Governance OF Enterprise IT practice questions

Regular penetration testing.

Why it fails: This is a security control, not an investment governance mechanism.

A robust incident management process.

Why it fails: Incident management is an operational process, not a strategic investment governance tool.

Standardized server configurations.

Why it fails: This relates to operational consistency and cost, not overall investment ROI.

Security Support Staff

Why it fails: Security support staff execute controls and provide input, but steering committees comprise executive decision-makers who own IT investment and risk. It is tempting because security representation is valuable, and would be correct if the question asked which roles advise or report to the committee rather than sit on it.

External Custodial Services

Why it fails: External custodial services perform facilities or records custody work and hold no IT governance mandate or decision rights. It is tempting because external parties can attend steering committees as advisers, and would be the right choice if the question asked about outsourced operational service providers rather than committee membership.

Junior Software Developer

Why it fails: Junior software developers implement code and lack the organisational authority to set IT strategy or allocate funding. It is tempting because developers supply technical insight, and would be the correct choice if the question asked about delivery team roles consulted by the committee rather than its governing members.

Office paint color

Why it fails: Irrelevant.

Employee cafeteria menu

Why it fails: Irrelevant.

Maximizing individual developer freedom

Why it fails: Not a governance principle.

Outsourcing everything

Why it fails: Not a governance principle.

Hardware procurement automation

Why it fails: Procuring hardware is an operational IT management activity, not one of the governance domains covering strategic alignment, value delivery, risk and resource management. It is tempting because asset lifecycle and cost control feed resource management, and would fit an IT operations or procurement process question.

Helpdesk ticket resolution speed

Why it fails: Ticket resolution speed is an operational service-desk metric, not a governance domain such as strategic alignment, value delivery or risk management. It is tempting because service performance informs governance reporting, and would be the right focus for an ITIL service-level management question.

Increase the frequency of IT risk assessments to quarterly.

Why it fails: More frequent assessments may improve risk identification, but they do not ensure that IT risk decisions consider the enterprise risk appetite. The gap is about alignment, not assessment cadence. Without a formal linkage to the enterprise risk appetite, even frequent assessments may continue to produce decisions that are misaligned with the board's risk tolerance.

Delegate all IT risk decisions to the enterprise risk management committee.

Why it fails: Delegating all IT risk decisions to the ERM committee may disenfranchise IT management and slow decision-making. The goal is integration, not abdication. IT management should remain accountable for IT risk within the boundaries set by the enterprise risk appetite. This action does not build the necessary alignment and could weaken IT governance.

Update the IT risk register to include all enterprise risks.

Why it fails: Expanding the IT risk register to include all enterprise risks may blur accountability and does not necessarily integrate IT risk with ERM. The core issue is alignment of IT risk decisions with the enterprise risk appetite, not the scope of the register. This action could create confusion and duplicate efforts without addressing the governance gap.

Defining the technical configuration of server clusters.

Why it fails: Server cluster configuration is an engineering task performed by technical teams under management direction. Boards set governance objectives and monitor risk and value; they would instead approve strategy and ensure assurance, not specify hardware or cluster parameters.

Managing the daily IT helpdesk ticket queue.

Why it fails: Helpdesk ticket queues are operational service management work delegated to IT staff, not board-level governance. It is tempting because boards do oversee IT outcomes, but their remit is strategic direction, risk appetite and value delivery, not day-to-day queue handling.

Focusing solely on the 'Ensure Governance Framework Setting and Maintenance' objective.

Why it fails: Focusing solely on one objective omits the other governance components and tailoring factors that keep the system responsive to change. It is tempting because that objective explicitly addresses framework maintenance, making it the right choice when the goal is establishing and sustaining the governance framework itself rather than ensuring ongoing dynamism.

Implementing all 40 governance and management objectives immediately.

Why it fails: Implementing all 40 objectives immediately ignores prioritisation based on enterprise context, so the system cannot evolve dynamically with changing needs. It is tempting because comprehensive coverage appears thorough, making it the right choice when the goal is full framework adoption rather than a dynamic, tailored governance system.

Adopting the framework exactly as published in the COBIT core publication.

Why it fails: Adopting COBIT exactly as published ignores the enterprise's specific context, so the governance system cannot adapt to changing strategy, risk or environment. It is tempting because the core publication provides an authoritative baseline, making it the right choice when a standardised reference model is needed rather than a tailored, dynamic governance system.

Daily network uptime statistics.

Why it fails: Daily uptime statistics are operational metrics reported upward, not a factor for designing governance oversight mechanisms. It is tempting because availability genuinely matters to the board, making uptime reporting the correct content for an assurance dashboard once oversight structures already exist.

Detailed software configuration standards.

Why it fails: Software configuration standards are an operational and architectural concern delegated to management, not a board-level oversight factor. It is tempting because configuration drift causes real risk, making such standards the right consideration for engineering change-control boards rather than directors setting governance direction.

Managing the procurement of software and hardware.

Why it fails: Procuring software and hardware is an operational and supply-chain activity performed by IT management under delegated authority. It appears plausible because the board approves IT investment budgets, but approving funding and strategic direction differs from executing procurement transactions, which governance structures deliberately delegate.

Developing IT policies and procedures.

Why it fails: Drafting IT policies and procedures is an executive and IT management task; the board approves governance frameworks and monitors their effectiveness rather than authoring operational documents. It tempts because policy approval sits with the board, yet writing detailed procedures requires technical and operational knowledge the board is not expected to hold.

Day-to-day management of IT operations.

Why it fails: Day-to-day IT operations belong to management and operational staff, not the board, whose remit is governance: setting direction, overseeing risk and ensuring value delivery. It is tempting because directors are ultimately accountable for IT outcomes, but that accountability is discharged through oversight and delegation, not by running systems.

Total cost of ownership (TCO) of IT assets.

Why it fails: TCO quantifies the cost of owning IT assets, so it addresses cost efficiency rather than whether investment returns correlate with business value. It is tempting because finance functions routinely produce TCO figures and boards scrutinise IT spend, and it would be the right metric when the objective is cost optimisation or comparing sourcing alternatives.

System uptime and availability percentages.

Why it fails: Uptime and availability measure operational reliability of infrastructure, not whether IT spend maps to business outcomes. It is tempting because availability reporting is readily available from monitoring tooling and reassures the board that services are stable, but it would be the right metric when the governance concern is service-level resilience rather than strategic value realisation.

IT project delivery on time and within budget.

Why it fails: On-time, on-budget delivery tracks project execution efficiency, not whether the delivered capability produced business value; a project can hit both and still yield no benefit. It is tempting because portfolio dashboards already report schedule and cost variance, and it would be correct when the governance question concerns delivery capability or project management maturity.

The potential for technical debt reduction.

Why it fails: Technical debt reduction is an internal IT efficiency gain, not evidence that the project advances business strategy or objectives. It becomes the priority when modernising legacy platforms for maintainability, rather than when justifying a high-cost transformation's strategic alignment.

The specific vendor selection process used for the software purchase.

Why it fails: Vendor selection is a procurement execution detail occurring after strategic decisions, so it cannot demonstrate alignment between the transformation and business objectives. It would be the committee's focus when awarding a contract, not when validating strategic fit.

Detailed technical architectural specifications.

Why it fails: Architectural specifications address how a solution is built, not whether it advances business strategy, so they cannot demonstrate alignment with organisational objectives. They are tempting because they feel rigorous and concrete, and would be the right focus once the committee has approved the initiative and handed design to engineering.

Require all IT departments to report directly to the Chief Risk Officer.

Why it fails: Reporting IT to the Chief Risk Officer creates a parallel risk-centric chain, bypassing existing executive and board structures rather than embedding governance within them. It appeals where risk oversight is weak, but governance integration requires aligning with current decision rights, not adding a reporting layer.

Adopt a proprietary framework developed by a third-party IT consulting firm.

Why it fails: A consultant's proprietary framework imposes an external structure rather than aligning with the enterprise's own management hierarchy, decision rights and reporting lines. It is tempting because proprietary frameworks offer ready-made maturity models and controls, and would suit an organisation lacking internal governance expertise to design its own.

Implement a parallel IT governance board independent of the executive committee.

Why it fails: A parallel board sits outside the executive committee, so governance decisions carry no executive authority and cannot embed into existing management structures. It is tempting because dedicated IT steering committees do add focus, and would suit an enterprise needing specialist oversight layered onto an already-integrated governance model.

Implement the IT Balanced Scorecard.

Why it fails: The Balanced Scorecard measures IT performance against strategic goals; it does not establish which governance objectives the enterprise should prioritise. It is tempting because it supports governance alignment and reporting, and would be a reasonable later step once objectives and design factors have been agreed, but it cannot precede that tailoring.

Adopt all 40 governance objectives immediately.

Why it fails: COBIT 2019 requires tailoring the governance system to enterprise context, so adopting all 40 objectives immediately ignores the design factors that determine which objectives matter. Full adoption is tempting as a completeness-driven approach, but the framework explicitly expects prioritisation through design factors and capability levels, not blanket implementation.

Draft new board-level IT policies.

Why it fails: Drafting board-level IT policies presupposes agreed governance objectives and design factors; producing policies first inverts COBIT 2019's tailoring sequence. Policy drafting is tempting because governance boards expect tangible artefacts, yet the framework requires prioritising objectives through design factors before any policy content can be meaningfully scoped.

To automate IT operations.

Why it fails: Automation is an operational delivery technique, not governance's purpose. A governance framework establishes decision rights, accountability and value delivery across the IT portfolio. Automation is tempting because governance frequently mandates it as a control enabler, but automating operations addresses execution efficiency, not the direction-setting and oversight role governance exists to provide.

To ensure 100% system uptime.

Why it fails: Uptime is an operational availability target delivered through resilience engineering, not governance's purpose. Governance directs IT investment, risk and value alignment with business strategy. It is tempting because availability metrics are measurable and governance bodies do review service-level reporting, but uptime is a performance outcome, not the framework's primary objective.

To minimize IT costs at all times.

Why it fails: Governance frameworks align IT with business strategy, manage risk and deliver value; cost minimisation is one possible outcome, not the primary purpose. It is tempting because cost control is a legitimate governance objective, but a framework that only cut costs would sacrifice value delivery and risk management.

Replace the existing CIO.

Why it fails: Management turnover rarely solves structural governance issues without a framework re-alignment.

Conduct an audit of all current IT projects.

Why it fails: Auditing every current IT project catalogues activity but does not realign it with corporate strategy, so drift persists. Audits suit assurance engagements, such as verifying compliance or confirming project controls, where evidence of conformance is the objective. Here the committee must first re-establish strategic direction and decision rights, not inventory existing initiatives.

Increase the IT budget to support more initiatives.

Why it fails: Increasing the IT budget funds additional initiatives without altering how alignment is monitored or enforced, so governance drift persists. Budget expansion addresses capacity constraints, and would be the right response when strategy-aligned demand outstrips funding, not when initiatives have drifted from corporate strategy.

Centralize all IT infrastructure back to on-premises.

Why it fails: Repatriating infrastructure to on-premises contradicts the hybrid cloud transition the scenario describes, so it cannot maintain oversight of cloud-hosted workloads. It is tempting because on-premises centralisation gives direct control and familiar governance; that approach would suit an organisation deliberately reversing its cloud strategy, not one adopting hybrid delivery.

Shift all responsibility for security to the cloud provider.

Why it fails: Transferring all security responsibility to the cloud provider breaches the shared responsibility model, under which the customer retains accountability for data, identities and configuration. It is tempting because providers secure the underlying infrastructure, which can look like full coverage; that model applies only to the provider's layer, leaving customer-side governance obligations intact.

Eliminate the need for internal IT policies.

Why it fails: Removing internal IT policies strips the governance framework that assigns accountability and controls for hybrid workloads, leaving oversight undefined. It is tempting because cloud providers supply their own compliance controls, which can appear to replace internal policy; however, those controls address the provider's layer only, and internal policy remains necessary to govern data, access and risk across both environments.

Governance Policy Statement.

Why it fails: A Governance Policy Statement establishes decision rights, principles and accountability structures; it does not document specific service expectations or relationship terms between IT and business units. It is tempting because governance formalises IT-business interaction, but at a policy level. The stem requires a service-level agreement specifying measurable mutual commitments.

Project Charter.

Why it fails: A Project Charter authorises a single project's scope, objectives and deliverables; it does not define ongoing IT-to-business relationships. It is tempting because it does formalise expectations, but only within one project's boundaries. The stem requires a standing service-level agreement covering continuous operational expectations between IT and business units.

IT Strategic Plan.

Why it fails: An IT Strategic Plan sets long-term direction, investment priorities and capability roadmaps; it does not formalise operational expectations or relationship terms between IT and business units. It is tempting because it aligns IT with business goals, but that alignment is directional, not contractual. The stem requires a service-level agreement documenting mutual responsibilities.

The IT Security Manager.

Why it fails: The IT Security Manager operates within management, implementing controls and reporting risk, and holds no governance authority under COBIT 2019; governance sits with the board. This is tempting because security managers influence IT decisions, but their remit is operational execution, not setting governance direction.

The Chief Information Officer (CIO).

Why it fails: The CIO is part of management, while governance is the board's responsibility.

The external auditors.

Why it fails: External auditors provide independent assurance to the board; they assess governance but hold no decision-making authority within it. This is tempting because auditors evaluate the governance structure and report findings, yet COBIT 2019 reserves authority for the board, not for independent reviewers.

The IT Steering Committee.

Why it fails: The IT Steering Committee reviews and endorses the IT governance policy, but final approval rests with the board of directors, which owns governance and delegates authority. The committee's role is advisory oversight, making it the right approver for operational IT decisions, not enterprise policy.

The Chief Technology Officer (CTO).

Why it fails: The CTO provides technology direction and input into the policy, yet approval authority for enterprise IT governance sits with the board of directors. The CTO would be the right approver for technology architecture standards or platform selection decisions, not governance policy itself.

The Chief Information Security Officer (CISO).

Why it fails: The CISO advises on security requirements within the policy and owns security standards, but lacks the enterprise-wide authority to approve governance policy. Final approval belongs to the board. The CISO would correctly approve security-specific policies and control frameworks.