ISACA Certified in the Governance of Enterprise IT (CGEIT) (CGEIT) (CGEIT) — Questions 301–337

A formal decision-making process with escalation paths ensures that IT decisions are made consistently, transparently, and at the appropriate level. It prevents bottlenecks and ensures that strategic decisions are escalated to the governance body, enabling effective oversight and accountability.

Naming each benefit and assigning a named owner creates accountability for delivery, preventing vague aspirations from entering the plan. This satisfies the BRP requirement that benefits be explicitly identified and owned, enabling tracking and intervention when realisation drifts.

When a risk is projected to exceed the board-approved risk appetite, the governance practitioner must escalate the matter with a clear analysis of the exposure, potential impact, and viable response alternatives. This ensures the board retains oversight and can make an informed decision on whether to accept, mitigate, transfer, or avoid the risk. It preserves the link between risk appetite and risk response.

Regular performance reviews against agreed metrics provide objective evidence of efficiency and effectiveness, and reporting to the board gives the necessary oversight. This directly answers the board's request for assurance by establishing a feedback loop between resource usage and governance expectations.

The board is the ultimate owner of risk appetite. Since the CIO proposes a change that alters the enterprise's tolerance, the governance process requires board approval. Escalating ensures alignment with strategic objectives and maintains governance integrity. This step respects the board's authority and ensures that any revision is formally documented and communicated, preventing unauthorized risk-taking.

A phased implementation with enhanced monitoring and a rollback plan balances the pursuit of innovation with risk management. It allows the company to realize competitive advantages while containing potential stability issues within acceptable limits. This approach aligns with a moderate risk appetite by taking calculated risks and having contingencies in place. It demonstrates governance that supports innovation without exposing the enterprise to unacceptable disruption.

This is the most effective way because it directly assesses whether IT investments are delivering the intended business outcomes, such as increased revenue, cost savings, or improved customer satisfaction. It ties IT performance to business value, which is the core of value delivery governance.

A dynamic risk monitoring process with horizon scanning and defined triggers allows the organization to detect regulatory changes early and reassess risks promptly. This ensures the risk management process remains responsive and effective in a volatile environment. It aligns with the principle of continuous risk assessment and enables proactive adaptation rather than reactive crisis management, which is critical when regulatory uncertainty is high.

This is the correct answer because a formal IT asset management policy is a foundational governance mechanism. It establishes the rules, accountability, and processes for managing assets from acquisition to disposal, ensuring compliance with legal and regulatory requirements. The policy is the authoritative document that governs behavior and decision-making, and it can be supported by tools like a CMDB.

A governance framework supplies the decision rights, structures and processes that direct IT investment towards value delivery while embedding risk management. This directly satisfies the stem's requirement for a structured approach, since it coordinates accountability across the enterprise rather than merely documenting controls or measuring performance.

Benefits realization extends beyond program closure. Transferring each benefit to an accountable operational owner, with an agreed measurement method and reporting cadence, ensures the value claim continues to be tested in business as usual. This is the essential closure action that prevents benefits from being orphaned when the program team disbands.

Customer satisfaction and Net Promoter Score capture perceived value delivered to users, complementing financial and operational measures of an IT investment. This satisfies the stem by providing a stakeholder-facing metric that indicates whether the investment achieved its intended business outcomes.

Percentage of IT initiatives directly contributing to documented business strategy goals measures strategic alignment itself, evidencing that investment correlates with business value. Financial or operational metrics alone cannot demonstrate that linkage, which is the board's stated concern.

The charter formally establishes the committee and defines its mandate, authority limits and reporting responsibilities. This satisfies the stem because governance bodies derive their legitimacy and decision rights from this document, not from meeting minutes or terms of reference held elsewhere.

Mandatory training gives every employee shared vocabulary and awareness of IT risk responsibilities, embedding risk thinking across all roles rather than confining it to specialists. This directly satisfies the stem's cultural integration goal by making risk consideration routine behaviour organisation-wide.

Aligning the IT risk taxonomy and reporting thresholds with the corporate ERM framework directly satisfies the integration requirement by ensuring IT risks are expressed in the same language, scales and escalation criteria as enterprise risks. This shared taxonomy lets ERM committees aggregate, compare and govern IT exposure alongside other business risks, rather than treating it as a separate silo.

A federated governance structure pairs centralised policy definition with delegated execution, letting business units retain day-to-day operational agility while Microsoft Entra ID-style central oversight enforces consistent standards. This directly resolves the stem's fragmented governance constraint: authority for policy stays central, yet decision-making rights remain distributed, restoring enterprise-wide oversight without recentralising IT operations.

A merger changes organizational scale, reporting lines, and risk profile, so the original governance design may no longer fit. Re-evaluating decision rights, committee structures, and escalation paths ensures the framework remains proportionate and workable. This is a foundational effectiveness check because even well-designed governance can fail when the enterprise it governs has materially changed in size or complexity.

Defined KPIs and metrics provide quantifiable evidence that IT resources deliver value and meet performance expectations, satisfying the governance requirement for measurable accountability. Without such measures, resource usage cannot be objectively evaluated, so this element directly supports the oversight and monitoring mandate central to a strong IT resource governance policy.

Reporting and escalation procedures satisfy the policy's requirement for defined accountability channels, ensuring identified risks reach the appropriate decision-makers with authority to act. Without explicit escalation paths, risk governance collapses into undocumented local handling, so this element is essential for the policy to function.

A Key Risk Indicator provides forward-looking, quantifiable metrics that signal rising risk exposure before incidents occur, satisfying the stem's requirement for a primary purpose. Unlike lagging indicators, which report past events, KRIs enable pre-emptive governance action by tracking risk drivers against defined thresholds, giving management timely warning of potential risk events.

A portfolio review rebalances investment across the whole IT portfolio, explicitly shifting capacity from run-the-business support to strategic initiatives. This directly addresses the resource starvation in the stem by reallocating constrained resources rather than adding governance layers or deferring projects.

The failure is that self-reported status is not tied to objective evidence and no one independently checks it. Requiring source-system extracts and independent sampling validation removes the ability to report green without supporting data and creates a credible deterrent, directly improving the reliability of benefits reporting while keeping owners accountable for the metrics.

Inadequate alignment between IT risk management and business value objectives directly addresses the governance gap: risk decisions are made without reference to the value the project was meant to deliver. CGEIT frames governance as ensuring IT investments realise benefits while managing risk, so misaligned risk and value objectives is the root failure producing the value shortfall.

Disbenefit analysis quantifies negative outcomes alongside benefits, satisfying the business case's need for balanced, evidence-based justification. Rather than presenting only upside, it exposes costs, risks and adverse impacts, giving decision-makers the transparent, realistic impact view the stem demands. This supports informed investment approval and later benefit-realisation tracking.

An Architecture Review Board provides cross-functional oversight of technology decisions, ensuring solutions align with enterprise architecture principles and strategic objectives. It satisfies the governance requirement for structured decision-making authority, distinct from operational management bodies. This formal review mechanism enforces standards and accountability across projects, which is characteristic of IT governance structures rather than day-to-day delivery functions.

This is the correct first step because it directly addresses the root causes by creating a structured, forward-looking approach to workforce planning. An IT workforce plan linked to the strategic roadmap ensures that the enterprise architect role has a defined career path and that training investments are prioritized based on future needs, thereby improving retention and capability.

Governance drift stems from misalignment between business strategy and IT design factors, so the committee must first review both to re-establish the linkage. Only after understanding current strategic priorities and how IT is designed to support them can realignment actions, such as revised decision rights or investment criteria, be correctly targeted.

Operational risks cover the day-to-day delivery of IT services, so governance must oversee them to protect service continuity and efficiency. This satisfies the stem's requirement for a distinct risk category spanning the three governance domains of operational, compliance and strategic risk.

Design factors capture the enterprise's context, goals, risk profile and technology landscape, and COBIT 2019 uses them to determine which governance and management objectives matter most. Assessing them first gives the board an evidence-based priority ranking rather than an arbitrary selection.

A strategic alignment review compares IT capabilities against business needs, exposing the specific gaps causing benefits shortfalls. This satisfies the stem's requirement for the most effective remediation, since misalignment, not delivery failure, is the root cause of unrealised business benefits.

Unique named accounts with logging and just-in-time elevation restore individual accountability and least privilege over a critical IT resource, which is the root control gap the audit identified. It enables investigation and reduces standing privileged exposure, making it the correct first governance action before layering further controls.

The enterprise risk register consolidates identified IT and business risks with their assessed likelihood, impact, owners and treatment status, giving the board an aggregated view of the current risk posture. It is the authoritative primary source for that summary.

The Benefits Dependency Map explicitly links enablers, IT-enabled changes, business changes and outcomes to strategic objectives, documenting causality. This satisfies the stem's requirement for the artifact evidencing the causal link between IT-enabled outcomes and organisational strategy under a benefits-led approach.

When the board sets a low tolerance for clinical availability risk, responses that reduce that exposure must be resourced in line with that tolerance rather than deferred by budget convenience. Aligning response timing and funding with appetite is a core governance principle because it ensures the enterprise operates within the boundaries the board defined, especially when patient safety is involved.

The Benefit Dependency Network maps how enablers, changes and outcomes interconnect, so tracing it pinpoints precisely where the output-to-outcome linkage broke down. This satisfies the stem's requirement for an initial diagnostic step before committing to corrective action or revised business cases.

Addressing shadow IT's root cause and supplying sanctioned, secure alternatives removes the incentive driving unsanctioned usage. This satisfies the stem's requirement for the most effective strategy, since blocking alone leaves the underlying business need unmet and shadow IT persists.