CGEIT Questions Bank

The best way for an IT steering committee to monitor the adoption of a new enterprise IT strategy is to establish key performance indicators (KPIs), because they are metrics that measure the progress and achievement of the IT strategic objectives and goals, and provide feedback and guidance for improvement. KPIs can help the IT steering committee to track and evaluate the performance and outcomes of the IT function, and to ensure that the IT activities and resources are aligned with the business needs and expectations12. KPIs can also help to communicate and report the IT value delivery and innovation to the board and other stakeholders12. References := ISACA, CGEIT Review Manual, 7th Edition, 2019, page 43-44.

 The first step to address the issue of complaints from business executives regarding the amount their units are being charged for IT services should be to quantify consumption and service level agreement (SLA) achievements per business unit. This will help the CIO to understand the actual usage and performance of IT services by each business unit, as well as to justify and communicate the chargeback rates based on the value and quality of IT services delivered. Quantifying consumption and SLA achievements can also help identify and address any inefficiencies, discrepancies, or gaps in IT service delivery or chargeback methods.

Agreeing to reduce charge rates and improve relationship management with the business, looking into outsourcing of support functions to drive down the cost structure, and asking the CFO about budget revisions for the business units’ IT expenditures are possible steps to take after quantifying consumption and SLA achievements, but they are not the first step. Agreeing to reduce charge rates without understanding the underlying causes of the complaints may result in underfunding or underpricing of IT services, which may affect their quality and sustainability. Improving relationship management with the business is important, but it should be based on transparent and accurate information about IT service consumption and chargeback. Looking into outsourcing of support functions may reduce the cost structure, but it may also introduce new risks and challenges for IT governance and management. Asking the CFO about budget revisions may help align IT expenditures with business priorities, but it may not address the root causes of the dissatisfaction with IT chargeback.

References := IT Chargeback Drives Efficiency - Uptime Institute Blog; What is IT governance? A formal way to align IT & business strategy; Chargeback vs. IT Governance – HEIT Management.

 The first course of action when assessing the impact of a new regulatory requirement is to map the regulation to business processes. This means identifying and analyzing which business processes are affected by the new regulation, how they are affected, and what changes are needed to comply with the regulation1. Mapping the regulation to business processes helps to understand the scope, complexity, and priority of the regulatory compliance project, and to align the IT and business objectives and strategies1. It also helps to identify the stakeholders, roles, responsibilities, and risks involved in the compliance process, and to communicate and coordinate with them effectively1. The other options are not as important as mapping the regulation to business processes, as they are dependent on the outcome of this step. Updatingaffected IT policies, assessing the budget impact of the new regulation, and implementing new regulatory requirements are subsequent steps that should be done after mapping the regulation to business processes2. References: How to Map Regulations to Business Processes. CGEIT Certification | Certified in Governance of Enterprise IT | ISACA.

The number of events impacting business processes due to delays in responding to risks is the best outcome measure to determine the effectiveness of IT risk management processes, because it reflects the actual consequences and losses that result from inadequate or ineffective riskmanagement. Outcome measures are metrics that evaluate the results and benefits of a process or activity, rather than the inputs or outputs1. Outcome measures help to assess whether the process or activity is achieving its objectives and delivering value to the organization1. The number of events impacting business processes due to delays in responding to risks is an outcome measure that indicates how well the IT risk management processes are able to identify, analyze, evaluate, treat, monitor, and communicate IT risks in a timely and appropriate manner. A high number of such events would suggest that the IT risk management processes are not effective, and that they need to be improved or revised. A low number of such events would suggest that the IT risk management processes are effective, and that they are reducing the likelihood and impact of IT risks on the organization.

References := How To Measure Risk Management KPI & Metrics - ERM Software