ISACA Certified in the Governance of Enterprise IT (CGEIT) (CGEIT) (CGEIT) — Questions 1–75

A baseline, a target, and a defined measurement method make the benefit verifiable and comparable over time. Auditors and governance bodies need these elements to confirm whether the claimed improvement actually occurred, so omitting any of them leaves the benefit unverifiable and unsuitable for traceable benefits realization reporting.

Governance succeeds when IT spending produces measurable business outcomes. Alignment between IT investments and realised business value directly evidences that governance decisions steer resources toward strategic objectives, unlike operational metrics such as uptime or ticket volume.

Reporting cadence should track how rapidly exposure shifts. A deteriorating or highly volatile risk posture warrants more frequent board updates, because stale information could mislead oversight; a stable, low-volatility environment justifies longer intervals between reports.

Strategy and business goals determine the governance system's design because governance exists to direct and control IT toward enterprise objectives. Decision rights, structures and processes are tailored to the organisation's specific strategic context, so differing goals produce differing governance arrangements, making strategy the dominant influencing factor.

COBIT 2019's design factors (enterprise goals, risk profile, threat landscape, size, sourcing model) exist precisely so governance systems can be tailored per enterprise. Customising on these factors makes the system dynamic, satisfying the stem's requirement rather than applying a rigid one-size-fits-all framework.

Computing infrastructure absorbs the direct processing load of increased transactions, so rapid demand growth saturates CPU, memory and throughput first. Storage and network capacity can often be expanded with less immediate effect on service delivery, making compute the most likely bottleneck during a sudden surge.

A formal communication and training plan translates the governance policy into awareness and role-specific instruction, ensuring employees understand their obligations. Publishing the policy alone does not build comprehension or drive consistent adherence across the organisation.

The failure is a breakdown in the governance mechanism of defined decision rights and escalation, not necessarily in the CIO's competence. Reaffirming the thresholds and requiring a remediation plan restores accountability while keeping operational authority with the CIO. It also gives the committee evidence to monitor whether the escalation discipline is being followed going forward.

This demonstrates governance by linking human resource capability to the work the bank must deliver, and by defining how external staff are engaged, how their knowledge is transferred to employees, and how critical skills are retained. It gives the board evidence that workforce decisions follow deliberate criteria tied to strategic and regulatory objectives, which is the assurance they are requesting.

Monitoring and enforcement ensure that governance decisions are followed and that deviations are addressed. Without this, governance becomes advisory and loses its effectiveness. COBIT includes processes like MEA01 Performance and Conformance Monitoring, which provide the oversight needed to keep decision-making aligned with enterprise objectives. This is a key component for maintaining the integrity of the governance framework.

IT governance is defined by its relational and procedural nature: a structure of relationships and processes that directs and controls the enterprise's IT. This captures both decision rights and accountability mechanisms, matching recognised definitions rather than narrower operational or technical descriptions.

Monitoring realized benefits against the approved baseline converts benefits realization from a planning exercise into an ongoing control. Defined review points and escalation triggers ensure underperforming investments are identified early enough for intervention, which is exactly what the committee requires to govern value delivery rather than merely approving spending.

A cloud governance framework provides the structure for managing cloud resources. It defines who is accountable for cost, how resources are requested and approved, and what policies govern usage. This foundational step ensures that subsequent technical controls, such as scaling or tagging, are aligned with business objectives and enforced consistently across the organization.

Change management and training address the human adoption barrier: staff must understand new processes and be competent before go-live. This satisfies the stem's preparation requirement because technical readiness alone leaves users unable to operate the solution, so structured training and transition planning ensure genuine business readiness.

Executives approving funding need visibility of what could prevent the investment delivering its promised value. Documenting key risks with mitigations satisfies governance expectations for informed decision-making, showing the business case has been stress-tested rather than presenting only optimistic projections.

A skills inventory and succession planning process directly addresses the deployment of human resources by identifying gaps between current competencies and future strategic requirements. It enables the committee to make informed decisions about training, hiring, and reassignment. This action supports both operations and strategy because it ensures the right skills are available where needed and reduces key-person risk.

Before declaring failure or success, the benefits owner must verify the baseline and attribution. A 12% improvement claim is meaningless without a pre-implementation baseline and a credible link between the CRM deployment and the retention metric. This step isolates whether the shortfall is real, a measurement error, or caused by external factors, and it determines the corrective action.

The root cause is unclear decision rights over IT resources. Defining who decides, who is accountable and how business units participate in a joint review forum restores governance while preserving innovation. This aligns with CGEIT's emphasis on resource governance through decision rights and accountability rather than central control or punitive measures.

This action directly connects the board's risk appetite to IT by defining measurable tolerance thresholds, ensuring IT risk decisions align with enterprise objectives. It is the foundational step before monitoring or reporting, as it establishes the criteria against which IT risks are evaluated and managed.

Quantifiable financial returns, including cost reduction, revenue growth or avoided expenditure, form the tangible economic component of portfolio value. They let decision-makers compare competing investments on a common monetary basis alongside qualitative strategic and risk criteria.

A rolling capacity model that incorporates business forecasts and lifecycle events directly addresses the shortcomings of using historical averages. It enables the CIO to anticipate the reduction in load from the legacy retirement and the additional users from the acquisition. This is a governance-aligned approach because it ties resource planning to business strategy and known changes, improving both reliability and cost efficiency.

The governance board owns risk appetite, so a material deviation must be escalated to it with a proposed remediation plan rather than handled silently by the practitioner. Reporting the variance preserves board oversight and enables it to accept, reject or adjust the response.

A weighted scoring model translates dissimilar benefits into a common decision scale tied to strategic objectives, letting the committee compare processing-time reduction, revenue growth, and risk reduction on one consistent basis. This is the standard portfolio prioritization technique when benefits are heterogeneous and the goal is alignment with enterprise strategy rather than pure financial return.

Benefits are realized through use, so the committee should require demonstrated adoption and measured efficiency before confirming them. Keeping the program open or extending the benefits tracking phase until usage evidence exists protects the investment and keeps accountability with the sponsor. This reflects the principle that delivery is not realization and that benefits confirmation depends on operational uptake.

Strategic alignment measures how directly each investment advances the enterprise's stated objectives and target capabilities. It satisfies the prioritisation criterion by filtering out proposals that, however profitable in isolation, divert funding from initiatives that collectively deliver the portfolio's intended business outcomes.

Alignment between IT projects and strategic business objectives directly evidences whether resources flow to sanctioned priorities, satisfying the stem's demand for an effectiveness measure rather than an efficiency or utilisation metric. It exposes misallocation that capacity, spend or uptime figures conceal, making it the strongest governance indicator of allocation quality.

This applies portfolio-level governance: resources are directed by assessed business criticality and risk, ensuring the customs-clearance application's exposure is addressed in proportion to its importance. It balances limited budget and specialist capacity across competing demands rather than defaulting to a single technical remedy, which is precisely how IT resource governance should allocate constrained assets.

Mapping IT risk scenarios to the enterprise risk taxonomy ensures consistent categorization and aggregation. Reporting in the ERM dashboard provides visibility to enterprise risk committees and enables holistic risk management. This demonstrates that IT risk is not siloed but integrated into the broader ERM framework, allowing for better prioritization and resource allocation aligned with enterprise objectives.

An IT steering committee is a formal governance structure: a cross-functional body with defined membership, mandate and decision rights that directs and oversees IT investment and priorities on behalf of the board, distinct from processes, policies or individual roles.

Normalised TCO relative to business unit output divides cost by a common productivity measure, removing distortions from differing currencies, scale and operating models. This satisfies the cross-unit comparability constraint, letting the company rank investment performance on a like-for-like basis rather than raw absolute spend.

Planning and acquisition initiates the infrastructure lifecycle by aligning resource capacity with business strategy before procurement. This satisfies the stem's lifecycle requirement, since infrastructure management begins with forecasting needs and securing assets, preceding deployment, operation, maintenance and eventual retirement phases.

A technical debt register makes the invisible visible, allowing the committee to prioritize remediation based on risk and business impact rather than anecdote. Quantifying remediation cost and velocity impact enables trade-off decisions against other IT resource investments. This is the foundational governance step: you cannot govern what you have not measured. Subsequent actions such as sprint allocations or funding decisions become defensible once the register exists.

The Business Sponsor owns the investment rationale and is accountable for the benefits realisation, so they must validate that costs, assumptions and projected returns in the business case are accurate and justifiable. This satisfies the stem's accountability requirement, which cannot sit with IT delivery or finance alone.

Controls lower the probability or impact of a threat but cannot drive exposure to zero, so the $1.1 million is the residual risk that remains after treatment. Under enterprise IT governance, residual risk must be explicitly owned, documented in the risk register, and either accepted within appetite or subjected to further treatment. Treating it as fully mitigated obscures accountability and prevents the risk committee from making an informed acceptance decision.

Inherent risk is the exposure that exists before any controls are applied, representing raw likelihood and impact. It is the baseline against which residual risk is compared, so the risk existing absent controls is the correct example.

Establishing governance begins with clarifying what it must achieve and which parts of the enterprise it covers, aligned to enterprise goals and stakeholder expectations. This defines the framework's purpose and boundaries, guiding later decisions on structures, processes, and metrics. Without agreed objectives and scope, framework design risks being generic and disconnected from the insurance company's strategic and risk context. It is the logical and necessary first step.

Data classification determines which datasets fall under which sovereignty jurisdiction, letting controls enforce residency and access restrictions per location. This satisfies the stem's compliance constraint because sovereignty obligations attach to data categories, not infrastructure, so classification must precede any hybrid cloud placement decision.

This is the primary consideration because governance effectiveness depends on its ability to adapt to changes in business strategy, market conditions, and regulations. Continuous alignment ensures that the framework remains relevant and supports the enterprise's ability to achieve its objectives in a dynamic environment.

Weak strategic alignment between IT and business is a recognised IT governance implementation challenge. It satisfies the stem because misalignment prevents IT investment from supporting enterprise objectives, producing duplicated effort, unclear ownership and diminished value delivery across the governance programme.

Mapping IT risks to business processes and strategic objectives enables the board to understand how technology failures could impact corporate goals. This alignment transforms technical risks into business-relevant terms, making reporting actionable. Without this linkage, IT risk remains siloed and the board cannot prioritize investments or responses effectively. This practice directly supports integration with ERM by ensuring IT risk is expressed in the same language as other enterprise risks.

Monitoring and reporting on resource utilisation gives the governing body the evidence needed to confirm IT resources are deployed against strategic objectives and to correct misalignment. Without this feedback loop, governance decisions rest on assumption rather than measured performance, so accountability cannot be demonstrated.

Tracking benefits after implementation satisfies the realisation phase of the benefits lifecycle, verifying that forecast outcomes actually materialise and enabling corrective action. This ongoing measurement distinguishes benefits management from mere business case approval, ensuring value delivery is evidenced rather than assumed throughout the investment's operational life.

Re-assessing strategic goals tests whether the low Strategic Fit score reflects genuine misalignment or an outdated scoring baseline, since positive NPV signals real financial value. Governance should verify the alignment criteria themselves before rejecting a value-generating project, ensuring portfolio decisions rest on current strategic priorities rather than stale assumptions.

The CIO translates board governance directives into operational IT management, ensuring execution aligns with mandated strategy and risk appetite. This satisfies the stem's governance constraint: the CIO owns the management-side accountability for conformance, distinct from the board's directive-setting role, making IT activity answerable to governance rather than autonomous.

Risk appetite expresses how much risk the enterprise will accept, giving a measurable threshold against which identified risks are compared. Risks exceeding that threshold warrant treatment; those below it can be accepted, so responses are proportionate.

A Benefit Dependency Network maps the causal chain from enablers and investments through business changes to measurable outcomes. It visualises dependencies rather than costs or schedules, letting governance bodies trace how each initiative contributes to realised benefits and where delivery breaks down.

Periodic portfolio review directly satisfies the alignment constraint by reassessing every IT investment against current business priorities at fixed intervals. Unlike static approval gates, it forces reallocation as priorities shift, letting governance bodies retire, redirect or reprioritise funding. This continuous realignment mechanism is precisely what changing business priorities demand.

Mapping IT governance activities onto existing business decision-making processes and accountabilities embeds IT oversight within current management structures rather than creating a parallel hierarchy. This satisfies the integration requirement, ensuring IT investment, risk and performance decisions follow the same governance routes as the wider enterprise.

Expressing IT risk appetite in business impact terms, such as maximum tolerable downtime, lets the board compare cloud risk against other enterprise exposures using a common language. Embedding these thresholds into the enterprise risk appetite statement connects technology decisions to strategic objectives. This integration ensures IT risk is governed at the same level and cadence as other material enterprise risks.

A benefits register is the core governance artifact for benefits realization. It records each benefit, the metric used to measure it, the baseline before the initiative, the target, the accountable owner, and how often it will be reported. This structure makes benefits credible, comparable, and auditable over time, and it assigns clear accountability for realization.

Aligning risk trends with strategic business milestones shows whether exposure is shifting as key objectives approach. This satisfies the maturity requirement for forward-looking, strategy-linked reporting, enabling the board to anticipate impediments to planned outcomes rather than reviewing historical risk data in isolation.

Aligning infrastructure resources with business goals directly satisfies the governance requirement for value delivery, ensuring IT investment supports strategic objectives rather than operating in isolation. This distinguishes governance-focused resource management from purely technical capacity planning, which addresses performance and availability but not strategic alignment or accountability for business outcomes.

Conducting a risk assessment is foundational to understanding which IT risks are most significant and how they relate to business goals. It provides the basis for prioritizing investments and treatments. Without this, any subsequent actions may be misdirected. This aligns with CGEIT's emphasis on risk optimization and governance.

The Board of Directors holds ultimate accountability for enterprise IT governance, setting direction and ensuring IT risks and value are managed. This satisfies the stem because governance accountability cannot be delegated to management, who implement rather than own it.

Benefits often materialise months or years after implementation, so measurement windows rarely align with project closure or reporting cycles. This lag complicates attribution, since intervening business changes obscure whether the project caused the gain, and it strains governance processes that expect demonstrable returns within the same financial period.

IT functions must keep existing services running whilst funding transformation, and splitting finite staff, budget and attention between the two creates persistent tension. This trade-off between operational stability and innovation is a core resource management challenge named in the stem.

A risk taxonomy ensures consistent categorization, and standardized rating scales with mandatory fields enforce completeness. This addresses the root cause of incomplete entries by providing structure and requiring key data. It also enables meaningful aggregation and comparison across business units. This is a foundational governance improvement that supports board reporting and risk optimization.

Raising the appetite specifically for experimental initiatives directly matches the high-risk innovation strategy, while sunset clauses impose time-bound limits that force review or termination. This satisfies the stem's need to support bold innovation without granting blanket tolerance, keeping exposure bounded and governance intact.

A PIR compares realised outcomes against the business case's projected benefits after delivery, confirming whether value materialised. It also captures lessons learned to improve future investment decisions, which is precisely benefits realisation assurance rather than project closure administration.

The IT Steering Committee provides cross-functional prioritisation, giving business and IT representatives a formal forum to arbitrate competing project priorities. Strengthening it directly resolves the friction described in the stem by establishing agreed decision rights over portfolio sequencing.

A benefits dependency network maps the enabling changes, business changes, and benefits, and it must be validated with the business owner who controls the operational change. Here, operations never agreed to alter maintenance scheduling, so the enabling business change was never owned, making the claimed cost reduction unachievable regardless of IT delivery success.

Activities delivering core competitive advantage are typically retained internally to preserve control, expertise and differentiation, while commodity or non-strategic functions are candidates for outsourcing. Strategic value therefore governs the internal versus external sourcing decision more than cost alone.

Categorizing benefits as quantifiable or non-quantifiable allows the board to compare monetary returns alongside intangible outcomes such as citizen satisfaction or compliance, without forcing false precision onto things that resist monetization. It keeps both types visible in the benefits register and supports consistent discussion of trade-offs between measurable savings and strategic or reputational gains.

Consistent, documented measurement methods with defined baselines and timing allow benefits from different business units to be compared and aggregated credibly. Without common definitions, one unit may measure productivity gains differently from another, making the portfolio view meaningless. This practice directly addresses the committee's need for assurance and comparability and is a core element of benefits realization governance.

Risk impact is measured by how a threat event disrupts business objectives and value delivery, not by technical severity alone. This perspective satisfies the stem's assessment requirement because it links likelihood and consequence to enterprise outcomes, enabling governance bodies to prioritise treatment aligned with strategic value.

Benefits-based teams continuously validate deliverables against expected benefits, re-evaluating scope when a feature no longer contributes value. This differs from project-based teams, which manage to fixed scope, schedule and cost. It satisfies the stem by keeping the project oriented toward realised outcomes rather than deliverable completion.

Virtualised workloads can be provisioned and moved dynamically, so security groups, segmentation and compliance controls may drift between hypervisors and tenants. SDI's abstraction layer removes the physical enforcement points that once guaranteed uniform policy, making inconsistent control coverage the governance risk to address.

Ongoing post-implementation reviews of benefit metrics provide the continuous measurement loop that sustainable benefit realisation demands, satisfying the stem's post-implementation constraint. By periodically comparing actual outcomes against the original business case, they detect benefit erosion or drift early, enabling corrective action rather than one-off verification at go-live.

Measurement alone changes nothing. Corrective action requires an accountable person who can alter processes, redeploy staff, or escalate. Naming benefit owners with the authority to act converts a lagging indicator into a decision. This is what makes the plan actionable rather than a passive reporting artifact, and it is a core governance expectation for benefits realization.

Harmonising the standards produces one governance framework covering the combined entity's full risk profile, rather than letting two incompatible sets coexist or arbitrarily imposing one side's rules. This directly addresses the merger's incompatible-standards problem while preserving risk coverage across both legacy environments.

Retention strategies for key talent address the supply side of workforce planning by reducing attrition of scarce, strategically critical IT skills, ensuring the capability pipeline identified during demand analysis remains available to deliver the enterprise's objectives.

The Board sets direction rather than managing delivery. Directing strategic alignment of IT with business goals is a governance-level duty, ensuring IT investment supports enterprise objectives and sits within the Board's mandate to steer overall strategy.

Maturity improvement requires a baseline before targets. Assessing current governance maturity exposes gaps between existing practise and the desired state, giving the organisation an evidence-based starting point for prioritising remediation. Without this baseline, subsequent roadmaps and improvements lack grounding in actual capability.

Strategic alignment means IT plans and business plans are synchronised, so IT investment directly supports enterprise objectives. This satisfies the stem by describing the two-way integration of IT strategy with business strategy, rather than mere IT cost efficiency or technology standardisation.

Positive ROI calculations assume anticipated usage and benefit capture, so low adoption signals that the benefits realisation plan neglected organisational change, training and stakeholder engagement. Technical delivery succeeded, but the benefits dependency on business behaviour change was never managed.