ISACA Certified in the Governance of Enterprise IT (CGEIT) (CGEIT) (CGEIT) — Questions 76–150

The board needs a comprehensive risk analysis to make an informed decision aligned with its low risk appetite. Quantifying the compliance exposure—such as potential fines, sanctions, and reputational harm—and evaluating options like upgrading, compensating controls, or replacement provides a balanced view. This approach respects the board's role in risk oversight and ensures that the decision is based on accurate information. It also documents due diligence, which is essential for regulatory accountability.

Given the board's zero tolerance for material data breaches, avoiding the risk by discontinuing the third-party gateway removes the exposure entirely. Developing an in-house solution allows the enterprise to control security measures directly. While this may require investment, it aligns with the risk appetite by eliminating the specific risk. Avoidance is the only response that guarantees the risk cannot materialize from that source, making it the most appropriate recommendation.

Delegating defined decision rights to lower levels directly addresses the slow decision-making constraint by removing escalation bottlenecks. Thresholds preserve governance oversight whilst enabling faster responses to market changes, matching COBIT's principle that authority should sit closest to the point of decision. This balances agility against control without abandoning accountability structures.

The steering committee provides cross-functional oversight, ensuring proposed and active IT investments remain aligned with business strategy and that the portfolio is balanced. It reviews direction and prioritisation rather than performing day-to-day delivery, which distinguishes it from programme or operations management.

The board wants strategic oversight, which means governing alignment, value, risk, and resources rather than reviewing operational health. Replacing operational metrics with these governance-focused topics shifts the committee's attention to its actual mandate. Operational metrics remain useful to IT management but should not dominate a governance agenda. This change directly addresses the board's concern by making the committee a strategic oversight body.

The data the vendor accesses or processes determines the inherent risk exposure, since sensitive or regulated information raises the impact of any vendor failure. Governance therefore prioritises this factor when assessing third-party risk, as it drives the controls and oversight required.

Cultural resistance is a common IT governance challenge because governance imposes enterprise-wide decision rights and accountability, altering established departmental autonomy and informal power structures. Staff and managers may resist changed roles, new oversight forums and compliance demands, so adoption stalls unless change management and executive sponsorship actively address behavioural and political opposition.

Reviewing IT project status and business value delivery is a steering committee responsibility because it provides ongoing governance oversight of whether initiatives deliver expected outcomes. This satisfies the stem by matching the committee's remit to monitor performance and value realisation, rather than executing projects or managing resources directly.

Presenting a business case to the board satisfies the appetite-exceedance constraint: only the board can formally accept risk above its own approved threshold. Compensatory controls reduce residual exposure, and the project's competitive-advantage value justifies escalation rather than cancellation or silent tolerance.

COBIT 2019 places governance decision rights with a business-led forum, not IT alone. The IT Steering Committee holds delegated authority spanning strategy, investment and prioritisation, ensuring IT governance decisions align with enterprise objectives and remain accountable to executive management.

A standardised framework supplies a defined structure, shared terminology, and repeatable processes, directly satisfying the stem's demand for governance benefit. This consistency lets diverse stakeholders communicate decisions and accountabilities uniformly, reducing ambiguity across the enterprise. It is precisely this common language and structured practice that converts scattered IT activity into governed, auditable outcomes.

A benefits realization post-implementation review compares actual results with the business case, explains variances, and captures lessons for future investments. It gives the board a structured account of why benefits were or were not achieved and feeds improvements into the governance framework. This directly addresses the board's need to understand causes and enhance future realization.

A benefits realization plan defines what will be measured, who owns each benefit, the pre-initiative baseline, and when results will be assessed. Creating it first ensures that fraud-loss and case-resolution data are captured before the platform changes behavior, making later confirmation possible. Without it, the committee would have targets but no agreed method or accountability for proving them.

Alignment of IT services with business objectives is a governance outcome because it describes the resulting state achieved once decision rights, structures and processes operate effectively. It satisfies the stem by being an end effect of governance, unlike mechanisms such as committees or policies, which are enablers.

Organisational structures are a governance enabler because they define decision rights, accountability and reporting lines through which governance objectives are achieved. COBIT groups them with processes, information, culture and services as components that make governance work.

Risk capacity defines the maximum risk the enterprise can bear before strategic objectives are threatened. Establishing it first gives the practitioner a quantified boundary against which risk appetite is then calibrated, ensuring alignment with corporate strategy rather than arbitrary tolerance setting.

Residual risk trend against risk appetite shows whether treatment is actually reducing exposure to within tolerated limits over time. The board needs this forward-looking comparison, not raw incident counts or control coverage, to judge whether IT risk management is achieving its intended outcome.

An enterprise capacity plan creates the missing supply-side view that project-by-project approval lacks, allowing governance bodies to sequence demand against realistic skill and budget constraints. It directly addresses both chronic overruns and long waits by making trade-offs explicit before commitments are made, which is the core of IT resource governance.

This is a key component because clear roles and responsibilities establish accountability for IT resources. Without defined ownership and stewardship, resource management becomes uncoordinated, leading to inefficiencies, gaps, and conflicts. In a hospital setting, this is critical for ensuring that clinical systems and data are managed appropriately and that resources are aligned with patient care priorities.

Integrating IT human capital planning with enterprise strategic planning ensures workforce skills, capacity and sourcing decisions derive from long-term business direction. This satisfies the stem by embedding IT workforce planning within the same cycle that sets enterprise strategy, rather than treating it as a separate IT activity.

A balanced scorecard for IT governance spans four perspectives: financial, customer, internal process, and learning and growth. This structure balances lagging financial measures with leading indicators, giving the stem's governance framework complete coverage rather than a single-dimension view.

Board minutes are contemporaneous, formally approved records evidencing directors' actual deliberation and decisions. They document IT strategy review and approval, providing auditable proof of oversight, whereas charters, policies or committee terms merely describe intended responsibilities without demonstrating that the board discharged them.

Cross-functional membership ensures business priorities shape technology decisions, satisfying the governance requirement for enterprise-wide alignment rather than IT-only oversight. Business representatives bring accountability for value delivery, while IT provides feasibility insight. This shared ownership prevents the committee becoming a technical forum divorced from strategic objectives, which is precisely what effective IT governance demands.

Defined processes translate governance intent into repeatable, auditable activities, specifying who decides what and when. Without them, decision rights and accountability remain informal, so governance cannot be consistently enforced across the enterprise. They are one of the three critical components, alongside structures and information flows.

Investing in redundancy for the EHR system directly supports patient safety by reducing the risk of downtime that could compromise care. Accepting higher costs to mitigate a patient safety risk aligns with a risk appetite that prioritizes safety over cost efficiency. This demonstrates that risk response decisions are consistent with the board's stated tolerance for risk in pursuit of patient safety objectives.

Because appetite is 'low' and the project introduces moderate breach risk, governance must direct treatment rather than accept it. Adding controls reduces residual risk to within the stated appetite, satisfying the constraint that risk exposure must not exceed the board-set tolerance.

Standardized benefit categories and measures make results comparable across diverse initiatives, while periodic reporting and variance escalation give the board ongoing assurance that value, not merely delivery, is being managed. This approach scales to 40 initiatives and creates consistent accountability, enabling the board to challenge underperformance and redirect investment based on evidence.

Risk-based prioritisation criteria embedded in the business case let governance rank initiatives by exposure and value before funding, satisfying the stem's demand to optimise risk across the lifecycle from the planning phase onward, rather than reacting after delivery begins.

Because 800 stores remain unmigrated, the program naturally forms treatment and comparison groups. A defined baseline plus a control group lets the committee isolate the incremental stockout and carrying-cost effect attributable to the forecasting platform, netting out the supply chain reorganization and seasonal demand. This is the only option that directly answers the attribution question the CIO raised.

A cloud center of excellence establishes governance guardrails, approved service catalogs, and consolidated procurement while still allowing regions to consume resources. This directly addresses duplication and inconsistent controls without eliminating regional agility, because regions self-provision only from vetted offerings. It is the first step because it creates the framework within which later optimization decisions can be made.

Contractual clauses obliging the provider to perform recurring risk assessments create enforceable, auditable alignment with the enterprise's risk appetite. This satisfies the governance constraint by making provider risk practices continuously verifiable rather than relying on one-off due diligence.

Comparing realised benefits against the original business case measures whether the projected value materialised, satisfying the review's core purpose of benefit realisation. This evidence-based comparison determines whether corrective action, benefit re-forecasting or project closure is warranted.

Scope of governance defines which business units, geographies, processes and technologies the policy covers, establishing the policy's boundaries and applicability. Without it, the committee cannot determine where governance authority applies, so this satisfies the stem's requirement for a commonly included component.

Avoid eliminates the risk entirely by discontinuing the activity or changing approach that generates it, removing both likelihood and impact. This is one of the standard risk response strategies, directly satisfying the question's requirement for common strategies rather than controls or monitoring activities.

A portfolio review maps each IT investment to strategic business objectives, exposing misalignment and duplicated or low-value spend. This directly addresses the stem's constraint that investments are not delivering expected value, giving the committee evidence before reallocating or terminating investments.

Providing strategic direction and monitoring governance performance aligns with the board's oversight mandate under IT governance frameworks such as COBIT, where the governing body sets direction and evaluates performance. This satisfies the stem's requirement for the board's primary responsibility, distinct from management's operational duties of planning, building and running.

Appointing data owners assigns explicit accountability for data quality, classification and usage, while a data governance committee provides cross-functional oversight and escalation. Together these mechanisms directly remedy the identified accountability gap, satisfying the stem's requirement for a governance mechanism rather than a purely technical control.

Escalating the discrepancy and recommending a framework review addresses both the immediate issue and the underlying governance weakness. The corporate risk committee needs to be aware that a region misapplied the risk appetite, and the framework should be strengthened with clear escalation triggers, common risk taxonomy, and regular calibration. This ensures consistent risk assessment and reporting across the enterprise.

Adoption rate during the pilot phase is a predictive metric: it signals whether the system will deliver intended benefits before full rollout, satisfying benefits realisation's need for early course correction. Unlike lagging indicators such as post-implementation ROI, it measures behavioural uptake while change is still influenceable, enabling governance to intervene proactively.

A baseline captures current performance before implementation, giving a fixed reference against which post-implementation results are compared. This satisfies the stem because without it, measured improvement cannot be attributed to the new system, making impact assessment impossible.

A standard service catalogue with an internal brokerage model gives business units a sanctioned, fast route to acquire IT, removing the incentive to procure externally. This restores visibility of spend for the consolidated benefits realisation report while preserving agility through self-service options.

Differentiated capability targets apply the COBIT design factor concept of tailoring governance intensity to risk and context. High-risk areas receive stronger controls and assurance, while lower-risk innovation work is governed more lightly, satisfying the board's risk appetite requirement without imposing uniform overhead that would slow product launches across the board.

A gap analysis maps existing competencies against the future-state skill profile the transformation demands, exposing precise shortfalls. This directly satisfies the workforce-planning constraint by grounding development and recruitment decisions in evidenced deficiencies rather than assumption.

Visible executive sponsorship supplies the authority to enforce governance decisions, allocate budget and resolve competing priorities across business units. Without that mandate, the program stalls at the steering-committee stage, so active senior leadership commitment directly satisfies the critical success factor of organisational authority and sustained resourcing.

Aligning IT investment prioritisation with business outcomes directly addresses inconsistent IT costs by tying funding decisions to measurable value, satisfying the stem's governance challenge. This is an investment-governance mechanism, not operational cost control, ensuring resources flow to initiatives delivering strategic benefit and reducing unjustified spend.

Root cause analysis directly addresses the high frequency of minor incidents by uncovering systemic patterns rather than treating symptoms individually. This satisfies the governance requirement to prevent cumulative minor incidents escalating into significant enterprise risk, since RCA converts recurring operational failures into remediable structural findings that inform risk oversight.

Governance requires IT risk to be assessed against business impact, so the two must be linked. Performing IT risk assessments independently of the BIA severs that alignment, meaning risk treatment cannot reflect actual business consequence — a direct failure of enterprise risk governance.

Tracking the proportion of projects explicitly linked to business strategy directly quantifies strategic alignment, since alignment is achieved only when the IT portfolio demonstrably supports stated business objectives. This metric exposes misaligned investment, satisfying the stem's requirement for a strategic alignment measure.

Using a common risk taxonomy and scoring methodology allows IT risk to be compared and aggregated with other risks, enabling consistent prioritization and reporting to the board. This is fundamental for integration because it breaks down silos and ensures IT risk is not managed in isolation. Without a shared language, IT risk cannot be effectively incorporated into enterprise-wide risk decisions.

Organisational structures define decision rights, accountability and reporting lines, ensuring IT investment decisions align with enterprise strategy. This satisfies the stem's requirement for an essential governance component by establishing who owns, approves and oversees IT outcomes, distinct from operational processes or tooling alone.

COBIT 2019 provides a performance management system with process capability levels and metrics that assess whether governance and management objectives are being achieved. By evaluating the enterprise's achievement of these objectives, the CIO can demonstrate the effectiveness of the governance system in delivering value, managing risk, and optimizing resources, directly answering the board's question.

Alignment is demonstrated by outcomes, not artefacts: strategies, roadmaps and steering committees are inputs, but the definitive indicator is that business objectives are actually achieved through IT. This option ties alignment to realised business value, satisfying the stem's demand for a success indicator rather than an activity.

A business value versus technical health assessment, often visualized as a portfolio matrix, directly compares each application's contribution to the business against its technical quality and support burden. This allows the CIO to identify applications that are high-cost or technically poor relative to their value. It is the most appropriate technique because it aligns resource optimization with business strategy and supports governance decisions on invest, maintain, or retire.

A benefit impact assessment quantifies the cost of deferral, identifies whether acceleration enables other benefits, and gives the committee evidence to make a balanced decision. This is the core governance response: understand the effect of change on benefits before approving it. It preserves flexibility while ensuring benefit realization remains the decision criterion rather than schedule alone.

IT risk materialises through business processes, so those accountable for process outcomes must own the risk decisions, with senior IT leadership supplying technical feasibility and control context. This pairing ensures the committee governs enterprise risk rather than only infrastructure concerns.

IT resource governance requires that major changes to foundational platforms be evaluated against enterprise risk appetite before approval. A migration affecting core transaction processing could disrupt critical financial services and breach regulatory obligations. The committee should require a risk assessment that quantifies continuity and compliance exposure, ensuring the resource decision is grounded in risk-adjusted value rather than cost savings alone.

Compute and storage capacity determines whether the project can actually be hosted and scaled, making it a core resource input. Assessing it satisfies the stem's requirement to evaluate resource requirements before committing to delivery timelines and budgets.

Defining KPIs at investment outset establishes measurable baselines against which expected business outcomes are later compared, enabling benefits realisation rather than retrospective justification. Without pre-agreed indicators, the organisation cannot objectively demonstrate whether the investment delivered the intended value, so governance decisions on continuation or corrective action lack evidence.

The committee needs evidence, not delivery status. A benefits tracking report compares actual outcomes against the approved baseline for the two claimed benefits, which is exactly how benefits realization is verified after go-live. This converts the program's closure claim into an evidence-based assessment and gives the committee a basis for accepting, conditioning, or rejecting the declared completion.

Monitoring control effectiveness is a delegated assurance activity the Risk Owner assigns and oversees, confirming controls still mitigate the risk within tolerance. This satisfies the stem by capturing the operational responsibility dimension of the role, distinct from ultimate accountability.

Embedding risk management within the IT governance policy makes risk identification and treatment a standing governance obligation rather than an ad hoc activity. This satisfies the stem by ensuring risks are systematically identified, assessed and managed through defined accountability and reporting channels.

Assigning risk ownership to named roles ensures every identified risk has an accountable party who monitors and escalates it. Without this, the policy states intent but lacks the enforcement mechanism that makes risk management operational across the enterprise.

Risk responses must align with the enterprise's risk appetite to ensure that the organization does not exceed its tolerance. By selecting responses that bring residual risk within the approved appetite, the CGEIT practitioner ensures that the plan is consistent with governance objectives. This approach balances risk and reward and is fundamental to effective risk optimization.

Benefits realization requires measuring actual outcomes against the baseline and target stated in the business case. Churn was the committed benefit, so the manager must determine whether it moved, by how much, and why the forecast diverged, before deciding on corrective action or re-forecasting.

A disbenefit is an outcome of an IT investment that reduces value, such as increased operating cost, compliance exposure or displaced revenue. It satisfies the stem by naming the negative consequence explicitly, distinguishing it from an unrealised benefit or a project cost overrun.

An advisory council with clinical and IT representation creates a formal, repeatable channel for clinical input into EHR prioritization. It ensures decisions reflect patient care needs while remaining technically feasible, and it gives the governance committee a documented source of stakeholder requirements. This structure directly addresses the goal of giving clinical staff a formal voice without transferring decision accountability away from governance.

Sensitivity analysis varies key assumptions, such as cost or adoption rates, to show how much the projected return on investment moves. This directly satisfies the stem's purpose: testing how changes in assumptions affect the projected ROI underpinning benefits realisation.

When a key dependency is removed, the benefit case changes materially, so the committee must reassess the investment and choose among re-scoping, re-sequencing, or stopping it. This preserves portfolio value discipline and prevents continued funding of an initiative whose benefits are no longer achievable as approved.

A federated model balances enterprise-wide consistency with local agility. The central council defines non-negotiable principles, security standards, and investment thresholds, while regional committees make decisions within those guardrails. This directly resolves duplicated spending, inconsistent controls, and fragmented risk visibility without eliminating the local knowledge that regional committees provide, making it the most appropriate governance mechanism for a multi-country retailer.

Cyber-insurance contractually shifts specified financial losses to the insurer, directly satisfying the board's decision to transfer an unmitigable high-impact risk. Unlike avoidance, which eliminates the activity, or mitigation, which reduces likelihood or impact, transfer leaves the risk exposure intact but compensates resultant losses, matching the stem's constraint that full mitigation is impossible.

The IT Strategic Plan defines how IT resources are prioritised and allocated by translating enterprise strategy into IT objectives, initiatives and investment sequencing. It provides the framework directing funding and effort toward agreed priorities, whereas operational plans address execution rather than allocation.

Multi-cloud splits workloads across providers, each with separate consoles, tagging schemas, and billing models. This fragmentation prevents consistent visibility, unified policy enforcement, and consolidated cost management, which is the dominant governance obstacle to optimising resource usage across platforms.

Value delivery and risk exposure are weighed together, so investment decisions pursue benefits only within the enterprise's stated risk appetite. This satisfies the stem's balance requirement, rather than maximising return or minimising risk in isolation.

Conditional approval that folds the enabling decommissioning work into scope and funding aligns the benefit promise with the work required to achieve it. It makes the dependency explicit, assigns accountability, and ensures the benefits baseline reflects the true cost and sequence of change. This is the governance action that protects benefit realization while keeping the investment viable.

The decision should compare the incremental cost to complete against the incremental benefits still expected, since only future cash flows and outcomes are affected by the choice. If the remaining benefits no longer justify the additional funding, terminating preserves capital for alternatives with stronger benefit cases, which is sound benefits realization governance.