ISACA Certified in the Governance of Enterprise IT (CGEIT) (CGEIT) (CGEIT) — Questions 226–300

A risk-based approach directs governance funding toward the exposures posing the greatest potential loss, so budget is prioritised for the highest-risk areas. This satisfies the stem's allocation question by tying spend to risk magnitude rather than equal distribution.

After containing and recovering from an incident, governance requires a post-incident review to understand root causes, evaluate the effectiveness of controls, and update the risk register. This step ensures lessons learned are captured and integrated into future risk management. It also provides the board with assurance that the organization is improving its risk posture. Without this review, the organization may remain vulnerable to similar attacks and miss opportunities to strengthen governance.

Metrics define how the benefit is quantified and evidenced, converting an intended outcome into something measurable. Without them the plan cannot demonstrate realisation, so specifying metrics satisfies the requirement to track whether benefits actually materialise.

The documented decision rights exist on paper, yet business unit leaders are committing IT resources outside them, which is a direct failure of the organizational structures and decision rights component. The framework has not made the assigned authority operative or respected, so commitments occur without the intended governance check.

Untracked mitigation means no documented record exists showing which risks were treated, by whom, or with what outcome. Governance therefore cannot evidence that risk management is effective, leaving the risk register unverifiable and accountability unproven.

Defined roles, responsibilities and accountability mechanisms specify who enforces each policy, who complies and what consequences follow breach. Without this assignment, policies remain aspirational statements. It satisfies the enforcement requirement by making ownership and escalation paths explicit within the governance framework.

Tag-based chargeback and showback gives governance teams granular visibility of consumption per business unit, enabling cost accountability across hybrid workloads. This directly satisfies CGEIT's requirement to optimise cloud expenditure by aligning resource allocation with measurable financial ownership rather than ad hoc provisioning.

A chartered steering committee with explicit decision rights and compliance and risk responsibilities creates a standing governance mechanism for oversight across clinical and claims systems. It provides a forum where regulatory findings, risk tolerances, and resource trade-offs are reviewed and decided. This directly addresses the board's need for assurance that governance is active rather than episodic.

Risk appetite defines the boundaries within which all IT activity must operate, so it is inherently a governance-level decision. Delegating it to management would let the supervised party set its own limits, eliminating independent constraint. Governance bodies retain this right to ensure IT risk-taking stays aligned with enterprise strategy and the board's fiduciary obligations under ISACA CGEIT principles.

Deliverables complete but benefits lagging signals an adoption or organisational change shortfall, not technical failure. Reviewing the benefits realisation plan tests whether change management, training and process adoption are progressing, which is the appropriate management response.

Automation benefits arise from displacing manual effort, so reduced manual labour hours per transaction directly quantifies the labour cost saved. It is a causal, measurable indicator of the automation benefit, unlike revenue or satisfaction measures.

Faster-than-planned benefit realisation signals that assumptions or practices are outperforming expectations. The board's governance role is to investigate the cause and, where the driver is transferable, replicate it across the portfolio to improve overall value delivery.

Comparing actual project performance against the business case provides the variance evidence a benefits-based review demands, confirming whether forecast benefits remain achievable. This satisfies the stem's requirement to critically assess benefits realisation, since deviations between projected and delivered value expose whether the investment still justifies continued funding.

A cost-benefit analysis compares the cost of implementing a risk response against the expected reduction in risk exposure. This helps select the most economically efficient response, ensuring that resources are allocated effectively. It is essential for optimizing risk, as it prevents over-spending on low-impact risks or under-spending on high-impact ones. The analysis should consider both direct and indirect costs and benefits.

When actual IT performance breaches the board-approved risk appetite, governance must act to restore alignment. Requiring a formal remediation plan with timelines and interim controls ensures the committee exercises oversight, obtains accountability, and can monitor progress. This action directly addresses the breach without usurping management's operational role, keeping governance focused on direction-setting and monitoring rather than execution.

Placing exception authority with a designated architecture authority, governed by explicit criteria and expiration dates, balances agility with control. It ensures decisions are made by a body with the expertise and objectivity to assess architectural and risk impacts, while time limits prevent exceptions from becoming permanent de facto standards. This aligns with ISACA CGEIT governance design principles.

Technology alone rarely produces benefits; the benefit arises when business processes, roles, and incentives change to exploit the new capability. If no business owner was made accountable for the inventory reduction and no replenishment or planning process was redesigned, the platform can operate flawlessly while the intended value never materializes. This is a classic benefits transition failure.

When a risk exceeds the approved appetite, governance requires escalation to the body that owns the appetite so it can decide among remediation, risk transfer, or a documented exception. This preserves accountability, keeps the decision at the right authority level, and ensures the board explicitly owns any temporary tolerance breach rather than management silently absorbing it.

Benefits realization requires measuring actual outcomes against the documented baseline and then tracing variance to the specific drivers, assumptions, and accountable owners. This diagnosis reveals whether the shortfall arose from flawed forecasting, delayed adoption, process non-compliance, or external factors, and it gives the steering committee evidence to decide on corrective action rather than guesswork.

A hybrid model matches resource commitment to workload behavior, containing cost and risk for stable systems while allowing elastic scaling for volatile channels. Pairing it with forecasting and periodic capacity review embeds governance so allocation decisions track actual demand, which is precisely how IT resource governance should respond to uncertainty at a lease boundary.

In COBIT 2019, governance means evaluating stakeholder needs and options, directing through prioritisation and decision-making, and monitoring performance and compliance against agreed direction. This evaluate-direct-monitor definition distinguishes governance from management, which plans, builds, runs and monitors activities in alignment with that direction.

Resource governance spans business units and changes how funding and prioritisation decisions are made, so executive sponsorship supplies the authority to enforce it and organisational buy-in ensures adoption. Without both, the policy stalls as a paper artefact regardless of how well it is designed.

Reporting must translate raw risk data into prioritised, decision-ready findings and directional patterns, enabling the board and risk committee to act rather than merely observe. Insights and trends satisfy the framework's purpose of supporting informed governance decisions.

When remediation is technically impossible and the activity must continue, acceptance is the appropriate response provided it is deliberate. Documenting compensating controls, obtaining executive sign-off, and establishing a replacement roadmap keeps the exposure visible and governed. This approach acknowledges residual risk while maintaining regulatory submissions, which aligns with the enterprise's obligation to operate within a defined and monitored tolerance.

Standardising hardware and software platforms reduces the variety of systems requiring separate licences, support contracts, training and maintenance, directly lowering operational expenditure. This governance practice satisfies the cost-reduction objective by consolidating the technology estate and simplifying support and procurement.

TCO is a comprehensive financial estimate that includes all costs associated with acquiring, operating, maintaining, and disposing of an asset or service over its entire lifecycle. For the data center decision, this means capturing hardware, software, facilities, power, cooling, labor, training, support contracts, and decommissioning. This holistic view enables a fair comparison between on-premises and colocation options.

Governance arbitrates competing innovation and stability demands by reference to strategic priorities, not departmental preference. This satisfies the stem's requirement for governance's role in resolving the conflict, ensuring the balance struck reflects enterprise strategy rather than either party's agenda.

Tailoring the governance system by adjusting design factors right-sizes controls to the organisation's size, culture and agile delivery model. COBIT explicitly expects this adaptation, so governance remains effective without imposing disproportionate process overhead on small teams.

Embedding Value Stream KPIs into portfolio governance directly satisfies the stem's constraint: continuous tethering of funding to realised enterprise value. Unlike project-based budgets, which release funds against milestone completion, this mechanism ties investment decisions to outcome metrics, enabling governance bodies to reallocate funding based on measured value delivery rather than planned deliverables.

Categorising investments by type lets the portfolio be balanced across innovation, growth and maintenance, preventing over-concentration in any one category. This mix management aligns spending with strategic risk appetite and ensures run-the-business obligations are funded alongside transformative initiatives, which is the primary portfolio benefit.

Enterprise-level IT risk acceptance requires authority over the whole organisation's risk appetite, which sits with the CIO or the Board rather than operational or project roles. They own the final decision to tolerate residual risk.

This is the correct action because it implements a governance-driven, phased approach to resource reallocation. It recognizes the need to balance operational stability with strategic investment. By directing the development of a revised portfolio, the committee ensures alignment with the digital transformation mandate while mitigating the risks of abrupt change, which is a key responsibility of IT governance.

This approach preserves consistent enterprise risk direction through common principles, tolerances, and reporting, while allowing regional tailoring to satisfy differing legal requirements. The committee retains a consolidated view of risk and can compare treatment across jurisdictions, achieving both local compliance and enterprise-wide consistency without forcing a single rigid control set.

Escalating a risk beyond appetite to the board preserves accountability, since only the board can sanction acceptance or mandate treatment. Formal communication plus a proposed treatment plan satisfies the stem's requirement to act when risk exceeds the enterprise's stated risk appetite.

Application portfolio rationalization systematically evaluates applications against business value, technical health, and functional overlap. It identifies redundant or low-value applications that can be retired, consolidated, or replaced. This approach directly addresses the CIO's goal by revealing overlapping functionality and resource consumption, enabling informed decisions to optimize the portfolio.

The problem is that investment decisions lacked business-case rigor and strategic linkage. Instituting a formal process that requires documented business cases and traceability to strategy directly addresses the root cause. It ensures the steering committee evaluates initiatives on value and alignment rather than technical feasibility alone. This restores the governance principle that IT investments must demonstrably support enterprise objectives and be accountable for outcomes.

Ongoing monitoring ensures that vendors continue to meet cost efficiency and compliance expectations after the contract is signed. Regulations and business needs evolve, so periodic reviews allow the provider to detect issues early and take corrective action, sustaining both objectives.

Embedding IT governance roles into existing business management functions avoids a parallel structure, so IT decisions are made within the same forums, budgets and accountability chains as business decisions. This satisfies the stem's integration requirement by making governance inseparable from routine business decision-making.

Business process owners control the operational workflows where benefits such as cost reduction or efficiency actually materialise after delivery. Assigning them accountability satisfies the stem's focus on ultimate realisation, since benefits emerge from sustained process operation rather than from the project team that built the solution.

Implementing configuration management and continuous monitoring directly addresses the risk of misconfiguration. These controls reduce the likelihood of errors and enable early detection. This aligns with the need to mitigate high risks rather than accept them. The CGEIT professional should recommend this as a necessary treatment before go-live.

When current capability exceeds the board-approved tolerance, the governance response is to present the gap and the choices: invest to meet the two-hour objective or consciously change the appetite. Escalation preserves board ownership of risk tolerance and documents the decision. This is the first step because remediation or appetite revision both require board direction before resources are committed or tolerance is relaxed.

A structured knowledge transfer program directly addresses the resource risk by reducing single-person dependency. Documentation, cross-training, and a succession timeline build organizational capability that persists beyond any individual's tenure. This aligns with IT resource governance by ensuring critical clinical services can be sustained, and it provides the committee with measurable milestones to monitor progress against the risk.

IT risk sits within the broader enterprise risk portfolio, since technology failures are one category of the risks an organisation faces. Managing them together ensures technology exposures are aggregated, prioritised and reported alongside all other business risks.

Value optimization is the portfolio-level discipline of allocating limited resources to the mix of investments that best advances enterprise strategy while managing risk. It weighs the supply-chain initiative's strategic contribution against the back-office system's continuing cost avoidance and considers risk, timing, and dependencies. This concept directly addresses the CIO-CFO tension by comparing marginal value across the whole portfolio.

A balanced scorecard connects IT objectives and metrics to enterprise goals across financial, customer, internal process, and learning perspectives, translating IT activity into business outcomes. This gives the board a line of sight from IT performance to strategic value. It directly addresses the committee's need to demonstrate contribution rather than operational activity, aligning with ISACA CGEIT performance management guidance.

Internal audit provides independent, objective assurance on control design and operating effectiveness when it reports to the board or audit committee rather than to management. This independence is exactly what the governance committee needs to verify that IT controls work as intended. It is the recognized assurance mechanism under ISACA CGEIT and professional auditing standards.

CGEIT distinguishes financial from non-financial benefits, and processing-time reduction is a legitimate non-financial benefit measured through an operational indicator such as average cycle time. Recording both categories separately preserves a complete benefits register and lets the committee weigh cash-releasing savings alongside service and capacity gains.

Improved morale and productivity is an indirect benefit because it arises as a secondary consequence of the improved user interface, not from the IT investment itself. It cannot be attributed directly to a deliverable, unlike a direct benefit such as reduced processing costs.

Boards must ensure oversight mechanisms embed regulatory and compliance obligations, since external mandates define minimum governance controls the enterprise cannot tailor away. This factor directly satisfies the stem's requirement to consider what constrains governance design, ensuring the board's oversight framework remains legally defensible and auditable.

Technical soundness does not secure adoption. Resistance arises when the benefits realisation plan omits change management and stakeholder engagement, leaving affected business units uninvolved, unconvinced of the value, and unprepared for new ways of working.

Defining measurable business outcomes at inception establishes the baseline against which benefit realisation is later assessed. Without this, the investment lacks agreed success criteria, making it impossible to determine whether promised value was actually delivered or to intervene when outcomes drift.

Demand management links business forecasts to capacity planning, giving the steering committee a governance forum to approve or adjust resource commitments based on business priorities. This ensures capacity decisions reflect demand rather than infrastructure team preferences, directly satisfying the CIO's objective.

Gating new acquisitions through a standardized business case and architecture review prevents further portfolio sprawl and embeds governance into the intake process. It ensures each new application is justified against existing capabilities and enterprise architecture standards. Combined with an inventory, this creates a repeatable control loop: the inventory informs rationalization, and the intake gate prevents recurrence of the problem.

Hybrid cloud splits control between the enterprise and providers, so policy must define shared responsibility boundaries and cloud-specific controls. This satisfies the stem's oversight requirement because existing on-premises policies cannot address provider-managed layers, leaving accountability gaps that undermine governance.

Business value and contribution to organisational goals are the criteria that tie investment decisions to enterprise strategy. For a high-cost transformation, the committee must judge the business case against strategic objectives, not technical elegance or cost alone, ensuring the spend advances the organisation's stated direction.

The Board of Directors holds ultimate accountability for enterprise governance of IT, setting direction and overseeing value delivery. This satisfies the stem's accountability constraint because boards own governance outright, whereas executives and IT managers only execute delegated responsibilities.

Without an agreed baseline, the claimed $2.4M cannot be verified, attributed, or later measured. Establishing current duplicate-test volumes and their unit costs gives the committee an auditable starting point against which post-implementation results can be compared, and it exposes whether the savings are genuinely incremental or merely shifted between cost centers.

IT resource management optimises how IT assets, people and budgets are allocated and used, ensuring they align with and support business objectives. This allocation-and-use focus is the mechanism the stem requires, distinguishing it from risk or performance management within IT governance.

Risk governance exists to ensure risk management activities produce value aligned with enterprise objectives, not merely to produce reports. This objective satisfies the stem's focus on governance outcomes, confirming that processes are effective, resourced and integrated with strategic decision-making rather than performed as compliance theatre.

Evaluating benefit realisation risk tests whether forecast value survives realistic conditions such as capability gaps, adoption rates or market shifts. Feasibility therefore rests on achievable value, not theoretical projections, preventing approval of business cases whose returns cannot materialise.

A benefit can only be realized where the change actually occurs, so the accountable owner must sit in the business function that controls the affected process. Without that authority, the owner cannot enforce adoption, adjust operations, or remove obstacles. Naming a business owner with real process control converts a benefit from an aspiration into a managed outcome with a single point of accountability.

An SLA formalises IT-to-business expectations by defining measurable service targets, responsibilities and escalation paths for specific services. It satisfies the stem's requirement to document the relationship between IT and business units, translating business needs into agreed, reviewable performance commitments rather than informal arrangements.

Development-phase salaries are a direct, attributable cost of building the solution, so they belong in TCO alongside acquisition and ongoing running costs. Omitting internal labour understates true ownership cost and distorts comparison between build, buy or cloud alternatives.

Value delivery begins when the capability is actually used to produce outcomes, not when it is accepted or deployed. Business operations executing new processes with the system confirms the transition from project output to operational benefit realisation.

Providing visibility into the IT inventory directly satisfies governance's need for an accurate, current record of resources. This underpins optimisation decisions and demonstrates compliance with licensing, security and regulatory obligations. Asset management's core output is that authoritative inventory view, enabling informed IT resource governance across the organisation.

Benefits realisation depends on the affected business processes and roles actually changing, so the plan failed to address business change management and process alignment. Delivering the system alone leaves the outdated manual process intact, preventing the projected value from being realised.

A gap analysis exposes differences in decision rights, committees and processes between the merging entities, then a unified framework reconciles them. This satisfies the merger scenario by producing one coherent governance structure rather than duplicated or conflicting oversight.

A central oversight committee ensures that risk acceptances that exceed appetite are reviewed at the enterprise level. This provides a check on regional decisions and promotes consistency. It also allows the board to delegate authority while maintaining control. This is a key governance mechanism to align decentralized risk-taking with enterprise appetite.

Benefits realization depends on accountable ownership and complementary business process change, not just technology delivery. With high adoption but no benefit, the likely cause is that no one owns the outcome or that downstream processes such as inventory replenishment rules were never redesigned. Confirming ownership and process change first targets the most probable root cause before other diagnostics.

Executive management translates board direction into funded, resourced IT initiatives and owns operational accountability for risk and performance. Without their sponsorship, governance decisions lack enforcement authority, so they are essential alongside the board in the stem's governance model.

The primary governance basis is whether the risk of keeping the legacy system falls within the board-approved risk appetite. If the risk of failure exceeds tolerance, replacement is necessary regardless of cost. This ensures IT decisions are driven by risk-return trade-offs and strategic objectives, not solely by financial or technical arguments. The CGEIT practitioner should facilitate this alignment.

A risk register reviewed at milestones provides a structured way to track and manage risks over time. It ensures that risks are revisited and updated as the project progresses. This practice supports risk optimization by maintaining visibility and enabling timely decisions. It also facilitates communication with stakeholders and governance bodies.

Reputational harm from cyber threats is fundamentally a risk-tolerance question. Reviewing whether the stated risk appetite matches the brand resilience strategy confirms the board's willingness to accept risk aligns with protecting brand value, directly addressing the governance committee's remit over reputation exposure.

Using assessment ratings to sequence investment and gate the launch shows risk outputs directly shaping decisions and timelines. The highest-rated risks receive resources first, and remediation becomes a condition of go-live rather than an afterthought. This linkage between assessment and allocation is the essence of risk optimization because it converts analysis into prioritized action within the approved appetite.

Mapping interdependencies and data flows exposes which legacy components still feed live services, so retirement sequencing avoids breaking dependent systems. This directly satisfies resource optimisation: effort concentrates on genuinely isolated systems first, preventing costly rollback or parallel running. Without this visibility, decommissioning risks outages that consume far more resources than the original consolidation saved.