CGEIT Practice Questions

The MOST important consideration for board approval of an IT strategic plan is ensuring it clearly defines roles and responsibilities linked to IT objectives. The board's primary function is oversight and ensuring accountability for achieving enterprise goals. By explicitly linking roles and responsibilities to strategic IT objectives, the plan demonstrates a clear governance structure, assigns ownership, and provides the board with assurance that the strategy is actionable and its execution can be effectively monitored. This directly supports the core governance principles of direction and performance monitoring, which are paramount at the board level.

B. specific resourcing requirements for identified IT projects.

This is too granular for a strategic plan. The board is concerned with the overall investment envelope and business value, not the detailed resource breakdown of individual projects.

C. frameworks that will be aligned to IT programs.

Frameworks (e.g., COBIT, ITIL) are operational means to an end. The board is more concerned with the strategic outcomes and alignment, not the specific methodologies used to achieve them.

D. implications of the strategy on the procurement process.

This is an operational detail. While important for execution, it is a subordinate component of resource management and not the primary strategic consideration for board-level approval.

1. ISACA

CGEIT Review Manual

8th Edition. Domain 2: IT Governance

Task 2.5

emphasizes the need to "Establish and maintain organizational structures

roles

and responsibilities for the governance of IT to support the achievement of enterprise objectives." This highlights that defining accountability is a foundational governance activity that must be reflected in strategic planning presented to the board.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives. The EDM01 governance objective

"Ensured Governance Framework Setting and Maintenance

" includes the key practice EDM01.02: "Direct the establishment of organisational structures...Define and establish the roles and responsibilities of the board..." This confirms that defining roles and responsibilities is a primary directive from the governing body (the board).

3. De Haes

S.

& Van Grembergen

W. (2015). Enterprise Governance of Information Technology: Achieving Alignment and Value

Featuring COBIT 5. Springer International Publishing. Chapter 3

"IT Governance Structures

Processes

and Relational Mechanisms

" discusses that for a board-level IT governance committee

a key responsibility is to "clarify...business and IT responsibilities" (p. 69). This underscores the board's focus on accountability structures within strategic plans. DOI: https://doi.org/10.1007/978-3-319-14547-1

Once a strategic vision is established, it must be translated into measurable objectives. The most effective activity to support the implementation of performance measures is to identify Key Performance Indicators (KPIs). KPIs are specific, quantifiable metrics that directly measure the achievement of strategic goals. They form the foundation of the performance measurement framework by providing clear targets and a means to track progress. This allows the enterprise to monitor how effectively it is executing its strategy and to make data-driven decisions. Without defined KPIs, any performance measurement system would lack focus and relevance to the strategic vision.

A. Monitor service level performance: This is an ongoing operational activity that occurs after performance measures (like KPIs and SLAs) have been defined and implemented.

B. Document strengths, weaknesses, opportunities, and threats: A SWOT analysis is a strategic planning tool used to formulate the strategic vision, not to implement performance measures after the vision is set.

C. Document policy requirements: While performance measures must align with policy, documenting policies is a foundational governance activity that precedes the specific task of creating metrics to measure strategic execution.

1. ISACA. (2020). CGEIT Review Manual

8th Edition. Domain 1: Governance of Enterprise IT

Section B: Strategic Management

pp. 45-46. The manual explains that after the IT strategy is developed

performance metrics must be defined to measure the achievement of strategic goals.

2. ISACA. (2018). COBIT 2019 Framework: Governance and Management Objectives. APO02

Managed Strategy

Key Management Practice 3 (APO02.03). This practice states

"Define the I&T strategy and road map

including the definition of key performance indicators (KPIs) and improvement actions." This directly links strategy definition to the identification of KPIs.

3. ISACA. (2018). COBIT 2019 Framework: Introduction and Methodology. Chapter 4: The COBIT Goals Cascade

p. 31. The goals cascade is the core mechanism for translating high-level enterprise goals into specific

measurable IT-related goals and metrics (KPIs)

which is the essential step after the strategy is set.

The most critical first step when faced with a new regulatory requirement is to fully understand its scope, implications, and potential impact. The CIO, while an expert in IT, is not typically a legal or regulatory expert. Therefore, the initial and most prudent action is to consult with internal or external legal and risk management professionals. These experts can accurately interpret the regulation and advise on its applicability to the organization's IT-enabled business activities. This foundational understanding is a prerequisite for any subsequent actions, such as assessing resource needs, modifying projects, or briefing executive leadership.

A. Revising initiatives is a reactive measure that should only be undertaken after the new requirement is fully understood and its impact has been properly assessed.

B. Confirming resource adequacy is part of the planning and implementation phase of the response, which cannot be accurately performed without first understanding the compliance work required.

D. The board provides strategic oversight and direction. The CIO should first perform due diligence by understanding the issue with expert help before presenting an informed analysis and recommendation to the board.

1. ISACA

CGEIT Review Manual

8th Edition (2020). Domain 4: Risk Optimization

Task Statement R1 states the need to ensure IT-related risk is "identified

analyzed

mitigated

managed

monitored

and reported." The analysis

which involves understanding the requirement

must precede mitigation (revising initiatives) and management (allocating resources). Consulting legal experts is a key part of the analysis for regulatory risk.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives (2018). The management objective APO12 Manage Risk includes practice APO12.02 Collect data

which involves identifying "relevant external environment trends (e.g.

legal

regulatory...)" to enable risk identification. This identification and data collection to understand the requirement is the initial step before developing a response.

3. ISACA

COBIT 2019 Framework: Governance and Management Objectives (2018). The governance objective EDM03 Ensure Risk Optimization includes practice EDM03.01 Evaluate risk management. This involves directing the analysis of the potential impact of external business and regulatory changes on enterprise IT risk. This directive to analyze precedes any action on resource allocation or project changes.

The IT balanced scorecard (BSC) is a strategic performance management framework specifically designed to translate strategy into a comprehensive set of performance measures. It provides a holistic view by evaluating IT performance from multiple perspectives: financial, customer, internal processes, and learning and growth. This allows the IT strategy committee to directly link IT objectives and metrics to the overarching business strategy, offering the most complete and balanced method for determining how well the IT department provides support. It moves beyond purely operational or technical metrics to assess strategic contribution and value delivery.

A. A capability maturity assessment measures the effectiveness and sophistication of specific IT processes, not their direct contribution to business strategy.

B. A customer survey analysis provides valuable feedback on user satisfaction but represents only one perspective and does not capture the full strategic impact of IT.

D. An IT controls assurance program focuses on risk mitigation and compliance by evaluating the effectiveness of controls, not on the strategic value delivered by IT.

1. ISACA. (2020). CGEIT Review Manual

8th Edition. Domain 4: IT Resource Optimization

Section 4.4 Performance and Conformance Monitoring

p. 168. The manual states

"The balanced scorecard (BSC) is a concept that helps organizations translate strategy into action... It is a widely used management tool for measuring enterprise performance."

2. ISACA. (2018). COBIT 2019 Framework: Governance and Management Objectives. Section 3.4

The COBIT Goals Cascade

pp. 23-25. This section explains how stakeholder needs are cascaded down to specific IT-related goals

a process for which the balanced scorecard is a primary tool to ensure alignment between business and IT goals.

3. Van Grembergen

W.

& De Haes

S. (2009). Enterprise Governance of Information Technology: Achieving Strategic Alignment and Value. Springer. Chapter 4

"IT Governance and the Balanced Scorecard

" details how the BSC is adapted for IT to measure its contribution to business strategy across different dimensions.

4. ISACA. (2018). The IT-Enabled Business Case Guide. Part 3: Measuring and Managing Value

p. 29. The guide discusses the importance of measuring benefits realization and notes that frameworks like the balanced scorecard are essential for tracking the value contribution of IT investments against strategic objectives.

Integrating a new vendor with an Enterprise Resource Planning (ERP) system introduces significant risks to the organization's core data and business processes. A vendor risk assessment is the most critical initial step as it evaluates the vendor's security posture, financial stability, operational capabilities, and compliance with legal and regulatory requirements. This foundational activity provides the necessary information for senior management to make an informed selection, for procurement to draft an appropriate contract with necessary safeguards, and for technical teams to plan a secure integration. Without a thorough risk assessment, the enterprise is exposed to potential data breaches, operational disruptions, and non-compliance, making this the paramount consideration for governance of enterprise IT (GEIT).

A. IT senior management's role is strategic approval and oversight, but the selection itself should be based on a formal evaluation process, of which risk assessment is a primary component.

C. ERP data mapping is a crucial technical task during the implementation phase, but it occurs after the strategic decision to engage the vendor has been made based on risk and business value.

D. The contract's terms are essential for legal and operational control, but these terms are directly informed by the findings of the risk assessment, which identifies what needs to be contractually mandated.

1. ISACA

CGEIT Review Manual

8th Edition. Domain 4: Risk Optimization

Task Statement T4.5

states the need to "Ensure the identification

analysis and evaluation of IT risk to determine the impact on business objectives." Integrating a new vendor into an ERP is a significant IT risk that must be evaluated first.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives. The management objective APO10 Managed Vendors includes key practice APO10.02

"Identify and evaluate vendor relationships and contracts." A key activity listed is to "Periodically review and assess the risk of all vendors... Assess the risk associated with vendors not performing as expected..." This highlights risk assessment as a core activity in vendor management.

3. ISACA

COBIT 2019 Framework: Governance and Management Objectives. The management objective APO10.03 Select vendors specifies that vendors should be selected based on requirements that "include the ability to meet security and privacy requirements." This ability is verified through a risk assessment process before selection and integration.

Establishing product compliance criteria is the most critical initial step in the procurement process for IoT devices in a healthcare setting. This foundational governance activity involves defining the specific security, privacy (e.g., HIPAA), regulatory, and interoperability standards the devices must meet. These criteria form the basis for the request for proposal (RFP) and provide an objective framework for evaluating and selecting vendors. Without first defining what constitutes an acceptable and compliant product, the enterprise cannot effectively manage risk, ensure alignment with legal obligations, or make informed sourcing decisions. This step must precede any engagement with vendors to ensure all potential solutions are measured against the same essential requirements.

B. Patient training is an operational activity that occurs post-procurement and implementation, once a specific device has been selected.

C. Physical security audits are performed during the vendor evaluation phase or post-acquisition, not before vendors are even identified.

D. Vendor delivery timelines are part of the negotiation and contracting phase, which happens after initial vendor engagement and selection.

1. ISACA

CGEIT Review Manual

8th Edition. Domain 2: IT Resources Governance

Task G2.3

states the need to "Ensure that IT sourcing strategies include criteria for selection." This confirms that establishing criteria is a primary governance responsibility that precedes vendor selection.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives. The management objective APO10 Managed Vendors

specifically practice APO10.02 "Select vendors

" emphasizes the need to "Select vendors according to a fair and formal practice to ensure that the selected vendor is the best fit based on established criteria." This shows that criteria must be established first.

3. ISACA

COBIT 2019 Framework: Governance and Management Objectives. The management objective BAI03 Managed Solutions Identification and Build

practice BAI03.01 "Define and maintain business functional and technical requirements

" highlights that requirements

including compliance and security

must be defined before a solution is acquired. For healthcare IoT

this includes regulatory compliance.

The most appropriate initial action for a CEO, operating at a governance level, is to first understand the context and root cause of the performance issue. Engaging directly with the region's leadership is a fundamental step in the "Evaluate" component of the Evaluate, Direct, and Monitor (EDM) governance model. This collaborative approach ensures that any subsequent corrective actions are based on a thorough understanding of the specific challenges in that region, rather than on assumptions. This diagnostic step is crucial for effective governance and strategic decision-making before directing specific reviews or implementing changes.

A. Performing a benefit calculation and reviewing selection methodology is a specific, tactical response that assumes the problem lies in these areas, which may not be the case.

B. Suspending funding is a drastic and premature reaction that could be highly disruptive and demoralizing without first understanding the underlying cause of the issue.

C. An independent review of business cases is a detailed audit activity that should be initiated only after an initial investigation points to the business cases as a likely problem area.

1. ISACA

CGEIT Review Manual

8th Edition. Domain 1: Governance of Enterprise IT

Task 1.05

emphasizes the importance of communication with stakeholders to understand performance and adapt to changing needs. The CEO's first action should be to communicate with the relevant stakeholders (regional leadership) to evaluate the situation.

2. ISACA

COBIT 2019 Framework: Introduction and Methodology. Chapter 4

Governance and Management Objectives

EDM02 (Ensured Benefits Delivery). This objective states that governance must "evaluate value optimization" and "monitor value optimization." When monitoring reveals a significant decrease in returns

the evaluation process must be re-engaged to understand the cause before directing corrective action.

3. ISACA

COBIT 2019 Framework: Governance and Management Objectives. EDM01 (Ensured Governance Framework Setting and Maintenance). This process highlights the need to direct the governance system

which includes understanding and responding to the enterprise context. A performance issue in a specific region is a key contextual factor that requires evaluation through stakeholder engagement first.

The Balanced Scorecard (BSC) is the most effective method for monitoring IT governance effectiveness because it is a strategic performance management framework. It translates an organization's strategic objectives into a coherent set of performance measures distributed across four perspectives: financial, customer, internal business processes, and learning and growth. When applied to IT (as an IT Balanced Scorecard), it ensures that IT performance measurement is not solely focused on technical or operational metrics but is directly linked to business value and strategic alignment. This holistic, multi-dimensional view provides a comprehensive assessment of how well the IT governance framework is performing in achieving enterprise goals, which is its primary purpose.

A. Service level management: This is an operational process focused on monitoring IT service delivery against predefined targets (SLAs), not the overall strategic effectiveness of the entire IT governance system.

C. Risk control self-assessment (CSA): This is a tool for evaluating the effectiveness of risk management and internal controls, which is only one component of the broader IT governance framework.

D. SWOT analysis: This is a strategic planning technique used for situational analysis to identify strengths, weaknesses, opportunities, and threats, not a continuous monitoring and performance measurement tool.

1. ISACA

CGEIT Review Manual

8th Edition (2020). Domain 4

"Governance Monitoring and Improvement

" Task 4.3

emphasizes the use of tools like the IT balanced scorecard to monitor the performance of IT governance by linking IT goals to enterprise goals across various perspectives.

2. ISACA

COBIT 2019 Framework: Introduction and Methodology (2018). Section 5

"COBIT Performance Management (CPM)

" describes the goals cascade mechanism

which is fundamental to the balanced scorecard approach

for translating stakeholder needs into measurable enterprise and IT-related goals.

3. Van Grembergen

W.

& De Haes

S. (2009). Enterprise Governance of Information Technology: Achieving Strategic Alignment and Value. Springer. Chapter 4

"IT Balanced Scorecard

" pp. 81-105

details how the BSC is a primary tool for implementing and measuring IT strategy and governance

ensuring that IT performance contributes to business performance.

4. De Haes

S.

& Van Grembergen

W. (2004). "IT governance and its mechanisms." Information Systems Control Journal

1

27-33. This article identifies the IT balanced scorecard as a key structure for measuring the performance of IT governance and ensuring strategic alignment.

The primary deficiency identified is that the business continuity plan (BCP) fails to consider many common crisis events. The most direct and effective method to remedy this is to engage a broad range of stakeholders in scenario development. Stakeholders from various business units, IT, and support functions possess unique insights into potential threats and impacts relevant to their areas. This collaborative approach ensures that the BCP is built upon a comprehensive and realistic set of potential crisis scenarios, directly addressing the plan's current weakness and enhancing its overall relevance and effectiveness.

B. Review the root cause analysis: This is a reactive process used to analyze past failures. The current need is proactive planning to identify potential future crisis events.

C. Require further walk-through tests: Testing is used to validate an existing plan. It is inefficient to test a plan that is already known to be incomplete; the missing scenarios must be added first.

D. Review and update the crisis communication plan: While a vital component, the crisis communication plan is subordinate to the main BCP. Updating it does not solve the fundamental problem that the overall plan is missing key crisis scenarios.

1. ISACA

CGEIT Review Manual

8th Edition. Domain 4: Value Optimization

Section 4.4

Business Service Continuity and Availability. The manual emphasizes that the foundation of a BCP is the Business Impact Analysis (BIA)

which involves identifying potential threats and their impact. This process requires significant input from business process owners and other stakeholders to ensure all relevant scenarios are considered.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives. Management Objective APO12

Manage Risk. The framework details the need for risk analysis based on scenarios. Specifically

management practice APO12.03

"Analyze risk

" states the need to "Develop a detailed view of the IT risk... including... the use of risk scenarios to estimate the business impact..." This process is informed by data collection (APO12.02)

which involves identifying and consulting relevant stakeholders.

3. ISACA

COBIT 2019 Framework: Governance and Management Objectives. Management Objective DSS04

Manage Continuity. Management practice DSS04.02

"Identify and select a business continuity strategy

" requires an understanding of business requirements during a disruption. This understanding is derived from a BIA

which is fundamentally based on identifying potential disruptive scenarios with input from business stakeholders.

4. Hiles

A. (2011). The Definitive Handbook of Business Continuity Management. John Wiley & Sons. Chapter 6

"Business Impact Analysis

" explains that the BIA process

which is foundational to any BCP

relies on workshops and interviews with key stakeholders to identify critical processes and the threats (scenarios) that could disrupt them. This highlights the central role of stakeholder engagement in defining the scope of the BCP.

The BEST strategy is a governance-level action that embeds the desired change into the enterprise's processes. Creating a new investment category for innovation establishes a formal, strategic mechanism for the IT steering committee to prioritize, fund, and track modernization efforts. This approach aligns with IT portfolio management principles, ensuring that overcoming technological stagnation becomes a deliberate and sustainable part of the enterprise's investment strategy. It directly addresses the committee's concern by creating a dedicated channel for funding new technology, separate from day-to-day operational spending, thereby ensuring focus and accountability for modernization.

A. This is a tactical budgetary action that would result from a strategic decision, not the strategy itself.

B. Redefining the target architecture is a planning activity; it identifies what to invest in but does not create the investment strategy or funding mechanism.

D. Updating the HR plan is a necessary supporting activity that follows the decision to adopt new technologies, not the primary investment strategy.

1. ISACA

COBIT 2019 Framework: Governance and Management Objectives. The management objective APO05 Manage Portfolio includes the practice APO05.04 Manage the investment portfolio. A key activity is to "Establish a target investment mix (e.g.

proportion of investments in innovation/growth vs. run/maintain) based on the enterprise strategy and goals." Creating a new category for innovation directly implements this best practice.

2. ISACA

CGEIT Review Manual

8th Edition. Domain 2

"IT Resources

" emphasizes the importance of IT portfolio management to ensure resources are optimized to achieve enterprise objectives. Task Statement 2.4

"Direct IT portfolio management to ensure alignment with the enterprise's strategic objectives

" directly relates to the steering committee's role in creating investment categories to drive strategic change.

3. De Haes

S.

& Van Grembergen

W. (2015). Enterprise Governance of Information Technology: Achieving Alignment and Value in Digital Organizations. Springer. Chapter 4

"IT Portfolio Management

" describes the practice of categorizing IT investments (e.g.

run

grow

transform) as a fundamental IT governance mechanism to ensure strategic alignment and value creation. Creating an "innovation" category is a direct application of this principle. (DOI: 10.1007/978-3-319-14547-1)