ITIL4-DPI Direct, Plan and Improve Practice Question
An IT director is reviewing the organization's governance, risk, and compliance (GRC) posture using the ITIL 4 guiding principle 'Think and work holistically'. How should the director apply this principle to GRC integration?
⚠ Common exam trap
Candidates often select 'creating a GRC policy' or 'auditing departments,' failing to apply the holistic principle, which requires embedding GRC into all value streams rather than treating it as a silo.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Integrate governance, risk, and compliance considerations across all value streams, recognizing dependencies between people, processes, and technology.
Applying 'Think and work holistically' requires recognizing that governance, risk, and compliance do not operate in silos but interact across all value streams, practices, and organizational layers. The director must integrate GRC into the fabric of daily operations rather than treating them as separate, periodic checkpoints. This ensures balanced decision-making and sustainable value co-creation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Establish a separate, isolated compliance department that reviews projects only after they have been fully deployed.
Why it's wrong here
An isolated department reviewing only after deployment breaks holistic integration, since compliance must be embedded across the value stream rather than bolted on at the end. It is tempting because specialist review adds assurance, and would be correct where independent post-implementation audit is the stated requirement.
- ✓
Integrate governance, risk, and compliance considerations across all value streams, recognizing dependencies between people, processes, and technology.
Why this is correct
Thinking and working holistically means treating GRC as an interconnected system rather than isolated silos. Integrating governance, risk, and compliance across every value stream, and acknowledging dependencies between people, processes, and technology, prevents local optimisations that undermine enterprise-wide risk posture.
- ✗
Focus compliance efforts exclusively on financial reporting while ignoring technical and operational risks.
Why it's wrong here
Ignoring technical and operational risks contradicts holistic thinking, which requires GRC to span all risk domains as one interconnected system. It is tempting because narrowing scope to financial reporting eases regulatory audit effort, and would suit a purely finance-focused SOX compliance programme where operational risk sits outside the mandate.
- ✗
Automate all compliance audits and remove human governance oversight to accelerate software delivery speed.
Why it's wrong here
Removing human governance oversight breaks the holistic principle: automation cannot own accountability, and ITIL 4 treats governance as inseparable from delivery. It is tempting because automating audit evidence collection genuinely accelerates CI/CD pipelines, and would be right where routine, low-risk compliance checks need continuous, repeatable validation without manual intervention.
About these practice questions
Courseiva writes every ITIL4-DPI question from scratch — 102 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official PeopleCert/AXELOS exam blueprint
This ITIL4-DPI practice question is part of Courseiva's free PeopleCert/AXELOS certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ITIL4-DPI exam.