Isaca Updated CGEIT Exam Questions and Answers by koda

Understanding the root causeis the essential first step. The CEO shouldwork with regional leadershipto gather context before applying solutions or imposing changes. This collaborative approach ensures that corrective actions are informed, targeted, and not based on assumptions.

Other steps like reviewing business cases or revising benefits calculations may follow, butdiagnosis must come before treatment.

When a regulatory change significantly affects an ongoing project, thefirst step should be to perform an impact analysis and update the business case.This helps the organization understand how the change influences cost, timelines, compliance, and value delivery.

Only after understanding the impact should actions such as seeking reapproval, changing scope, or applying for exemptions be considered. This aligns with the principle of informed decision-making in IT governance.

Monitoring the adoption of a new IT strategy requires measurable indicators that track progress and alignment with strategic objectives. The CGEIT Review Manual 8th Edition highlights that key performance indicators (KPIs) are the primary tool for monitoring strategy implementation, as they measure performance against defined goals.

Extract from CGEIT Review Manual 8th Edition (Domain 4: Strategic Management):"Key performance indicators (KPIs) are essential for monitoring the implementation and adoption of an IT strategy. KPIs provide measurable data on progress toward strategic objectives, enabling the IT steering committee to assess effectiveness and make informed adjustments." (Approximate reference: Domain 4, Section on Strategy Monitoring)

Establishing KPIs (option B) allows the IT steering committee to track the strategy’s success, identify gaps, and ensure alignment with enterprise goals, making it the best approach for monitoring adoption.

Why not the other options?

A. Implement service level agreements (SLAs): SLAs are operational agreements for service delivery, not strategic monitoring tools.

C. Schedule ongoing audit reviews: Audits provide assurance but are periodic and not designed for ongoing strategy monitoring.

D. Establish key risk indicators (KRIs): KRIs focus on risk exposure, not on measuring strategy adoption or performance.

Developing an IT risk management framework begins with aligning it to the enterprise risk management (ERM) framework. This ensures consistency across all organizational risk domains and supports the integration of IT risk into the broader enterprise risk strategy. The ERM provides a foundation for identifying, assessing, and managing IT risks in a way that aligns with the organization's overall objectives. Promoting a culture of risk awareness, while critical, is a subsequent step once the framework is defined. References: COBIT 2019 Risk Management Process, CGEIT Exam Manual.