a balanced scorecard linking IT objectives to enterprise goals with outcome-based measures.. Demonstrating IT's strategic contribution requires metrics that trace from IT objectives to enterprise goals, which a balanced scorecard with outcome-based measures provides. Operational metrics such as uptime, resolution times, and composite health indices describe activity and efficiency but cannot show value delivery. ISACA CGEIT stresses aligning IT performance measurement with enterprise strategy so governing bodies can assess whether IT is creating intended value.

Answer

Benchmark help-desk resolution times against industry averages and report the variance.

Answer

Adopt a single composite IT health index that aggregates all operational metrics into one score.

Answer

Increase the frequency of uptime reporting from monthly to weekly to improve visibility.

Question 14

A government agency's IT governance committee is finalizing its governance framework. A dispute arises over who should approve exceptions to the enterprise architecture standards when a business unit needs a rapid technology deployment. Which principle should guide the committee's decision on where to place exception approval authority?

Accepted Answer

Exceptions should be approved by a designated architecture authority with defined criteria and time limits.. Exception authority should sit with a designated architecture authority operating under explicit criteria, documented rationale, and time limits, which preserves both agility and control. Self-approval by requesters, case-by-case governance committee review, and external auditor approval all misplace authority, creating conflicts, bottlenecks, or independence breaches. ISACA CGEIT guidance supports delegated decision rights bounded by criteria and escalation for material impacts.

Answer

Exceptions should be approved by the external auditor to provide independent validation of each case.

Answer

Exceptions should be approved by the requesting business unit's project manager to preserve agility.

Answer

Exceptions should be approved by the IT governance committee for every deployment to ensure consistency.

Question 15

A mid-sized insurance company has no formal IT governance structure. The board wants assurance that IT is delivering value and managing risk appropriately. The CIO proposes creating a governance framework based on a recognized standard. Which action should be taken FIRST when establishing this framework?

Accepted Answer

Define governance objectives and scope in alignment with enterprise goals and stakeholder needs.. The first step in establishing any governance framework is to define its objectives and scope in alignment with enterprise goals and stakeholder needs. This establishes purpose and boundaries that guide every subsequent design choice, including structures, roles, processes, and tooling. Benchmarking, tool deployment, and role assignment are valuable but depend on knowing what governance must achieve and cover. Starting with them risks a framework that is technically complete yet strategically irrelevant.

Answer

Benchmark the company's IT maturity against industry peers to identify gaps.

Answer

Purchase and deploy a governance, risk, and compliance tool to automate oversight.

Answer

Appoint a chief risk officer to own all IT governance responsibilities.