Ace Your CGEIT Isaca Certification Exam

IT maturity models measure the capabilities of an IT organization, which means the ability to perform certain activities or tasks effectively and efficiently. IT maturity models assess the current state of the IT organization in terms of people, processes, and technology, and compare it with the desired or optimal state. IT maturity models also help to identify the gaps and opportunities for improvement, and to prioritize and plan the actions to achieve higher levels of maturity. IT maturity models can be used for various purposes, such as benchmarking, strategic planning, performance management, risk management, and quality assurance. References: CGEIT Exam Content Outline | ISACA1, CGEIT Review Manual (Digital Version), Use an IT maturity model - IBM Garage Practices1, IT Maturity Models, Scorecards & Assessments | Smartsheet2

The first thing that the enterprise should do after learning of a new regulation that may impact delivery of one of its core technology services is to assess the risk associated with the new regulation. A risk assessment is a process of identifying, analyzing, and evaluating the potential threats and impacts of a risk event on the enterprise’s objectives, processes, and resources1. A risk assessment can help the enterprise understand the nature, scope, and severity of the new regulation, as well as its compliance requirements, costs, and benefits. A risk assessment can also help the enterprise prioritize and implement the appropriate risk responses, such as avoiding, reducing, transferring, or accepting the risk2. According to COBIT 5, one of the seven enablers of IT governance is risk management, which includes assessing IT-related risks and aligning them with enterprise risks3. The risk assessment is also part of the IT governance domain 3: Risk Management4.

The other options are not the first things that the enterprise should do after learning of a new regulation. Updating the risk management framework is a step that may be done after assessing the risk associated with the new regulation, as it involves reviewing and improving the policies, procedures, and practices for managing IT risks in the enterprise. Determining whether the board wants to comply with the regulation is a step that may be done after assessing the risk associated with the new regulation, as it involves consulting with the board and other stakeholders on the strategic and ethical implications of complying or not complying with the regulation. Requesting an action plan from the risk team is a step that may be done after assessing the risk associated with the new regulation, as it involves defining and executing the tasks and activities for achieving compliance and mitigating risk.

The main responsibility of the board of directors regarding the management of enterprise risk is to ensure a risk process exists which addresses the risk appetite, because this would help the board to oversee and direct the enterprise’s risk management activities and ensure that they are aligned with the enterprise’s strategic objectives and value creation. The risk process should include identifying, assessing, responding, monitoring, and reporting the risks that may affect the enterprise’s performance and outcomes, and ensuring that the risks are within the acceptable level that the enterprise is willing and able to tolerate12. The other options are not the main responsibility of the board of directors, because they are either part of or dependent on the risk process.

Portfolio management is the most useful technique for prioritizing IT improvement initiatives to achieve desired business outcomes. Portfolio management is the process of selecting, prioritizing, balancing, and monitoring the IT investments and initiatives that support the enterprise’s strategic objectives and deliver value to the stakeholders1. Portfolio management helps to align IT with business goals, optimize resource allocation, manage risks and dependencies, and measure performance and benefits1. By applying portfolio management, an enterprise can ensure that the IT improvement initiatives are consistent with its vision, mission, values, and priorities, and that they contribute to the desired business outcomes1. References: CGEIT Review Manual (Digital Version) or CGEIT Review Manual (Print Version), Chapter 3: Benefits Realization, Section 3.1: IT Portfolio Management, Page 83-84. What is IT portfolio management? A framework for aligning technology and business.