When the board of directors requests a report on the current IT risk posture, which metric is most effective for demonstrating alignment between risk appetite and investment?
An enterprise is evaluating the trade-off between the cost of risk mitigation and the potential business benefit. Which framework or approach should the practitioner use?
An IT project is identified as having a high inherent risk that exceeds the board-approved appetite. The project is critical for competitive advantage. Which approach is most appropriate?
An organization is transitioning to a cloud-based infrastructure. Which governance mechanism is most effective for ensuring that the cloud service provider's risk management practices remain aligned with the enterprise's risk appetite?
During an IT governance board meeting, the CGEIT practitioner notices that the current risk profile deviates significantly from the approved risk appetite. What is the most appropriate next step?
An enterprise is aligning its IT risk appetite with corporate strategic objectives. Which action should the CGEIT-certified practitioner prioritize first?
An organization's risk appetite has been set as 'low' for data breaches. A new project introduces a moderate risk of a breach. What is the most appropriate governance action?
An enterprise is facing a high-impact risk that cannot be fully mitigated. The board decides to transfer this risk. Which of the following is the best implementation of risk transfer?
An organization is integrating IT risk management into its enterprise governance framework. Which approach best ensures that IT risk is treated as a component of enterprise risk?
An organization experiences a high frequency of minor IT incidents. What is the most effective governance action to ensure this does not result in a significant enterprise risk?
Your organization is undergoing a major digital transformation. To ensure risk is optimized throughout the lifecycle, what is the most critical governance activity during the planning phase?
The board of directors is concerned about the impact of recent cybersecurity threats on the company's reputation. Which TWO of the following actions should the Governance committee prioritize to address these concerns?
You are evaluating the maturity of your organization's risk reporting to the board. Which THREE of the following elements are essential for high-maturity reporting?
A global logistics enterprise has approved a risk appetite stating that no single operational disruption may exceed a four-hour recovery time objective for its customs-clearance platform. The CIO proposes migrating that platform to a hyperscale cloud provider under a shared-responsibility model. Which governance action BEST ensures the residual risk remains within the board-approved appetite?
You are the CGEIT practitioner for a global logistics enterprise. During an IT governance committee meeting, the CIO presents a proposal to increase the IT risk appetite for cloud migration to accelerate time-to-market. The CFO objects, noting that the board has not approved a revised risk appetite statement. According to CGEIT governance principles, what should be the immediate next step?
A multinational bank is integrating its IT risk management with enterprise risk management (ERM). The CGEIT practitioner is asked to evaluate the effectiveness of this integration. Which of the following indicators best demonstrates successful integration?
A healthcare provider is developing a risk response plan for a critical patient records system. The CGEIT practitioner must ensure that the plan aligns with the enterprise's risk appetite. Which of the following actions is most appropriate?
The board of a multinational bank has approved a risk appetite statement that explicitly prohibits any single operational risk event exceeding $5 million. The CIO proposes migrating the core banking platform to a public cloud provider, which would introduce a concentration risk that could potentially cause a $12 million outage. The CIO argues that the cloud provider's certifications and service-level agreements mitigate the risk. As the CGEIT practitioner, what should you recommend?
A global retailer's board has approved a risk appetite statement that permits a maximum acceptable annual loss from e-commerce fraud of $2 million. Six months into the fiscal year, the CISO reports cumulative fraud losses of $1.9 million, and the fraud team projects an additional $600,000 in losses before year-end if no action is taken. The CISO proposes deploying an AI-based fraud detection tool costing $400,000 annually. What should the CGEIT practitioner recommend FIRST?
A global retailer is implementing a new enterprise resource planning (ERP) system. The CGEIT practitioner is tasked with ensuring that risk optimization is embedded throughout the project lifecycle. Which TWO of the following actions are most critical to achieve this? (Choose two.)
A retail company's IT risk register shows that a legacy point-of-sale system has a high likelihood of failure due to unsupported hardware. The CIO wants to replace it, but the CFO argues that the system still works and replacement is too expensive. The CEO asks the CGEIT practitioner to facilitate a decision. Which of the following should be the primary basis for the decision?
A global insurer is expanding its use of cloud-hosted underwriting platforms. The CIO proposes a single enterprise risk register entry for 'cloud provider outage,' with quarterly review by the IT steering committee. The board risk committee has asked the CGEIT practitioner to strengthen the integration of IT risk with enterprise risk management. Which TWO actions best align the IT risk taxonomy and reporting with the enterprise risk framework? (Choose two.)
A financial services firm is implementing an enterprise risk management (ERM) framework. The CGEIT practitioner is asked to ensure that IT risk is integrated with overall ERM. Which of the following is the MOST important action to achieve this integration?
A global retailer's board has approved a risk appetite statement specifying that the enterprise will accept no more than a 5% annual loss of availability for its e-commerce platform. The CIO proposes moving the platform to a public cloud provider whose standard SLA guarantees 99.5% uptime. Which action should the CGEIT practitioner recommend FIRST?
A global manufacturing firm has a decentralized IT governance model. Each region manages its own IT risk register and reports quarterly to the corporate risk committee. The CGEIT practitioner discovers that one region has been classifying a critical supplier outage as 'low risk' because it has a local backup supplier. However, the corporate risk appetite states that any single supplier failure affecting more than 10% of global production is unacceptable. What is the MOST effective action for the CGEIT practitioner to take?
A financial services firm has a low risk appetite for data breaches. The CGEIT practitioner is reviewing the IT risk register and notices that a critical vulnerability in the customer database has a high likelihood of exploitation and a high impact. The current risk response is 'accept' with no further action. What should the CGEIT practitioner recommend?
A retail bank's board has approved a risk appetite stating that no single technology failure may cause more than two hours of customer-facing outage. The CIO reports that the core banking platform depends on a single data center with a tested recovery time objective of six hours. Which action should the CGEIT practitioner recommend FIRST?
A multinational corporation is expanding into a new market with significant regulatory uncertainty. The CGEIT practitioner is tasked with ensuring that the risk management process remains effective despite rapidly changing regulations. Which of the following approaches is MOST appropriate?
A financial services firm is integrating its IT risk register with its enterprise risk management (ERM) framework. The CGEIT practitioner is asked to ensure that IT risk reporting to the board is both actionable and aligned with strategic objectives. Which TWO of the following practices are MOST critical to achieve this integration? (Choose two.)
An insurance company is developing a new mobile app that will allow customers to file claims and upload sensitive documents. The CGEIT practitioner is asked to ensure that risk is optimized during the development lifecycle. Which of the following should be the PRIMARY consideration when integrating risk management into the project?
A pharmaceutical company relies on a legacy laboratory information management system that cannot be patched and is essential for regulatory submissions. The CGEIT practitioner is updating the risk register and must select the most appropriate risk response for the confirmed inability to remediate. Which response should be documented?
A hospital's board has established a risk appetite that prioritizes patient safety over cost efficiency. The CGEIT practitioner is reviewing IT investment proposals and must ensure they align with this risk appetite. Which TWO of the following actions best demonstrate alignment with the board's risk appetite? (Choose two.)
A financial services firm is reviewing its IT risk management framework. The CGEIT practitioner has been asked to identify the factors that should be considered when determining the appropriate risk response for a critical IT system failure. Which TWO of the following factors are MOST important for this determination? (Choose two.)
A healthcare provider experiences a ransomware attack that encrypts patient records. The incident response team has contained the malware and restored systems from backups. According to IT governance principles, which action should the CGEIT practitioner ensure is performed NEXT?
A telecommunications provider has completed a risk assessment for a new 5G network slicing service. The CGEIT practitioner must ensure the results are used to optimize risk. Which action best demonstrates that risk assessment outputs are driving resource allocation decisions?
A multinational bank's board has set a low risk appetite for regulatory compliance failures. The CGEIT practitioner discovers that a critical IT system supporting anti-money laundering (AML) reporting is running on an unsupported operating system. The IT director argues that upgrading is too costly and proposes compensating controls. Which action should the practitioner recommend to the board?
A telecommunications company has a risk appetite that allows for moderate risk-taking to achieve innovation goals. The CGEIT practitioner is reviewing a proposal to adopt a new, unproven 5G technology for a critical network segment. The technology promises significant competitive advantage but has known stability issues. What is the MOST appropriate recommendation?
A hospital group's board has set a low tolerance for clinical system availability risk. The IT director proposes a multi-year program to reduce downtime, but the CFO wants to defer funding to next year's budget cycle. Which governance principle should the CGEIT practitioner cite to support immediate funding consideration?
An e-commerce company's risk register shows that a third-party payment gateway poses a high risk of data breach. The CGEIT practitioner is asked to recommend a risk response that aligns with the enterprise's risk appetite. The board has stated that it will not accept any risk that could lead to a material data breach. Which risk response should the practitioner recommend?
A pension fund administrator has completed a quantitative risk analysis for its core benefits-processing platform. The analysis shows an inherent annualized loss expectancy of $4.8 million. Management has implemented redundant data centers, automated reconciliation controls, and 24x7 monitoring at an annual cost of $900,000, which reduces the expected loss to $1.1 million. The CIO argues the remaining $1.1 million should be treated as fully mitigated because controls are now in place. As the CGEIT practitioner advising the risk committee, what is the MOST appropriate governance response?
A national retail chain is selecting a cloud-based point-of-sale analytics provider that will process aggregated sales and loyalty data. The vendor will store data in a multi-tenant environment and subcontract a third party for data enrichment. The information security manager proposes approving the vendor based on its ISO/IEC 27001 certificate alone. As the CGEIT practitioner, which action BEST ensures third-party risk is governed appropriately before contract signature?
A regional energy utility is integrating operational technology with corporate IT to enable remote monitoring of substations. The CGEIT practitioner is defining how risk treatment options will be selected and governed across the resulting exposure. Which TWO considerations are MOST important when establishing the enterprise's approach to risk treatment? (Choose two.)
A retail bank has defined a risk appetite stating that any customer data breach affecting more than 10,000 records is unacceptable. During a project to implement a new CRM system, the project manager identifies that the design would store unencrypted customer data in a third-party cloud environment. The project is in the design phase, and the go-live is six months away. What should the CGEIT professional recommend FIRST?
A global insurance company uses a centralized risk register managed by the enterprise risk management (ERM) team. Business units are responsible for identifying and assessing risks, but they often submit incomplete risk entries that lack impact and likelihood ratings. The CGEIT professional has been asked to improve the quality of risk data for better aggregation and reporting to the board. Which of the following is the MOST effective approach?
A CGEIT professional is reviewing the enterprise risk management (ERM) process of a multinational manufacturing firm. The firm has a decentralized structure with regional risk committees. The CGEIT professional notes that risk responses are inconsistently applied across regions, and some regions accept risks that exceed the enterprise risk appetite. Which TWO of the following actions should the CGEIT professional recommend to improve alignment with the enterprise risk appetite? (Choose two.)
A CGEIT professional is advising a mid-sized financial services firm that has recently experienced several IT outages due to unpatched systems. The board has asked for a presentation on how to improve the governance of IT risk. Which of the following should the CGEIT professional recommend as the FIRST step?
A global pharmaceutical company is implementing a new cloud-based clinical trial management system. The system will store sensitive patient data and must comply with strict regulatory requirements. The CGEIT professional is reviewing the risk register and notes that the risk of data leakage due to misconfiguration of the cloud environment is rated as high likelihood and high impact. The project team proposes to accept the risk because the cloud provider has a robust security certification. What should the CGEIT professional recommend?