Isaca Updated CGEIT Exam Questions and Answers by sullivan

An enterprise’s board of directors can best manage enterprise risk by requiring the establishment of an ERM framework. An ERM framework is a methodology that looks at risk management strategically from the perspective of the entire firm or organization. It is a top-down strategy that aims to identify, assess, and prepare for potential losses, dangers, hazards, and other potentialsfor harm that may interfere with an organization’s operations and objectives and/or lead to losses. An ERM framework provides structured feedback and guidance to business units, executive management, and board members implementing and managing ERM programs. An ERM framework helps establish a consistent risk management culture, regardless of employee turnover or industry standards. It also often involves making the risk plan of action available to all stakeholders as part of an annual report

 An organizational change management plan is the best option to have in place prior to the start of an initiative to upgrade the technology and related processes of a rail transport company that has the worst on-time arrival record in the industry due to an antiquated IT system that controls scheduling. An organizational change management plan is a document that outlines the strategy, approach, and actions for managing and implementing a change within an organization. It helps to prepare the organization and its stakeholders for the change, communicate the vision and benefits of the change, address the potential resistance and challenges of the change, and monitorand evaluate the progress and outcomes of the change. An organizational change management plan is especially important for a project that involves a significant technological and process change that may impact the culture, performance, and satisfaction of the employees. By having an organizational change management plan in place before the start of the initiative, the rail transport company can maximize employee engagement throughout the project, and ensure a smooth and successful transition to the new IT system and processes

A responsive risk awareness culture is the best reflection of mature risk management in an enterprise, because it implies that the organization has a high level of risk maturity that enables it to reduce noise and focus more effectively on truly high-risk concerns, choose cost-effective solutions for the risk management priorities, and execute reliably1. A responsive risk awareness culture also means that the organization has a clear and consistent risk appetite and tolerance, and that the employees are cognizant of the relevant risks as part of their actions2. A responsive risk awareness culture also fosters trust, collaboration, and innovation among the stakeholders, and helps the organization to adapt to changing business environments and emerging risks3.

The other options are not as indicative of mature risk management in an enterprise, because they are either too narrow or too reactive. A regularly updated risk register is a useful tool forcataloguing, tracking, and mitigating risks, but it does not necessarily reflect the strategic alignment, integration, or performance of the risk management process4. Ongoing risk assessment is an essential activity for identifying and evaluating risks, but it does not guarantee that the risks are prioritized, communicated, or managed effectively5. Ongoing investment in risk mitigation is a sign of commitment to risk management, but it does not ensure that the investment is aligned with the risk appetite and tolerance, or that it delivers value to the organization5.

 An assessment to determine if data privacy protection is addressed is the first request that the IT steering committee should make to comply with the board’s mandate, as it helps to ensure that the use of geolocation software does not violate any applicable laws, regulations, or ethical standards regarding the collection, processing, and sharing of personal or sensitive data. Data privacy protection is an important aspect of information governance, which is part of the CGEIT Domain 1: Governance of Enterprise IT1. An assessment can also identify the risks and controls associated with the geolocation software, and provide recommendations and best practices for its implementation and management2. References := CGEIT Exam Content Outline, Domain 1, Subtopic C: Information Governance, Task 1: Define and implement information governance processes to ensure alignment with enterprise goals and objectives.