CGEIT Isaca Certified in the Governance of Enterprise IT Exam Free Practice Exam Questions (2025 Updated)

According to the CGEIT exam guide, the IT strategy committee should ensure that the IT strategic plan is aligned with the business needs and goals of the enterprise. Therefore, before initiating the development of an IT strategic plan, the committee members should be apprised of the business needs and understand the expectations and requirements of the stakeholders. References: CGEIT Exam Candidate Guide, page 13. CGEIT Certification

Business ethics is the application of ethical values to business behaviour. It encompasses the people, processes, and technologies required to manage and protect data assets1. Promoting business ethics within the IT enterprise should be the primary objective because it ensures trust among internal and external stakeholders, such as customers, employees, suppliers, regulators, and society234. Trust is important because it makes cooperation possible, enhances performance, fosters engagement, and creates long-term value21. While the other options are also desirable outcomes of business ethics, they are not the primary objective. Employees acting more responsibly, corporate social responsibility, and legal and regulatory compliance are all consequences of trust-building rather than the main goal. References:

2: https://www.ibm.com/topics/data-governance

1: https://www.cio.com/article/202183/what-is-data-governance-a-best-practices-framework-for-managing-data-assets.html

3: https://www.sailpoint.com/identity-library/enterprise-data-governance/

4: https://atlan.com/enterprise-data-governance/

 A strategic HR plan is a document that drives the business forward by evaluating where the workforce is at and comparing it to future needs. It sets out the organizational goals and outlines how the HR team will help achieve them1. A strategic HR plan for IT would help to identify and address the gaps, challenges, and opportunities in the IT talent management, such as recruitment, retention, development, engagement, and succession2. A strategic HR plan for IT would also help to align the IT workforce with the IT strategy and objectives, and to ensure that the IT personnel have the skills, competencies, and motivation to support the organization’s new strategy3. A strategic HR plan for IT would also help to communicate and collaborate with the IT personnel and other stakeholders, and to foster a positive and supportive IT culture4.

The best long-term solution to address the concern regarding loss of experienced staff is to implement knowledge management practices, because knowledge management is the process of creating, sharing, using, and managing the knowledge and information of an organization1. Knowledge management practices can help capture, document, and transfer the valuable knowledge and expertise of the experienced staff before they leave the organization, as well as facilitate the learning and development of the new or existing staff. Knowledge management practices can also enhance the organizational performance, innovation, and competitiveness by leveraging the intellectual capital and creating a culture of knowledge sharing2. According to a study by 3, the impact of knowledge management practices on employee retention is significant and positive in both IT and banking industries. Another study by 4 found that knowledge management practices can improve job satisfaction and employee retention by fostering a supportive work environment, providing growth opportunities, and rewarding knowledge contributions. Therefore, implementing knowledge management practices can help mitigate the risk of losing experienced staff and their knowledge in the long run.

The other options are not the best long-term solutions, because they are either short-term or partial solutions. Establishing a mentoring program for IT staff can help transfer some of the knowledge and skills of the experienced staff to the mentees, but it may not be sufficient or systematic enough to capture and preserve all the relevant knowledge. Determining key risk indicators (KRIs) can help monitor and measure the risk exposure of losing experienced staff, but it does not address the root cause or provide a solution for the problem. Retaining key staff as consultants can help retain some of the expertise and experience of the staff, but it may not be feasible or cost-effective in the long term, and it may also create dependency and vulnerability issues for the organization.

 A gap analysis is a method of assessing the differences in performance between a business’ information systems or software applications to determine whether business requirements are being met and, if not, what steps should be taken to ensure they are met successfully1. A gap analysis typically involves identifying non-compliant processes or activities; assessing their risklevels; determining potential corrective actions that can be taken to address them; and implementing those corrective measures1. Once completed, organizations can then measure their progress toward achieving full compliance over time1.

A gap analysis should be done first when feedback indicates recently implemented software products are not meeting business unit expectations, as it can help identify the root causes of the dissatisfaction, the gaps between the current and desired state of the software products, and the actions needed to close those gaps. A gap analysis can also help align the software products with the business strategy, goals, and expectations, as well as ensure compliance with regulations and policies.

Reviewing help desk logs, confirming user acceptance testing (UAT) was completed, and instituting a new software training program are also important steps to take when software products are not meeting expectations, but they are not the first step. Reviewing help desk logs can help gather feedback and identify issues or errors with the software products, but it does not provide a comprehensive analysis of the gaps and solutions. Confirming UAT was completed can help verify that the software products were tested by the end users before implementation, but it does not address the reasons why the feedback was negative after implementation. Instituting a new software training program can help improve the user’s skills and knowledge of the software products, but it does not guarantee that the software products will meet their needs and expectations.

References := What is Gap Analysis in Compliance | Scytale; How to Perform an IT Gap Analysis - Systems X; IT Gap Analysis – First Step to ITIL Success | Invensis Learning.

According to the web search results, a SaaS contract is a legal agreement between a SaaS provider and a customer that defines the terms and conditions of using the SaaS solution, such as the scope, duration, price, service level, data ownership, security, privacy, compliance, etc. The most effective way to reduce the risk associated with the SaaS solution is to include risk-related requirements in the SaaS contract, such as the following12:

The SaaS provider should comply with the relevant laws and regulations that apply to the customer’s industry and location, such as GDPR, HIPAA, PCI DSS, etc.

The SaaS provider should implement adequate security measures and controls to protect the customer’s data from unauthorized access, modification, disclosure or loss, such as encryption, authentication, authorization, backup, etc.

The SaaS provider should provide regular reports and audits on the security and performance of the SaaS solution, as well as notify the customer of any security incidents or breaches that may affect the customer’s data.

The SaaS provider should guarantee a certain level of availability and reliability of the SaaS solution, and specify the remedies or penalties for any service downtime or disruption.

The SaaS provider should allow the customer to access, export, delete or transfer their data at any time, and ensure that the data are erased or returned to the customer upon termination of the contract.

The SaaS provider should indemnify and hold harmless the customer from any claims, damages or liabilities arising from the use of the SaaS solution.

Including risk-related requirements in the SaaS contract will help to clarify the roles and responsibilities of both parties, as well as to establish trust and accountability between them. It will also help to mitigate the potential risks and challenges of using a hosted SaaS solution34, such as data loss, unauthorized access, compliance violations, service outages, vendor lock-in, etc. The other options are not as effective as including risk-related requirements in the SaaS contract, as they do not address the contractual and legal aspects of using a hosted SaaS solution.

The most effective way for the CIO to ensure the IT management team is held accountable for the delivery of the plan is to revise the managers’ performance goals to include key objectives that are aligned with the IT strategic plan. This way, the managers will have clear and measurable targets that reflect their contribution to the IT strategy and vision. The CIO can also monitor and evaluate the managers’ progress and performance based on these goals, and provide feedback, recognition, or improvement actions as needed.

The other options are not the most effective way for the CIO to ensure the IT management team is held accountable for the delivery of the plan. Updating the IT balanced scorecard with key objectives is a good practice, but it does not directly link the objectives to the managers’ individual responsibilities and incentives. Enforcing disciplinary action for managers if the plan is not delivered is a negative and punitive approach, which may demotivate and discourage the managers from pursuing the plan. Providing management training on IT strategic objectives is a helpful initiative, but it does not specify how the managers will be assessed and rewarded for achieving the objectives.

For more information on IT strategic planning and accountability, you can refer to these web sources:

IT Strategic Planning: A Step-by-Step Guide

How to Hold Your Team Accountable

IT Governance - CIO Wiki

 A quantitative risk assessment method uses numerical values and mathematical models to estimate the likelihood and consequences of risks. This reduces the subjectivity and bias that may arise from qualitative methods that rely on personal judgment and experience. A quantitative method also allows for more objective comparison and prioritization of risks based on their impact and probability. References :=

Quantitative Risk Analysis (Definition, Benefits and Steps) - Indeed

Risk Assessment and Analysis Methods: Qualitative and Quantitative - ISACA

The MOST important thing for the IT steering committee to consider before deciding on a policy to anonymize personal data in enterprise systems is the regulatory requirements. Anonymization is the process of protecting private or sensitive information by erasing or encrypting identifiers that connect an individual to stored data1. However, different jurisdictions may have different definitions, standards, and rules for anonymization and data protection2. For example, the EU’s General Data Protection Regulation (GDPR) outlines a specific set of rules that protect user data and create transparency1. The GDPR permits companies to collect anonymized data without consent, use it for any purpose, and store it for an indefinite time—as long as companies remove all identifiers from the data1. However, if the data is not fully anonymized and can be re-identified by using de-anonymization methods, then the GDPR still applies and requires consent, purpose limitation, and data minimization2. Therefore, the IT steering committee should consider the regulatory requirements of the applicable legislation in both the home and host countries before deciding on a policy to anonymize personal data in enterprise systems. This can help to ensure compliance, avoid fines or penalties, and protect the reputation and trust of the business.

 Business use cases are descriptions of the business processes, scenarios, and interactions that support the achievement of a specific business goal or objective1. By considering the business use cases supporting the digital strategy, the enterprise can ensure that the information architecture is aligned with and driven by the business needs and expectations2. The information architecture can also support the communication, collaboration, and decision-making processes among the stakeholders involved in the digital strategy2.

The other options are not as important as the business use cases supporting the digital strategy, as they are either specific aspects or outcomes of information architecture, but not comprehensive factors. Resource constraints related to implementing the digital strategy are the limitations and challenges that affect the availability and quality of the resources required for executing the digital strategy, such as time, money, people, technology, or data3. Resource constraints can affect the information architecture, but they are not the most important factor to consider, as they are only one of the many criteria that evaluate information architecture3. Changes to the legacy business and data architectures are the modifications and adaptations that are needed to update and improve the existing business and data structures, models, and systems to align with the digital strategy4. Changes to the legacy business and data architectures can affect the information architecture, but they are not the most important factor to consider, as they are only one of the many components that constitute information architecture4. The history of fraud incidents and their root causes are the records and analyses of the previous fraud events and their underlying factors that occurred within or against the enterprise5. The history of fraud incidents and their root causes can affect the information architecture, but they are not the most important factor to consider, as they are only one of the many sources of information that inform information architecture5.

One of the primary responsibilities of a data steward is to classify and label organizational data assets, which means to assign categories and tags to the data based on its characteristics, such as type, source, sensitivity, quality, or purpose. Classifying and labeling data helps to organize, manage, and protect the data assets, as well as to facilitate their discovery, access, and usage. Data stewards are also responsible for defining and maintaining the data classification and labeling standards and policies, and ensuring their compliance across the organization. References: What Is a Data Steward? Roles & Responsibilities | Zuar1, Data Stewards: Who They Are & Why Data Stewardship Matters - HubSpot Blog2, Data Steward: Roles, Responsibilities, and Certification3

Internal audit is an independent and objective function that provides assurance and consulting services to the enterprise on the effectiveness and efficiency of its governance, risk management,and control processes1. By including internal audit as a stakeholder, the enterprise can benefit from its knowledge, expertise, and perspective on IT-related issues and risks, such as IT strategy alignment, IT performance measurement, IT value delivery, IT resource management, IT risk management, and IT compliance2. Internal audit can also provide input on the design, implementation, and evaluation of the IT governance framework, policies, standards, and procedures, as well as recommend improvements and best practices2. Therefore, internal audit provides input on relevant issues and control processes, which is the most important reason to include it as a stakeholder when establishing clear roles for the governance of IT.

The other options are not as important or accurate as option D. Internal audit does not have knowledge and technical expertise to advise on IT infrastructure, as this is not its primary role or responsibility. Internal audit is not accountable for the overall enterprise governance of IT, as this is the responsibility of the board of directors and senior management3. Internal audit does not implement controls over IT risks and security, as this is the responsibility of the IT function and other business units4.

A project governance framework is a set of principles, policies, roles, responsibilities, and processes that guide, direct, and control the initiation, planning, execution, monitoring, and closure of IT projects. A project governance framework can help the enterprise address the problems of poor project performance, lack of accountability, and inconsistency in execution by:

Providing a clear and consistent structure for managing IT projects across the enterprise

Aligning IT projects with the strategic objectives and priorities of the enterprise

Defining the roles and responsibilities of the project stakeholders, including the board of directors, senior management, project sponsors, project managers, project teams, and end-users

Establishing the criteria and methods for selecting, prioritizing, approving, and funding IT projects

Setting the standards and expectations for project planning, execution, quality, risk management, communication, and reporting

Implementing the mechanisms and tools for monitoring, controlling, evaluating, and reviewing IT project performance and outcomes

Ensuring the accountability and transparency of IT project decisions and results

When considering an IT change that would enable a potential new line of business, the first strategic step for IT governance would be to ensure agreement among the stakeholders regarding a vision for the future state, because this would provide a clear direction and purpose for the change, and align the IT strategy with the business strategy. A vision statement should describe the desired outcomes and benefits of the change, and reflect the enterprise’s mission, values, and goals12. References := ISACA, CGEIT Review Manual, 7th Edition, 2019, page 23-24.

The most important course of action for IT senior management to improve IT governance within the organization is to understand the driver that led to a desire to change. IT governance is the process of ensuring that IT supports and enables the achievement of the enterprise’s goals and objectives, and delivers value to the stakeholders1. IT governance is influenced by various internal and external factors, such as business strategy, customer expectations, regulatory requirements, industry standards, best practices, and emerging technologies1. Therefore, before initiating any improvement initiatives, IT senior management should first identify and analyze the driver that prompted the board of directors to request a change in IT governance. This will help them to understand the current situation, the desired state, the gap between them, and the rationale and urgency for improvement2. By understanding the driver that led to a desire to change, IT senior management can also align their improvement efforts with the board’s vision and expectations, communicate the benefits and challenges of change, and gain their support and commitment2. References: CGEIT Review Manual (Digital Version) or CGEIT Review Manual (Print Version), Chapter 1: Governance of Enterprise IT, Section 1.1: IT Governance Frameworks and Principles, Page 9-10. What is CGEIT? A certification for seasoned IT governance professionals.

According to the ISACA paper on IT Governance Reporting1, the IT strategy committee is a board-level committee that is responsible for overseeing and guiding the IT strategy and governance of the enterprise. The IT strategy committee helps to ensure that IT supports and enables the achievement of the enterprise’s strategy, objectives and goals, and that IT delivers value, benefits and competitive advantage to the enterprise. One of the decisions that would be made by the IT strategy committee is the composition of the investment portfolio, which is the set of IT projects and programs that are selected, prioritized, funded and monitored by the enterprise. The composition of the investment portfolio reflects the strategic alignment, value proposition and risk profile of IT, as well as the resource allocation and optimization of IT. The other options are not decisions that would be made by the IT strategy committee, but rather by other IT governance bodies or roles, such as the IT steering committee, the IT management team, or the chief information officer (CIO). References: IT Governance Reporting, IT Strategy Committee

 An IT value delivery framework primarily helps an enterprise optimize value to the enterprise, because it provides a systematic and holistic approach to planning, building, and delivering IT solutions that meet the business needs and objectives. An IT value delivery framework helps to align IT strategy with business strategy, ensure effective governance and management of IT resources and processes, measure and monitor IT performance and outcomes, and continuously improve IT value creation and delivery1. An IT value delivery framework also helps to balance the benefits, costs, and risks of IT investments, and to ensure that IT delivers value to the enterprise in terms of efficiency, effectiveness, agility, innovation, and customer satisfaction2.

References := IT Governance: Definition, Frameworks, and Best Practices - InvGate, What is Value-Based Delivery? | Blog | Digital.ai.

This is because stakeholder analysis is a process of identifying and prioritizing the people or groups who have an interest, influence, or impact on the enterprise’s objectives and activities. Stakeholder analysis can help to understand the business expectations, needs, preferences, and concerns of different stakeholders, as well as their roles and responsibilities in the governance program. Stakeholder analysis can also help to engage and communicate with stakeholders effectively, and to align the governance program with the business strategy and value creation.

Some of the sources that support this answer are:

1: This source explains the importance and benefits of stakeholder analysis for IT governance, and provides some tips and tools for conducting it. It suggests that stakeholder analysis can help to ensure that IT governance meets stakeholder needs, delivers value, and supports business objectives.

2: This source defines stakeholder analysis and describes its steps and techniques. It also provides some examples of stakeholder analysis templates and matrices that can be used for IT governance projects.

3: This source discusses how stakeholder analysis can be used in the TOGAF framework for enterprise architecture. It states that stakeholder analysis should be used during Phase A (Architecture Vision) to identify the key players in the engagement, and also be updated throughout each phase; different stakeholders may be uncovered as the engagement progresses through into Opportunities & Solutions, Migration Planning, and Architecture Change Management.

4: This source presents a chapter on enterprise governance of IT processes from a book titled “Enterprise Governance of Information Technology: Achieving Alignment and Value, Featuring COBIT 5”. It mentions that stakeholder analysis is one of the key activities for defining the IT governance framework, as it helps to identify the relevant stakeholders and their expectations, roles, and responsibilities.

 The first step that the CIO should do to help ensure continuous alignment of IT with the new business strategy is to review the existing IT strategy against the new business strategy. A review is a process of evaluating and comparing the current state and performance of the IT strategy with the desired state and expectations of the new business strategy. A review can help identify the strengths, weaknesses, opportunities, and threats of the IT strategy, as well as the gaps, risks, and issues that need to be addressed. A review can also provide insights and recommendations for improving and aligning the IT strategy with the new business strategy. According to COBIT 5, one of the seven enablers of IT governance is performance management, which includes reviewing and monitoring the achievement of IT-related goals and objectives1. The review is also part of the IT governance domain 2: Strategic Alignment2.

The other options are not the first steps that the CIO should do to ensure continuous alignment of IT with the new business strategy. Revising the existing IT strategy to align with the new business strategy is a step that follows after reviewing the existing IT strategy, as it involves making changes and adjustments to the IT strategy based on the findings and recommendations of the review. Establishing a new IT strategy committee for the new enterprise is a step that may or may not be necessary depending on the existing governance structure and processes, and it does not directly address the alignment issue. Assessing the IT cultural aspects of the acquired entity is a step that may be relevant for integrating and harmonizing the IT functions and practices of both entities, but it does not ensure alignment with the new business strategy. References := 1: COBIT 5: A Business Framework for the Governance and Management of Enterprise IT, ISACA, page 312: CGEIT Review Manual 2023, ISACA, page 69.

Portfolio management is the process of selecting, prioritizing, monitoring and controlling the projects, programs and other related work that best align with the enterprise’s strategic objectives and deliver the most value to the stakeholders. The primary strategic goal of implementing portfolio management is to maximize value from the combined investments by ensuring that they are aligned with the enterprise’s vision, mission, goals and values, and that they are optimized in terms of risk, return and resource allocation. References: CGEIT Domain 2: IT Resources

The first step to strengthen and enforce current data governance practices after a data leakage incident is to verify data owners. Data owners are the individuals or groups who have the authority and responsibility to define, classify, protect, and manage the data assets of an enterprise1. By verifying data owners, the enterprise can ensure that the data is properly accounted for, categorized, and secured according to its value, sensitivity, and risk. Data owners can also establish data policies, standards, and procedures, as well as monitor and report on data quality, usage, and compliance1. Verifying data owners is a prerequisite for assessing data security controls, reviewing data logs, and analyzing data quality, as these activities depend on the accurate identification and assignment of data ownership roles and responsibilities. References: CGEIT Review Manual (Digital Version) or CGEIT Review Manual (Print Version), Chapter 4: Risk Optimization, Section 4.2: IT Risk Management Process, Subsection 4.2.1: IT Risk Identification, Page 163-164. Top 10 Effective Data Governance Tools.

The CIO is responsible for the overall IT governance and ensuring that IT supports the business objectives and strategy. The CIO should also ensure that IT staff have the necessary skills and competencies to perform their roles effectively and efficiently. The CIO should address the root cause of the service disruption and take corrective actions to prevent recurrence. References := CGEIT Review Manual, 27th Edition, Domain 1: Governance of Enterprise IT, page 17-18.

IT key risk indicators (KRIs) are metrics that measure the likelihood and impact of IT-related risks on the enterprise’s objectives and goals. Therefore, the first step in determining appropriate IT KRIs is to identify the IT-related risks that are relevant and significant for the enterprise. IT controls, IT threats and IT objectives are also important factors in developing IT KRIs, but they are not the first step. IT controls are the measures that mitigate or reduce IT risks, IT threats are the sources of potential harm or loss to IT assets or processes, and IT objectives are the desired outcomes or results of IT activities that support the enterprise’s strategy and goals. References := ISACA, CGEIT Review Manual, 7th Edition, 2019, p. 90-91; Integrating KRIs and KPIs for Effective Technology Risk Management; Performance Measurement Metrics for IT Governance; State and Impact of Governance of Enterprise IT in Organizations: Key Findings of an International Study.

 Information ownership is the right and responsibility to define, classify, protect, and manage the data assets of an enterprise. When using a cloud-based application, the enterprise should ensure that it retains the ownership and control of its information, and that it complies with the relevant laws and regulations regarding data privacy, security, and sovereignty12. The enterprise should also establish clear policies and agreements with the cloud service provider and the internal and external parties regarding the access, usage, storage, transfer, retention, and disposal of the information12. By considering information ownership, the enterprise can mitigate the risks and challenges of using a cloud-based application, such as data breaches, unauthorized access, vendor lock-in, legal disputes, or reputational damage12.

The other options are not as important as information ownership, as they are secondary or dependent factors. Cloud implementation model is the type of cloud service that the enterprise chooses to use, such as software as a service (SaaS), platform as a service (PaaS), or infrastructure as a service (IaaS)3. Cloud implementation model can affect the cost, performance, scalability, and flexibility of the cloud-based application, but it does not directly affect the ownership and governance of the information3. User experience is the perception and satisfaction of the users when interacting with the cloud-based application. User experience can affect the adoption, engagement, and productivity of the users, but it does not directly affect the ownership and governance of the information. Third-party access rights are the permissions and restrictions that the enterprise grants to external parties to access and use its information through the cloud-based application. Third-party access rights can affect the security and privacy of the information, but they are determined by the information ownership policies and agreements that the enterprise establishes with the cloud service provider and the external parties12.

Total cost of ownership (TCO) is the purchase price of an asset plus the costs of operation over its lifespan1. TCO includes hardware and software acquisition, management and support, communications, end-user expenses and the opportunity cost of downtime, training and other productivity losses2. By considering TCO in investment decisions, an enterprise can avoid unexpected costs and optimize the value of its IT assets3. A policy to consider TCO in investment decisions can help the enterprise to plan ahead for the lease or purchase of ITinfrastructure and software licenses, and avoid cost overruns due to lease extensions or other factors. References :=

CGEIT Review Manual (Digital Version), Chapter 4: Value Optimization, Section 4.2: IT Value Delivery, Subsection 4.2.3: IT Resource Management, Page 123

CGEIT Review Manual (Print Version), Chapter 4: Value Optimization, Section 4.2: IT Value Delivery, Subsection 4.2.3: IT Resource Management, Page 123

How to Calculate Total Cost of Ownership for Software - GetApp4

Total Cost of Ownership: How It’s Calculated With Example - Investopedia1

The first thing that a new CIO should do to ensure information assets are effectively governed is to perform an information gap analysis. An information gap analysis is a process of comparing the current state and performance of the information assets with the desired state and expectations of the information governance program. Information assets include data, metadata, documents, and records that have value to the organization and need to be managed andprotected. An information gap analysis can help identify the strengths, weaknesses, opportunities, and threats of the information assets, as well as the gaps, risks, and issues that need to be addressed. An information gap analysis can also provide insights and recommendations for improving and aligning the information assets with the information governance program. According to 1, an information gap analysis is a key step in developing an information governance strategy that supports the organization’s goals and objectives.

The other options are not the first things that a new CIO should do to ensure information assets are effectively governed. Quantifying the business value of information assets is a step that may be done after performing an information gap analysis, as it involves measuring and communicating the benefits and costs of the information assets to the organization and its stakeholders. Reviewing information classification procedures is a step that may be done after performing an information gap analysis, as it involves evaluating and updating the policies and practices for categorizing and labeling the information assets according to their sensitivity and criticality. Evaluating information access methods is a step that may be done after performing an information gap analysis, as it involves assessing and improving the mechanisms and controls for granting and restricting access to the information assets.

Enterprise architecture (EA) is the process of aligning business and IT strategies, processes, and resources to achieve organizational goals and objectives1. EA implementation involves a significant amount of change in the enterprise, such as introducing new technologies, standards, policies, roles, and responsibilities2. Therefore, managing the challenge of change is MOST important to the successful implementation of EA, as it requires effective communication, stakeholder engagement, change management, and governance mechanisms34. Without managing the challenge of change, EA implementation may face resistance, confusion, conflict, or failure. References :=

Entreprise Architecture: Critical Factors and Implementation | IEEE …5

A Review of Critical Success Factors of Enterprise Architecture …3

Critical Success Factors of Enterprise Architecture Implementation - IJOCIT1

EVALUATION OF ENTERPRISE ARCHITECTURE IMPLEMENTATION: A CRITICAL …4

 An IT risk-aware culture is one that promotes a shared understanding of risk and supports the organization’s strategy, business model, operational practices, and competitive advantage1. It works to strengthen the core of an organization’s operations and protects customers, the brand, and the bottom line1. An IT risk-aware culture also involves the participation and collaboration of all stakeholders in identifying, assessing, and managing IT risks2. Therefore, the BEST evidence of an IT risk-aware culture across an enterprise is when business staff report identified IT risks. This indicates that the business staff are aware of the potential threats and impacts that IT risks can pose to the organization, and that they are willing and able to communicate and escalate them to the appropriate authorities3.

The other options are not as good as option A. While it is important to communicate IT risks to the business, publish IT risk-related policies, and ensure the resilience of the IT infrastructure, these are not sufficient to demonstrate an IT risk-aware culture across an enterprise. They are rather means to achieve the end goal of managing and mitigating IT risks. They do not necessarily reflect the level of awareness, attitude, and behavior of the organization’s employees toward risk and how risk is managed within the organization. References :=

Cultivating a Risk Intelligent Culture - Deloitte US1

Building an Effective Risk-Aware Culture - Magazine4

7 Steps to Create a Risk-Aware Culture | Treasury & Risk3

This should be the committee’s first action, as it will help to define how the IT function supports and enables the overall business strategy and objectives of the enterprise1. An IT strategic plan is a document that outlines the vision, mission, goals, and initiatives of the IT function, as well as the resources, processes, and metrics required to achieve them1. By creating an IT strategic plan, the committee can align IT with business needs and expectations, optimize IT investments andresources, manage IT risks and opportunities, and deliver value to the stakeholders1. Creating an IT strategic plan can also help to communicate and demonstrate the role and contribution of IT to the enterprise’s success, and to gain the support and commitment of the board of directors and senior management1.

The other options are not as important or effective as creating an IT strategic plan, as they are either specific solutions or outcomes of the IT strategic plan, but not comprehensive steps. Implementing a continuous improvement plan may help to enhance the quality and efficiency of IT services and processes, but it may not address the root cause or causes of IT not sufficiently supporting the corporate objectives, which could be related to other factors, such as strategy alignment, value delivery, resource management, or risk optimization2. Specifying IT human resource performance measures may help to evaluate and improve the skills and productivity of IT staff, but it may not address the root cause or causes of IT not sufficiently supporting the corporate objectives, which could be related to other factors, such as stakeholder engagement, communication, collaboration, or feedback3. Developing a service level management plan may help to define and monitor the expectations and agreements for IT service delivery between IT providers and customers, but it may not address the root cause or causes of IT not sufficiently supporting the corporate objectives, which could be related to other factors, such as business requirements, customer satisfaction, innovation, or agility.