Mixed Deck — All CGEIT Topics Flashcards

In CGEIT, the MAIN reason IT governance requires an enterprise architecture capability is to:

Answer: Ensure IT decisions are made with a complete, integrated view of the organization

EA gives governance bodies the holistic view of IT and business connections needed to make well-informed, integrated decisions rather than siloed ones.

Which of the following is PRIMARILY achieved through performance measurement?

Answer: Process improvement

Explanation: Performance measurement allows organizations to assess the effectiveness and efficiency of their processes. By measuring key performance indicators (KPIs), organizations can identify areas where processes can be optimized, streamlined, or redesigned to improve efficiency, reduce waste, and enhance overall effectiveness. Process improvement is directly facilitated by performance measurement because it provides the data and insights necessary to identify areas for improvement and track progress over time.

Which scenario BEST illustrates IT governance performance measurement working as intended?

Answer: A KPI trend showing declining customer satisfaction triggers a governance review that leads to a corrective action plan

When a declining KPI triggers a structured governance review and corrective action, measurement is fulfilling its purpose of enabling proactive governance.

An IT compliance audit PRIMARILY evaluates whether:

Answer: IT controls and practices conform to required standards, regulations, or policies

An IT compliance audit assesses whether the organization's IT controls and practices conform to the applicable legal, regulatory, and policy requirements.

When an organization adopts a cloud-first strategy, its enterprise architecture governance MOST needs to address:

Answer: Security, data sovereignty, vendor dependency, and integration with on-premise systems

Cloud adoption introduces new governance challenges around data control, regulatory compliance, vendor lock-in, and integration that EA governance must explicitly address.

In CGEIT, an enterprise architecture gap analysis PRIMARILY identifies:

Answer: The differences between current IT capabilities and what is needed to achieve future business goals

A gap analysis compares the current IT capability state to the future target state required by business strategy, identifying what must be built, changed, or retired.

Which CGEIT principle supports ongoing benefits realization after project closure?

Answer: Post-implementation review linked to business case KPIs

Post-implementation reviews measure actual outcomes against the business case KPIs, confirming whether benefits have been realized.

In which of the following editions of COBIT was "Management Guidelines" added?

Answer: The second edition

Explanation: Management Guidelines were added in the second edition of COBIT (Control Objectives for Information and Related Technologies). This addition enhanced the framework by providing detailed guidance and management practices for implementing the control objectives outlined in COBIT.

A 'run vs. grow vs. transform' investment categorization in IT portfolio management MOST helps to:

Answer: Balance spending between maintaining operations, enhancing capabilities, and driving innovation

Categorizing investments as run, grow, or transform enables governance bodies to deliberately balance maintaining the business, growing it, and transforming it.

An IT governance framework requires that IT infrastructure investments be prioritized based on:

Answer: Business impact, risk exposure, and alignment with strategic objectives

Infrastructure investments should be prioritized based on their business impact, risk profile, and strategic alignment to ensure optimal resource allocation.

When realized benefits fall short of expectations, the BEST governance response is to:

Answer: Conduct a root cause analysis and adjust the realization approach

A root cause analysis identifies why benefits were not fully realized and informs corrective action to recover or adjust the approach.

A company implements a new ERP system but sees no improvement in operational efficiency. The MOST likely governance failure is:

Answer: No benefits realization plan was established before deployment

Without a benefits realization plan, there is no structured approach to tracking and capturing the efficiency gains the investment was meant to deliver.

An organization's IT governance framework should treat compliance MOST appropriately as:

Answer: A minimum baseline, with governance aiming to deliver additional value beyond compliance

Compliance represents the floor, not the ceiling — good IT governance meets compliance requirements while also driving value creation and strategic alignment.

A governance committee discovers that 40% of the IT portfolio is unaligned with current business strategy. The BEST immediate action is to:

Answer: Conduct a strategic portfolio review and realign or exit misaligned investments

A strategic portfolio review is required to assess each misaligned investment and decide whether to re-align, deprioritize, or exit, freeing resources for strategic work.

HIPAA compliance MOST directly impacts IT governance in organizations that handle:

Answer: Protected health information (PHI) stored or transmitted electronically

HIPAA's Security Rule specifically governs IT controls over electronic protected health information, requiring encryption, access controls, and audit trails.

An IT governance dashboard is MOST valuable when it:

Answer: Presents real-time KPIs that support executive decision-making

A governance dashboard's value is in providing current, relevant KPIs in a format that allows executives to make timely, informed governance decisions.

An organization's IT portfolio review reveals several projects with no defined success metrics. The FIRST corrective action should be:

Answer: Establish benefit KPIs and assign benefits owners for each project

Establishing KPIs and assigning benefits owners creates the accountability structure needed to track and realize benefits.

Which factor MOST determines the frequency of IT governance reporting to stakeholders?

Answer: The stakeholder's role, decision-making needs, and the volatility of the IT environment

Reporting frequency should match how often stakeholders need information to make decisions, adjusted for how rapidly the IT environment is changing.

A 'governance heat map' is BEST used in stakeholder communication to:

Answer: Visually display risk or performance status across IT domains

A governance heat map uses color coding to communicate risk levels or performance status across governance domains in a format quickly understood by stakeholders.

A CGEIT practitioner discovers that IT governance decisions are not being cascaded to operational teams. The BEST corrective action is to:

Answer: Establish a structured communication cascade from governance bodies to operational levels

A communication cascade ensures governance decisions are translated and communicated down to the operational teams who must act on them.