A project sponsor has circumvented the request for proposal (RFP) selection process. Which of the following is the MOST likely reason for this…

The act of a project sponsor circumventing a mandatory process such as a Request for Proposal (RFP) points directly to a failure in the governance system's ability to enforce its own rules. The most fundamental reason for such a control gap is a lack of accountability. If individuals, particularly those in positions of authority like a project sponsor, believe there are no consequences for non-adherence to established policies, they are more likely to bypass them for perceived convenience or other personal motives. Effective governance requires that policies are not only established but are also consistently enforced through clear accountability mechanisms.

A. Inadequate stage-gate reviews are a failure in project oversight at specific milestones, not the root cause of why a procurement policy was ignored from the outset.

B. Inadequate board oversight is too high-level. While the board sets the tone, the direct enforcement of operational policies like RFPs is typically a management responsibility.

D. A lack of a legal and regulatory review process is a specific control weakness, but it is a component of the overall process that was circumvented, not the reason for the circumvention itself.

1. ISACA

CGEIT Review Manual

8th Edition

2020. Domain 1

Section 1.6

"Governance Principles

" emphasizes that for a governance system to be effective

there must be clear roles

responsibilities

and accountability. The scenario describes a failure in holding a role (project sponsor) accountable to a defined responsibility (following the RFP process).

2. ISACA

CGEIT Review Manual

8th Edition

2020. Domain 1

Section 1.10

"Organizational Structures

Roles

and Responsibilities

" states that accountability is a key element of governance. A failure to hold individuals accountable for their actions (or inactions) against policy is a primary governance failure. The sponsor's action is a classic example of this failure.

3. De Haes

S.

& Van Grembergen

W. (2015). Enterprise Governance of Information Technology: Achieving Alignment and Value

Featuring COBIT 5. Springer International Publishing. In discussions on governance enablers

the book highlights that "Principles

Policies

and Frameworks" are ineffective without the "People

Skills

and Competencies" enabler

which includes awareness and

critically

a culture of compliance and accountability for following defined processes. (Chapter 2

COBIT 5 Enablers).