ISACA Certified in the Governance of Enterprise IT (CGEIT) (CGEIT) (CGEIT) — Questions 151–225

A BIA must establish which processes are critical, since their disruption drives impact ratings and recovery priorities. Identifying critical business processes satisfies the stem directly: it defines the scope that all subsequent downtime tolerance and dependency analysis depends upon.

Reserving a fixed percentage of every cycle's capacity guarantees continuous remediation regardless of competing project demands, preventing debt from accumulating. Ad hoc or leftover-time approaches let remediation be deprioritised, which is why a standing allocation is most effective.

Final approval of the IT governance policy rests with the Board of Directors because governance authority originates at the top and cannot be delegated to management, which implements rather than authorises. The board's fiduciary accountability for enterprise direction makes it the only body able to confer legitimate, enforceable authority on the policy.

A Benefits Management Plan defines who owns each benefit, which metrics prove realisation, and when benefits should materialise. This satisfies the stem by specifying accountability, measurement and timing, rather than merely listing deliverables or approving the business case.

Declining to enter a high-regulatory-risk market eliminates the exposure entirely rather than reducing or transferring it, which is precisely what avoidance demands. No residual risk remains because the activity never commences, satisfying the stem's requirement for a genuine avoidance response rather than mitigation, acceptance or sharing.

Including business unit leaders in transformation decision-making embeds strategic alignment into governance, since those leaders own the business outcomes the transformation must serve. Their participation ensures investment, prioritisation and design decisions reflect corporate strategy rather than technology-driven agendas, directly satisfying the requirement that transformation supports business strategy.

A heat map maps each top risk against the business value drivers it threatens, letting the board see likelihood and impact in business terms rather than technical detail. This directly satisfies the stem's demand for the most value when reporting IT risk to the board.

Third-party risk governance requires due diligence proportionate to the sensitivity of the data and the criticality of the service. Because loyalty and sales data flow to a multi-tenant platform and onward to a subprocessor, the assessment must cover the subcontractor's controls, data handling and residency, breach notification, right-to-audit, and liability terms. The resulting residual risk is then documented and formally accepted by the accountable risk owner before signature.

Prioritisation ranks competing investment proposals against strategic criteria, ensuring scarce capital flows to highest-value initiatives. Without it, the governance process cannot consistently select or sequence investments, so it is required for effective IT investment governance.

A flexible resource model lets non-core, variable IT activities scale up or down using contractors, partners or shared services rather than permanent staff. This satisfies the optimisation goal by aligning cost and capacity with actual demand, avoiding idle permanent headcount.

Treatment selection is only meaningful when measured against the appetite and tolerance the board has set, because those thresholds define how much exposure the enterprise is willing to carry. Aligning treatment to appetite ensures resources target exposures that exceed tolerance, while exposures within tolerance can be formally accepted. Naming a risk owner preserves accountability for the acceptance decision and for monitoring whether the exposure changes over time.

Persistent divergence between funded IT projects and stated business strategic objectives signals that investment decisions are not driven by enterprise priorities. It directly evidences ineffective resource allocation, because budget and effort flow to work that delivers no strategic value.

A maturity model provides a defined scale of capability levels, so assessing current practise against it fixes an objective baseline. Repeating that assessment later reveals measurable movement between levels, which is how the organisation evidences improvement rather than merely asserting it.

A CASB discovers unsanctioned cloud usage and enforces policy across those sessions, directly addressing shadow IT's root cause: uncontrolled adoption. By brokering access, it converts ungoverned tools into monitored, compliant alternatives, satisfying the stem's requirement to optimise resources through governance rather than outright prohibition.

The framework establishes decision rights, structures and processes that connect IT strategy to business strategy, ensuring investments deliver value and risk is managed. This satisfies the stem's primary-role constraint by making alignment and value delivery the framework's core purpose.

Linking benefits to strategic objectives ensures the investment advances enterprise goals rather than isolated interests, and assigning an accountable business owner creates responsibility for realization after the project closes. Without this linkage, the business case cannot demonstrate strategic contribution, and benefits risk being orphaned once the delivery team disbands.

The project manager owns delivery of the technical output within scope, time and budget, whereas the benefits owner owns realisation of the business outcome after handover. This separates build accountability from the accountability for value actually materialising.

A global investment committee with delegated authority ensures that major resource decisions are aligned with enterprise strategy and consistent across regions. It provides a single point of accountability for high-value allocations while allowing local flexibility below the threshold. This mechanism is effective because it balances central oversight with operational autonomy and ensures that strategic priorities drive funding decisions.

The gap exists because 'improved customer experience' was never expressed as a measurable benefit with a baseline and target. Requiring the sponsor to define quantified metrics and baselines before releasing further funding restores governance control and makes later benefits tracking possible, which is the core discipline of benefits realization.

Performance dashboards present governance metrics, KPIs and trend data in a consolidated, recurring format, giving the board and executives continuous visibility of compliance against agreed targets. This satisfies the monitoring requirement by enabling timely detection of deviations rather than relying on retrospective review.

A curated internal repository lets developers self-serve approved components quickly while governance enforces scanning, version control and provenance. It optimizes developer time, reduces unmaintained library risk and provides auditable evidence of due care, which directly addresses both the security incidents and the speed complaint within an IT resource governance mandate.

Halting funding while the system remains business-critical demands assessing which departmental processes depend on it and how they would be sustained. An impact analysis identifies affected services and risks, and the migration strategy defines how those capabilities transfer to a funded replacement, satisfying the governance committee's need for a controlled transition.

A benefits register is the governance instrument that makes each benefit explicit and testable by pairing it with an accountable owner, a baseline, a target, and an agreed measurement method. For the board, this converts vague program promises into trackable commitments that can be reviewed at each stage gate, so value delivery can be judged objectively rather than inferred from activity or spend.

Cost overrun of 20% breaches the contingency threshold, so the benefits owner must reassess whether forecast benefits still justify revised costs. Re-evaluating the business case tests continued ROI validity against the new baseline, satisfying the stem's demand for immediate action before further funding or scope decisions.

Treating the benefit as contingent preserves its value while being transparent about the condition. Documenting the dependency and assigning an owner makes the risk manageable, and reassessing at the next stage gate aligns review with decision points. This is the balanced governance response when a benefit is achievable but gated by an external event.

The approved plan holds the pre-agreed baselines, measures, and targets, so comparing actuals against it prevents hindsight bias and moving goalposts. This gives the review an objective reference point and shows whether variance is due to performance, changed assumptions, or flawed estimates, which is essential for credible conclusions and for learning that improves future business cases.

A framework with mandatory enterprise principles preserves consistency and board-level oversight, while a defined process for local assessment accommodates jurisdictional differences. This balances the risk committee's concern with the CIO's goal of simplification. It also creates evidence that local requirements were evaluated, which supports compliance and governance reporting.

Governance integration requires a stated boundary for acceptable exposure. Defining risk appetite, quantitatively or qualitatively, gives the board a benchmark against which opportunities and threats are evaluated, aligning risk decisions with strategy rather than leaving tolerance implicit.

Outputs are tangible deliverables produced by the initiative, whereas outcomes are the measurable business results those deliverables enable. The automated reporting tool is the output; the reduction in manual data entry time is the outcome, which is the axis value-based management tracks.

A shared risk taxonomy gives IT and ERM identical language, categories and scoring scales, so IT risk registers aggregate directly into enterprise reporting rather than sitting in a parallel silo. This satisfies the requirement that IT risk be treated as a component of enterprise risk.

Process automation lowers recurring costs such as labour, licensing and error remediation, producing a measurable reduction in annual operating expenditure. That is a financial benefit because it improves the cost line of the business case, unlike revenue enablement or risk avoidance, which are classified separately.

A cloud-first policy shifts spend to consumption-based models, so governance must coordinate adoption, architecture and cost control across business units. A CCoE provides that central oversight, embedding best practices and guardrails while resources are allocated, directly satisfying the governance focus the stem demands.

A governance policy establishes the mandatory principles, decision rights and accountability structure that authorise oversight across the enterprise. It is the foundational instrument defining who governs, what they govern and the rules binding IT decisions, thereby enabling the committee to exercise legitimate authority.

Percentage-of-goal reporting normalises results, so a high percentage on a small base can mask large absolute shortfalls and unrecovered costs. This satisfies the stem's risk by concealing the underlying monetary values and total investment needed to judge whether benefits were genuinely realised.

Explicitly documented decision rights are a core governance mechanism because they remove ambiguity about who owns which decisions. By mapping accountability for categories such as architecture, investment, and risk, the enterprise can hold named roles responsible and resolve escalation disputes. This directly satisfies the request to make accountability explicit and enforceable, and it underpins all other governance controls by establishing clear ownership.

Executive management translates board-defined governance policies into operational directives, allocating resources and assigning accountability across business units. This satisfies the stem's implementation constraint: the board sets direction, while executives own execution, bridging strategic intent and day-to-day practise through management structures and delegated authority.

Governance is fundamentally about decision rights, accountability, and enabling mechanisms. Creating a governing body with explicit mandates, aligned processes, and shared metrics directly addresses the fragmentation described. It provides the authority structure through which budget, architecture, and intake decisions can later be harmonized. This is the foundational step that makes all subsequent integration activities coherent and enforceable across the merged entities.

Consolidation concentrates risk, so governance must confirm the target facility can sustain the recovery time and recovery point objectives each service requires. Defining these objectives per service and validating them against the new infrastructure keeps the migration aligned with business continuity commitments rather than assuming a single site can serve every workload's tolerance for downtime.

Updating governance policies and risk thresholds extends existing oversight to AI-specific exposures such as bias, opacity and model drift. This satisfies the stem's requirement for how governance should oversee the risk introduced by integrating new AI technology, rather than relying on legacy thresholds.

Strategic workforce planning starts with understanding the business strategy and its implications for IT. This analysis defines the capabilities required to support expansion into emerging markets, which then drives decisions about hiring, training, and sourcing. It ensures that workforce actions are directly linked to strategic objectives rather than being reactive or ad hoc.

Treating both successes and failures as learning inputs lets the organisation refine benefit forecasts and interventions rather than repeating errors. This adaptive feedback loop is essential to a benefits realisation culture, which depends on continuous improvement rather than blame.

The current acceptance of a high-likelihood, high-impact risk exceeds the low risk appetite for data breaches. The CGEIT practitioner should recommend re-evaluating the response, likely mitigating through controls or avoiding the risk by discontinuing the vulnerable process. This ensures alignment with the board-approved risk appetite and protects the organization from unacceptable loss.

Risk appetite sets the boundaries for acceptable IT risk exposure, directly shaping how much risk governance tolerates in investment, sourcing and control decisions. It is a key input because governance strategy must align with the enterprise's stated willingness to accept risk.

An IT value framework translates strategy into investment decisions by linking each spend to enterprise objectives, so benefits are measurable and prioritisation is defensible. This directly satisfies the stem's alignment constraint, ensuring IT delivers strategic outcomes rather than isolated technical capability.

This is the correct action because a CMP provides the governance capabilities needed to optimize resource utilization in a hybrid cloud. It offers centralized visibility into all cloud resources, enables cost tracking and chargeback, and enforces policies automatically. This allows the committee to monitor usage, identify duplication, and ensure efficient resource consumption without stifling business agility.

The risk appetite explicitly prohibits breaches over 10,000 records, so unencrypted data in a third-party cloud is a clear violation. The CGEIT professional should ensure the project aligns with appetite by mandating controls that reduce the risk to acceptable levels. Redesigning to add encryption is a direct mitigation, and updating the risk register documents the treatment. This is the first step before escalation.

The business case articulates the expected benefits, costs and outcomes that justified the investment, so it supplies the criteria against which project success is judged. It is the primary reference for confirming whether delivered results match the intended value.

When the audit committee does not receive IT risk reporting, the governing body cannot exercise oversight or challenge management's risk decisions. The governance policy assigned this responsibility to the audit committee, so the gap directly impairs board oversight. This is the most likely consequence because it affects the governing body's ability to fulfill its defined role.

The register reports implementation progress while the actual outcome, reduced fuel spend, has not materialized. Treating delivery milestones as evidence of benefit conflates output with outcome, allowing a failing benefit to remain 'on track.' Governance requires the register to reflect measurable business results and to escalate when leading indicators, such as fuel consumption per kilometer, do not move.

For an insurer, data residency is frequently a legal and regulatory requirement, not merely a preference. Governance must evaluate whether the proposal complies with applicable laws and stays within the board-approved risk appetite. If the provider cannot guarantee residency, the committee cannot approve the migration as proposed, regardless of cost or technical benefits, because noncompliance would expose the enterprise to regulatory sanction and reputational harm.

Re-evaluating the Benefits Realization Plan against realised operational performance data directly addresses the variance's root cause by comparing forecast benefit assumptions with actual measured outcomes. This satisfies the stem's requirement to diagnose why projected ROI diverged, enabling corrective action rather than merely reporting the shortfall or adjusting baselines without evidence.

A cross-regional council provides a governance forum to balance utilization and service levels across regions. By reviewing both utilization and service level data, it can make informed reallocation decisions that consider regional differences and business priorities, directly addressing the CIO's goal.

The board set a measurable tolerance, so governance requires evidence that the new architecture can actually meet it. An independent recoverability assessment validates the design, and recording quantified residual risk in the register gives the board a defensible basis for acceptance or rejection. This keeps risk optimization aligned with the approved appetite rather than assuming the provider's scale guarantees it.

Fragmented procurement persists because accountability for platform decisions is undefined. Defining a decision-rights model clarifies who is accountable for enterprise-level technology choices versus what remains delegated, directly linking those choices to the AI-driven strategy. This is a core IT governance mechanism and enables agility within agreed boundaries rather than replacing it with centralized control. Architecture review and procurement controls can then operate within that model.

Benefits realisation continues after delivery, so the governance board tracks whether projected benefits actually materialise and intervenes when they diverge from plan. Monitoring realisation and authorising corrective action satisfies the board's portfolio-level accountability for value.

Dependency and data flow mapping prevents premature shutdowns that disrupt business services and force costly rollbacks. By sequencing retirements correctly, the enterprise frees infrastructure, licenses and support effort at the right time, which is a direct resource optimization outcome of governed decommissioning rather than an uncoordinated removal of systems.

Regular system backups reduce the impact of data loss or corruption by enabling restoration, which is mitigation rather than avoidance, transfer or acceptance. This satisfies the definition by lowering residual impact after an incident occurs.

A multi-cloud architecture with explicit workload placement policies directly addresses the board's cost mandate while mitigating concentration risk and enforcing data residency. It allows workloads to be placed where they are most cost-effective and compliant, and it prevents a single provider outage or policy change from disrupting all services. This approach operationalizes governance requirements as enforceable placement rules rather than relying on informal practices.

Independent internal audit provides objective assurance by examining controls and reporting findings directly to the board or audit committee, outside management's reporting line. This satisfies the stem's monitoring requirement through detached verification rather than self-reported data, giving governance unbiased evidence of performance and compliance.

Embedding risk assessment and response into each phase ensures that risks are identified, evaluated, and managed continuously as the project evolves. This allows for timely adjustments to design, controls, and scope, optimizing the risk-return balance. It also aligns with governance principles by making risk management an integral part of project decision-making, not an afterthought. This is the primary consideration for risk optimization.

Decentralisation pushes decision rights to business units, so governance cannot prescribe every choice centrally. Defining common standards preserves enterprise-wide alignment and risk control, while permitting local flexibility lets units respond to their own contexts. This balance satisfies the stem's shift from centralised to decentralised IT structure.

Without a defined governance framework, no clear accountability, decision rights or risk criteria exist for emerging technology investment, so resource allocation becomes ad hoc and misaligned with strategic objectives. This absence directly creates the governance challenge described.

Value optimisation means selecting and rebalancing the investment mix so that constrained money, people and time deliver the greatest aggregate business outcome. It is not maximising spend or minimising cost, but trading off competing initiatives against finite resources to optimise portfolio contribution.

Strategic alignment is one of the recognised primary pillars of IT governance, alongside value delivery, risk management and resource management. It addresses how IT plans and operations connect to enterprise objectives, making it a foundational governance domain rather than a supporting practise or maturity attribute.

Agile teams persist across releases, so funding stable product teams replaces allocating resources to temporary projects. This satisfies the resource governance implication of the shift, aligning budgeting, capacity planning and accountability with enduring product ownership rather than finite project lifecycles.

ROSI quantifies mitigation cost against monetary risk reduction, expressing the benefit as a ratio or net value. This directly satisfies the stem's trade-off between mitigation cost and business benefit, unlike purely qualitative frameworks that rank risk without financial comparison.

This is the foundational step because it translates the expansion strategy into governance objectives that then drive decision rights, risk thresholds, and measurement. Only after this mapping exists can the CIO design or adjust structures, processes, and reporting so IT investment and risk decisions trace back to the three-market expansion. It ensures governance is strategy-driven rather than technology-driven.

Linking benefits to strategic goals ensures each IT investment demonstrably advances the enterprise mission and competitive position, rather than delivering isolated local gains. This alignment lets governance bodies prioritise and justify spending by tracing realised value directly to stated strategic objectives.

Investment cost captures the total cost of ownership, not just hardware and licences. Staff training is a direct, necessary cost of making the upgraded infrastructure operational, so excluding it would understate the denominator and overstate ROI.

The board's risk appetite is expressed as a maximum 5% annual loss of availability for the e-commerce platform. The proposed SLA's 99.5% uptime appears compliant, but SLAs often contain exclusions, vague measurement periods, and limited remedies that can mask real downtime. The practitioner should first confirm that the SLA's definitions, exclusions, and historical performance truly align with the board's tolerance. This ensures the decision is based on verified risk exposure, not just a headline percentage.

Governance frameworks must stay aligned with shifting strategy, risk, technology and regulatory obligations. Reviewing at regular intervals plus upon significant enterprise changes satisfies this, since a static framework drifts out of alignment and ceases to provide effective direction and oversight.

Embedding alignment checks into the approval workflow turns the strategy into an enforceable control rather than a statement of intent. Non-compliant purchases are intercepted before funding, and exceptions are explicitly escalated and documented, which directly closes the gap that allowed business units to procure outside the approved cloud-first direction unnoticed.

The Benefits Owner owns realisation, not just tracking. Operational, process and behavioural changes across the business are what actually convert a delivered capability into measurable benefit, so this role ensures those changes are implemented and sustained.

The correct governance response is to perform a rigorous risk assessment that quantifies the potential impact and evaluates controls such as multi-region redundancy, exit strategies, or insurance. If the residual risk can be reduced to $5 million or less, the migration may proceed within appetite. This approach respects the board's risk appetite while enabling strategic initiatives, and it provides evidence for an informed decision.

A visual dashboard mapping metrics to business objectives directly satisfies the need for stakeholders to see how IT benefits trace to strategic outcomes. Unlike static reports, it presents realisation status against the objectives stakeholders actually own, enabling informed governance decisions. This alignment of measurement to business value is what makes communication effective.