Governance OF Enterprise IT practice questions

Defining the technical configuration of server clusters.

Why wrong: This is purely technical and below the board level.

Managing the daily IT helpdesk ticket queue.

Why wrong: This is an operational responsibility.

Focusing solely on the 'Ensure Governance Framework Setting and Maintenance' objective.

Why wrong: Governance requires an integrated approach across all domains, not just one objective.

Implementing all 40 governance and management objectives immediately.

Why wrong: This approach is rigid and ignores the design factor of enterprise size and complexity.

Adopting the framework exactly as published in the COBIT core publication.

Why wrong: The core publication is a framework for tailoring, not a one-size-fits-all solution.

Daily network uptime statistics.

Why wrong: Operational metrics are for management, not the board.

Detailed software configuration standards.

Why wrong: This is an operational responsibility, not a board-level oversight task.

Managing the procurement of software and hardware.

Why wrong: This is an operational management responsibility.

Developing IT policies and procedures.

Why wrong: This is typically a management function done under the direction of the board.

Day-to-day management of IT operations.

Why wrong: This is the responsibility of IT management, not the board.

Total cost of ownership (TCO) of IT assets.

Why wrong: TCO measures cost reduction, not necessarily strategic value alignment.

System uptime and availability percentages.

Why wrong: This is an operational KPI, which is secondary to strategic alignment.

IT project delivery on time and within budget.

Why wrong: This measures efficiency, not strategic alignment or business value.

The potential for technical debt reduction.

Why wrong: While important, it is not the primary driver for strategic alignment.

The specific vendor selection process used for the software purchase.

Why wrong: Vendor selection is an operational detail, not a strategic governance concern.

Detailed technical architectural specifications.

Why wrong: Technical details are secondary to strategic alignment at the steering committee level.

Require all IT departments to report directly to the Chief Risk Officer.

Why wrong: Reporting lines should support business alignment, not just risk management.

Adopt a proprietary framework developed by a third-party IT consulting firm.

Why wrong: Proprietary frameworks often lack the flexibility and broad acceptance of established frameworks.

Implement a parallel IT governance board independent of the executive committee.

Why wrong: Parallel structures often lead to silos and lack of executive buy-in.

Implement the IT Balanced Scorecard.

Why wrong: This is a performance measurement tool, not the initial setup step.

Adopt all 40 governance objectives immediately.

Why wrong: This is impractical and ignores enterprise context.

Draft new board-level IT policies.

Why wrong: Policies should follow the governance system design.

To automate IT operations.

Why wrong: This is a management task, not a governance goal.

To ensure 100% system uptime.

Why wrong: This is an operational availability goal, not a governance framework goal.

To minimize IT costs at all times.

Why wrong: Governance is about value optimization, not just cost minimization.

Replace the existing CIO.

Why wrong: Management turnover rarely solves structural governance issues without a framework re-alignment.

Conduct an audit of all current IT projects.

Why wrong: This identifies the symptoms but not the root cause of the alignment failure.

Increase the IT budget to support more initiatives.

Why wrong: Increasing budget without strategic alignment will only exacerbate the drift.

Centralize all IT infrastructure back to on-premises.

Why wrong: This is a technological choice, not a governance policy update.

Shift all responsibility for security to the cloud provider.

Why wrong: Governance requires oversight, even when outsourcing or using cloud services.

Eliminate the need for internal IT policies.

Why wrong: Internal policies are still required to govern the usage of cloud resources.

Governance Policy Statement.

Why wrong: This describes the framework, not the specific service obligations.

Project Charter.

Why wrong: This is specific to a project, not the ongoing relationship for services.

IT Strategic Plan.

Why wrong: This is a long-term roadmap, not an operational agreement.

The IT Security Manager.

Why wrong: Security management is an operational function, not a governance decision-making body.

The Chief Information Officer (CIO).

Why wrong: The CIO is part of management, while governance is the board's responsibility.

The external auditors.

Why wrong: Auditors provide assurance, they do not make governance decisions.

Regular penetration testing.

Why wrong: This is a security control, not an investment governance mechanism.

A robust incident management process.

Why wrong: Incident management is an operational process, not a strategic investment governance tool.

Standardized server configurations.

Why wrong: This relates to operational consistency and cost, not overall investment ROI.

The IT Steering Committee.

Why wrong: They propose and manage the framework, but the board holds final accountability.

The Chief Technology Officer (CTO).

Why wrong: The CTO is an operational leader, not the governing authority.

The Chief Information Security Officer (CISO).

Why wrong: The CISO operates within the governance framework, they do not approve it.

Standardize all processes across the company.

Why wrong: This would likely increase the burden rather than reduce it.

Ignore the framework until the company grows.

Why wrong: Governance must be present at all stages of growth; it just needs to be scaled.

Appoint more auditors to monitor compliance.

Why wrong: This adds overhead without solving the structural issues of the framework.

IT cost as a percentage of revenue is minimized.

Why wrong: Cost minimization is not the primary measure of alignment.

The IT department is fully staffed.

Why wrong: Resource levels do not reflect strategic alignment.

IT projects are completed on time.

Why wrong: This is an operational measure, not a strategic one.

It must be composed only of technical experts.

Why wrong: Technical focus without business alignment defeats the purpose of the committee.

It must be chaired by the CIO.

Why wrong: It is often better for a business leader to chair to ensure business-first focus.

It must meet at least once a week.

Why wrong: Frequency depends on the organization, but meeting frequently does not guarantee effectiveness.

Mandate that no new AI technology is used.

Why wrong: Governance is about enablement and risk management, not necessarily banning innovation.

Allow the IT team to proceed without oversight.

Why wrong: New technologies pose significant risks that require governance oversight.

Focus solely on the cost of the technology.

Why wrong: Risk and strategy are more important than cost alone for emerging tech.

Internal Audit.

Why wrong: They monitor compliance, they do not implement the policies themselves.

The Board of Directors.

Why wrong: They set the direction; they do not perform the implementation.

The IT support team.

Why wrong: They work at the operational level, but executive management holds the responsibility.