ISACA Certified in the Governance of Enterprise IT (CGEIT) (CGEIT) (CGEIT) — Questions 76–150

The committee must first assess the transparency and accuracy of the IT investment portfolio against business goals.

The board's primary role is oversight, ensuring that IT governance is established and that risks are managed in alignment with enterprise appetite.

Assigning data ownership and establishing a data governance council are the standard mechanisms to ensure accountability.

A leading indicator is a metric that predicts a future outcome, often used before the full benefit is realized.

The baseline represents the status quo, allowing you to measure the actual improvement (benefit) after the project.

Establishing an 'Internal IT Marketplace' or a standard service catalog provides business units with the agility they seek while ensuring that their spending is captured within the governance framework.

Competency mapping against strategic IT goals is the standard practice for identifying future needs.

Leadership support and cultural integration are essential for the success of any governance program.

The steering committee should review the IT investment portfolio and budget allocation to ensure consistency with strategic business priorities.

Aggregating risk is essential. Multiple minor incidents can indicate a systemic control weakness that, if unaddressed, leads to a major catastrophe.

If risk management activities are not linked to the strategic business objectives, the organization lacks effective governance over IT risk.

Portfolio alignment and value delivery metrics are key indicators of strategic alignment.

A governance framework must include both organizational structures and clear processes for decision-making.

Successful alignment is visible when IT investments and operations directly support the achievement of the enterprise's strategic goals.

IT governance covers strategic alignment, value delivery, risk management, resource management, and performance measurement.

Governance requires representation from the business, not just IT.

Human expertise, infrastructure capacity, and long-term maintenance costs are all critical factors in assessing project resource needs.

Defining KPIs early allows for the establishment of baseline performance data, which is essential to measure the delta created by the investment.

Risk owners are accountable for the management and monitoring of specific risks.

Governance frameworks integrate risk management by setting policies and requiring management to establish risk assessment processes.

A policy must define roles, responsibilities, and the framework for action.

A disbenefit is an adverse or negative impact resulting from the implementation of a project.

Sensitivity analysis tests how changes in variables (like cost or usage) impact the overall project ROI.

Risk transfer is about moving financial liability, not operational responsibility.

The IT Strategic Plan aligns IT initiatives and resource allocation with business objectives.

Managing fragmented resources across multiple providers complicates cost tracking, security policy enforcement, and skill management.

Governance is about the trade-offs. Delivering value requires taking risks; the objective is to optimize, not eliminate, risk.

BIA identifies critical processes and the impact of their disruption.

Allocating a fixed percentage of resources to technical debt reduction in every development cycle ensures continuous progress.

The board of directors (or equivalent) has ultimate accountability for the organization's governance, including IT governance.

The plan outlines how the benefits will be measured, tracked, and realized throughout the project lifecycle.

Avoidance is exiting an activity that carries risk.

Linking the digital transformation initiative to clear, measurable business objectives is essential for governance.

Boards need context, trends, and business impact rather than technical metrics.

Business case approval, project prioritization, and ROI measurement are the core steps in investment governance.

Cross-training and flexible resource pools (like contractors for non-core work) are effective strategies for workforce optimization.

Ineffective allocation leads to missed business goals and a high volume of 'keep-the-lights-on' work, leaving little room for innovation.

Maturity models identify gaps to allow for targeted improvements.

Rather than banning shadow IT, governance should provide approved, user-friendly alternatives to regain control and efficiency.

The framework provides the structure, processes, and mechanisms to ensure IT meets business goals and manages risk.

The project manager delivers the project; the benefits owner realizes the value after delivery.

Compliance monitoring relies on audit, formal performance metrics, and regular reporting.

The committee must perform a formal impact assessment and create a transition plan that ensures business continuity before decommissioning.

The benefits owner must determine if the increased costs impact the overall net value (ROI) to decide whether to continue the investment.

Governance of IT risk requires strategic alignment, clear communication, and defined accountability structures.

An output is what is delivered (the product), whereas an outcome is the resulting state or benefit to the organization.

Integrating IT risk into the enterprise risk framework ensures visibility for the board and alignment with business objectives, rather than treating it as a siloed technical concern.

Financial benefits are those that directly impact the organization's bottom line.

A cloud-first strategy requires robust governance over cloud spend, security, and integration to prevent runaway costs and fragmented infrastructure.

The governance policy and the committee charter are the foundational documents for oversight.

Governance must adapt to the velocity of agile without sacrificing oversight.

Percentages can mask the absolute scale of the benefit or the cost incurred to achieve it.

Management, led by the executive suite, is responsible for executing the strategies and policies set by the board.

Emerging technology requires the IT steering committee to review the risk appetite and update governance policies to manage new types of ethical and operational risks.

A culture of benefits realization requires accountability and a focus on measurement rather than blame.

IT governance must be derived from the enterprise's strategic goals and its appetite for risk.

An IT value framework ensures that IT investments provide the intended value to the business.

The business case provides the justification and the defined expected benefits for the project.

Benefits realization management requires an iterative review of the Benefits Realization Plan against actual operational data to identify whether the assumptions made during business case development are still valid.

Both executive business leadership and senior IT leadership must participate for the committee to be effective.

The governance board ensures that the investment remains aligned with enterprise strategy and that the benefits are being realized as planned.

Mitigation involves taking action to reduce the likelihood or impact of a risk.

Reporting and internal auditing are key mechanisms for governance monitoring.

Decentralization shifts control, requiring a governance framework that emphasizes shared standards and monitoring across multiple business units.

Emerging technologies often lack established governance models and possess significant skill gaps, making them difficult to manage.

Value optimization is the practice of continuously adjusting the portfolio to maximize the overall business value generated by IT investments.

Strategic alignment and value delivery are foundational pillars of IT governance.

Agile requires dedicated, cross-functional teams, which necessitates a shift from project-based to product-based resource allocation.

Cost-benefit analysis in risk management is fundamental to risk optimization.

Linking benefits to strategy ensures that IT investment contributes to the overall success and direction of the business.

Total Cost of Ownership (TCO) includes not just acquisition, but implementation and operational overheads.

Frameworks should be reviewed periodically or when significant changes occur in business strategy or the internal/external environment.

The benefits owner is accountable for ensuring that the business changes necessary to realize the value actually take place.

Dashboards provide visual, easy-to-understand status updates relevant to stakeholders.

Resources should be prioritized where the most significant risks exist.