Isaca Updated COBIT-2019 Exam Questions and Answers by edmund

The enterprise’s risk profile is the most important enterprise risk management concept to fully understand prior to finalizing the design of an IT governance system. Enterprise risk management is the process of identifying, analyzing, evaluating, treating, monitoring, and communicating risks that affect the achievement of enterprise objectives. Enterprise risk management concepts include risk appetite (the amount and type of risk that an enterprise is willing to accept), risk tolerance (the acceptable variation in outcomes related to specific performance measures), risk profile (the overall exposure or level of risk that an enterprise faces), etc. The enterprise’s risk profile is the most important concept to fully understand prior to finalizing the design of an IT governance system because it helps to determine the appropriate level of risk optimization for each governance objective.14 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance System

The risk profile is a design factor that describes how an enterprise identifies, assesses, responds to, monitors, and reports on information and technology risks. The risk profile helps to determine the level of risk appetite and tolerance that an enterprise has for its information and technology activities, as well as the level of control and assurance that is required for its governance framework. When tailoring COBIT 2019 to enterprise requirements, the primary objective of preparing a risk profile is to identify areas of risk that exceed risk appetite. The risk appetite is the amount and type of risk that an enterprise is willing to accept in pursuit of its objectives. The risk appetite provides a basis for defining the risk criteria, thresholds, indicators, and responses that will be used in the risk profile process. By identifying areas of risk that exceed risk appetite, an enterprise can prioritize its governance objectives, processes, practices, roles, structures, and metrics according to the level of risk exposure and impact. This will also help to align the governance framework with the enterprise’s strategy and objectives.

 The Build, Acquire and Implement (BAI) domain deals with the definition of IT solutions and their integration in business processes. This domain covers the activities related to identifying, developing, acquiring, implementing, testing, integrating, and deploying IT solutions that meet business requirements. The BAI domain consists of 10 management objectives that describe the desired outcomes of these activities.14 References: COBIT 2019 Framework: Introduction and Methodology, COBIT 2019 Framework: Governance and Management Objectives

 According to the COBIT 2019 Process Assessment Model, a common characteristic of process capability levels 2 to 5 is that the process’s description is well-defined. This means that the process has a clear purpose, scope, inputs, outputs, activities, roles, responsibilities, interfaces, controls, measures, practices and procedures that are documented and maintained. A well-defined process enables consistent executionand improvement across the enterprise.2, p. 16 References: 2: COBIT 2019 Process Assessment Model: Using COBIT 2019