Free Practice Questions for Isaca CGEIT Exam

 The business manager has the primary responsibility to define the requirements for IT service levels for the enterprise, as they are the ones who understand the business needs, objectives, and expectations from the IT services. The business manager should communicate these requirements to the IT service provider, who should then design, deliver, and monitor the IT services according to the agreed service levels. The help desk, the CIO, and the business continuity vendor are not primarily responsible for defining the IT service level requirements, although they may have roles in supporting, implementing, or ensuring them. References := CGEIT Review Manual, 27th Edition, Domain 1: Governance of Enterprise IT, page 20-21.

 The PRIMARY purpose of information governance is to set direction for information management capabilities through prioritization and decision making. Information governance is the overall strategy for information at an organization. It balances the risk that information presents with the value that information provides1. Information governance helps with legal compliance, operational transparency, and reducing expenditures associated with legal discovery1. To achieve this, information governance requires setting direction for information management capabilities through prioritization and decision making. This involves defining and implementing policies and processes for the effective and efficient acquisition, storage, distribution, usage, and disposal of information in alignment with business objectives and regulatory requirements2. It also involves ensuring the protection of information quality, integrity, availability, confidentiality, and ownership2. By setting direction for information management capabilities through prioritization and decision making, information governance can help to optimize the value and minimize the risk of information assets. References :=

Information governance - Wikipedia1

What is Information Governance? Why is it Important?3

The risk profile of the enterprise is the most important thing to consider first when conducting a risk assessment in support of a new regulatory requirement, as it reflects the overall exposure and tolerance of the enterprise to various types of risks, such as strategic, operational, financial, or compliance risks. The risk profile of the enterprise can help determine the scope, objectives, and criteria of the risk assessment, as well as the prioritization and allocation of resources and efforts for risk identification, analysis, evaluation, and treatment. The risk profile of the enterprise can also help align the risk assessment with the enterprise’s strategy, goals, and values, as well as ensure consistency and integration with other risk management activities or processes.

Disruption to normal business operations, readiness of IT systems to address the risk, and cost burden to achieve compliance are also important things to consider when conducting a risk assessment in support of a new regulatory requirement, but they are not the first thing to consider. Disruption to normal business operations is a potential consequence or impact of the risk on the enterprise’s performance, productivity, or continuity. Disruption to normal business operations can be assessed and measured during the risk analysis or evaluation stage of the risk assessment, as well as mitigated or reduced during the risk treatment or response stage. Readiness of IT systems to address the risk is a factor that affects the capability or maturity of the enterprise’s IT infrastructure, applications, or services to comply with or support the new regulatory requirement. Readiness of IT systems to address the risk can be assessed and improved during the risk treatment or response stage of the risk assessment, as well as monitored and reported during the risk communication or review stage. Cost burden to achieve compliance is a factor that affects the feasibility or affordability of the enterprise’s actions or investments to comply with or support the new regulatory requirement. Cost burden to achieve compliance can be estimated and optimized during the risk treatment or response stage of the risk assessment, as well as balanced with the benefits or value of compliance.

 Enterprise IT governance is the process of ensuring that IT supports the business objectives and strategies of the enterprise, and that IT investments and resources are aligned with the enterprise’s needs and priorities1. The effectiveness of enterprise IT governance can be measured by the extent to which the business objectives are achieved through IT-enabled initiatives and services2. An IT balanced scorecard, business objectives definition, and IT processes measurement are all tools or activities that can help implement and monitor enterprise IT governance, but they do not demonstrate its effectiveness by themselves345. References :=

IT Governance: Definition, Frameworks, and Best Practices - InvGate

The keys to effective IT governance in the digital era | CIO

Defining IT Governance and Its Roles for Business Success - ISACA

Governance of Enterprise IT - The Institute of Internal Auditors or The IIA

Holistic IT Governance, Risk Management, Security and Privacy … - ISACA

 To enable the development of required IT skill sets for the enterprise, it is most important to define skill requirements based on each role within the IT department, because different roles may have different responsibilities, tasks, and expectations that require specific skills and competencies. By defining skill requirements based on each role, the enterprise can ensure that the IT staff have the appropriate knowledge, abilities, and experience to perform their roles effectively and efficiently, and to support the enterprise’s goals and objectives. According to ISACA’s CGEIT Domain 2: IT Resources1, “the enterprise should identify the skills required for each IT role and assess the current and future skill gaps.” Furthermore, according to ISACA’s article on IT Skills Gap2, “the skills gap is not a one-size-fits-all problem. It varies by industry, organization and department/role.” Therefore, defining skill requirements based on each role within the IT department is the best way to enable the development of required IT skill sets for the enterprise. References:

IT Skills Gap: Trends, Implications and Best Practices - ISACA

IT Governance: Definitions, Frameworks and Planning - ProjectManager

What is IT governance? A formal way to align IT & business strategy | CIO

CGEIT Domain 2: IT Resources

 The first step for the newly hired CIO to address the problem of IT governance process not being followed is to gain an understanding of the existing governance process and corporateculture. This will help the CIO to identify the root causes of the problem, such as lack of awareness, commitment, alignment, communication, or accountability. It will also help the CIO to assess the strengths and weaknesses of the current process, as well as the opportunities and threats for improvement. By understanding the existing governance process and corporate culture, the CIO can also build trust and rapport with the stakeholders, and tailor the solutions to fit the specific needs and context of the enterprise. References: CGEIT Review Manual (Digital Version) or CGEIT Review Manual (Print Version), Chapter 1: Governance of Enterprise IT, Section 1.2: IT Governance Implementation, Subsection 1.2.1: IT Governance Implementation Process, Page 27-28. What is CGEIT? A certification for seasoned IT governance professionals.

The first step for executive management to take in communicating what is considered acceptable use with regard to personally owned devices for company business is to develop and disseminate an applicable policy. A policy is a written set of rules and guidelines that defines the scope, objectives, roles, and responsibilities of the BYOD program. A policy also specifies the security, privacy, and usage requirements and expectations for the employees and the organization. A policy helps to establish a clear and consistent understanding of what is acceptable and unacceptable when using personal devices for work purposes, and what are the consequences of non-compliance. A policy also helps to mitigate the potential risks and challenges associated with BYOD, such as data breaches, device loss or theft, malware infections, legal liabilities, and support issues. A policy should be developed in consultation with relevant stakeholders, such asIT, HR, legal, and business units, and disseminated to all employees through various channels, such as email, intranet, training sessions, and awareness campaigns. References: BYOD Policies for Organizations (4 Examples) - Dashlane1, Mobile Device Security–Bring Your Own Device (BYOD): Draft SP 1800-22 …2, Personally Owned Device Policy — FBI

The main goal of the IT strategy committee after establishing stakeholder desired outcomes should be to ensure IT risk alignment with enterprise risk. IT risk alignment means that the IT risk management program is consistent and integrated with the enterprise risk management (ERM) program, and that the IT risks are identified, assessed, and treated in relation to the enterprise’s objectives, strategies, and risk appetite. IT risk alignment can help the enterprise achieve the following benefits1:

Enhance the value delivery of IT to the business

Improve the decision making and prioritization of IT investments and initiatives

Reduce the likelihood and impact of IT-related incidents and losses

Increase the resilience and agility of IT in responding to changes and disruptions

Strengthen the governance and accountability of IT performance and compliance

To ensure IT risk alignment with enterprise risk, the IT strategy committee should perform the following tasks2:

Define the scope, objectives, and criteria for IT risk management

Establish the roles and responsibilities for IT risk management

Align the IT risk management framework and processes with the ERM framework and processes

Communicate and collaborate with the ERM function and other stakeholders on IT risk issues

Monitor and review the effectiveness and maturity of IT risk management

The other options are not the main goal of the IT strategy committee after establishing stakeholder desired outcomes. Identifying business data that requires protection, performing a risk analysis on key IT processes, and implementing controls to address high risk areas are steps that are part of the IT risk management process, but they are not specific to ensuring IT risk alignment with enterprise risk. These steps should be done by the IT risk management function or team, under the guidance and oversight of the IT strategy committee.

The first step in establishing a risk management process is to identify assets, because assets are the resources that have value to the organization and need to be protected from potential threats. Assets can include physical, human, information, financial, and intangible assets. Identifying assets helps to determine their criticality, ownership, and dependencies, as well as the potential impact of losing or compromising them. According to the ISO 31000:2018 standard, one of the components of the risk management framework is establishing the context, which includes defining the scope, objectives, and criteria for risk management, as well as identifying the internal and external factors that can affect the achievement of objectives1. Identifying assets is part of establishing the context. The other steps of the risk management process, such as identifying threats, determining the probability of occurrence, assessing risk exposures, and implementing risk treatments, follow after identifying assets. References := 1: ISO 31000:2018(en), Risk management — Guidelines

 The best way to prevent adverse effects to the enterprise resulting from the new technology is to develop key risk indicators (KRIs), because they are metrics that measure the potential impact and likelihood of the risks associated with the new technology, and provide early warning signals for taking corrective actions. KRIs can help the enterprise to monitor and manage the risks of integrating the new technology with the current IT infrastructure, and to ensure that the expected benefits and value are realized12. References := ISACA, CGEIT Review Manual, 7th Edition, 2019, page 75-76.

 A data classification policy is a plan that helps an organization determine the risk tolerance and security requirements for its data assets. A data classification policy separates data into different categories based on its sensitivity, such as public, private, or restricted. A data classification policy should be established first so that data owners can consistently assess the level of data protection needed across the enterprise, as it helps them to identify the types and locations of data they own, the potential threats and impacts of data breaches, and the appropriate security controls and measures to safeguard their data. A data classification policy also helps to ensure compliance with regulatory and legal obligations, as well as to optimize data management and governance practices. References: CGEIT Exam Content Outline | ISACA1, CGEIT Review Manual (Digital Version), Data Classification Policy: Benefits, Examples, and Techniques2, Why data classification is important for security | Infosec3

because this would help to address the concern of business management that controls are in place to help minimize the risk of critical IT systems being unavailable during month-end financial processing. Key risk indicators (KRIs) are metrics that measure the potential impact and likelihood of the risks that may affect the IT performance and outcomes, and provide early warning signals for taking corrective actions12. Action plans are specific steps and tasks that are designed to implement the risk response strategies, such as avoiding, reducing, transferring, or accepting the risks12. Developing KRIs and action plans can help the CIO to monitor and manage the risks of IT system unavailability, and to ensure that the expected benefits and value are realized. Developing KRIs and action plans can also help to communicate and report the risk scenarios and their consequences to business management, and to demonstrate the effectiveness and efficiency of the IT controls12.

According to the web search results, a request for proposal (RFP) is a formal document that solicits proposals from potential vendors for a product or service. The RFP process is intended toensure a fair, transparent and objective selection of the best vendor that meets the requirements and expectations of the project sponsor and the enterprise. The RFP process typically involves the following steps1:

Planning and preparation: Define the scope, objectives, budget, timeline and evaluation criteria of the project. Identify the stakeholders and decision makers involved in the RFP process. Research the market and potential vendors. Develop the RFP document that outlines the project details, requirements, expectations and instructions for the vendors.

Issuing and advertising: Distribute the RFP document to the potential vendors, either directly or through public channels. Provide a deadline for submitting proposals and a contact person for inquiries. Advertise the RFP opportunity to attract more qualified vendors.

Receiving and reviewing: Receive the proposals from the vendors by the deadline. Review and evaluate the proposals based on the predefined criteria, such as technical capabilities, experience, references, pricing, etc. Shortlist the most suitable vendors for further consideration.

Negotiating and awarding: Conduct negotiations with the shortlisted vendors to clarify any questions, concerns or issues. Discuss the terms and conditions of the contract, such as scope, deliverables, schedule, payment, etc. Select the best vendor that offers the most value and benefit to the project and the enterprise. Award the contract to the chosen vendor and notify the other vendors of the decision.

Managing and monitoring: Manage and monitor the performance and progress of the vendor throughout the project lifecycle. Ensure that the vendor meets the contractual obligations and delivers quality results on time and within budget. Provide feedback and support to the vendor as needed. Resolve any conflicts or disputes that may arise.

A project sponsor who circumvents the RFP selection process violates the established policies and procedures of the enterprise, as well as undermines the integrity and credibility of the RFP process. The most likely reason for this control gap is a lack of accountability for policy adherence, which means that there is no clear assignment of roles and responsibilities for following and enforcing the policies, or no effective mechanisms for monitoring and reporting policy compliance, or no adequate consequences for policy violations. A lack of accountability for policy adherence can lead to poor governance, increased risk, reduced value and damaged reputation for both the project sponsor and the enterprise23. Therefore, it is essential to establish and maintain a strong culture of accountability for policy adherence within the enterprise, as well as to implement appropriate controls and measures to ensure compliance with policies. References: The RFP process: The Ultimate Step-by-Step Guide, Criteria and Methodology for GRC Platform Selection, The Ultimate RFP Guide: Steps, Guidelines & Template, Guidebook: Crafting a Driven Request for Proposals (RFP)

 The first step in aligning resource management to the enterprise’s IT strategic plan would be to perform a gap analysis. A gap analysis is a process of comparing the current state and performance of the IT resources with the desired state and expectations of the IT strategic plan. IT resources include people, processes, technology, and information that support the delivery and management of IT services and solutions1. A gap analysis can help identify the strengths, weaknesses, opportunities, and threats of the IT resources, as well as the gaps, risks, and issues that need to be addressed. A gap analysis can also provide insights and recommendations for improving and aligning the IT resources with the IT strategic plan. According to 2, one of the steps in developing an IT strategic plan is to conduct a gap analysis to assess the current capabilities and resources of the IT organization and determine the gaps between the current and future states.

The other options are not the first steps in aligning resource management to the enterprise’s IT strategic plan. Developing a responsible, accountable, consulted and informed (RACI) chart is a step that may be done after performing a gap analysis, as it involves defining and clarifying the roles and responsibilities of the IT stakeholders for each task or activity in the IT strategic plan3. Assigning appropriate roles and responsibilities is a step that may be done after performing a gap analysis, as it involves allocating and delegating the IT resources to the relevant tasks or activities in the IT strategic plan. Identifying outsourcing opportunities is a step that may be done after performing a gap analysis, as it involves evaluating and selecting external vendors or partners that can provide IT services or solutions that are not available or feasible internally4. References := 1: What are IT Resources? Definition & Examples - BMC Software13: RACI Chart: Definition & Example - Project Management34: Outsourcing: Definition & Examples - Investopedia42: How to Create an Effective IT Strategy - Smartsheet2

Total cost of ownership (TCO) is the purchase price of an asset plus the costs of operation over its lifespan1. TCO includes hardware and software acquisition, management and support, communications, end-user expenses and the opportunity cost of downtime, training and other productivity losses2. By considering TCO in investment decisions, an enterprise can avoid unexpected costs and optimize the value of its IT assets3. A policy to consider TCO in investment decisions can help the enterprise to plan ahead for the lease or purchase of ITinfrastructure and software licenses, and avoid cost overruns due to lease extensions or other factors. References :=

CGEIT Review Manual (Digital Version), Chapter 4: Value Optimization, Section 4.2: IT Value Delivery, Subsection 4.2.3: IT Resource Management, Page 123

CGEIT Review Manual (Print Version), Chapter 4: Value Optimization, Section 4.2: IT Value Delivery, Subsection 4.2.3: IT Resource Management, Page 123

How to Calculate Total Cost of Ownership for Software - GetApp4

Total Cost of Ownership: How It’s Calculated With Example - Investopedia1