Exactprep CGEIT Questions

This is because alignment with business strategy means that IT projects are selected and executed in a way that supports the organization’s vision, mission, goals, and objectives. Alignment with business strategy can help to ensure that IT projects deliver value to the organization and its stakeholders, as well as to optimize the use of IT resources and capabilities. Alignment with business strategy can also help to avoid or minimize conflicts, gaps, or redundancies among IT projects, as well as to facilitate communication and collaboration among IT and business units.

Some of the sources that support this answer are:

1: This source provides a comprehensive guide on how to optimize IT project intake, approval, and prioritization. It suggests that one of the steps to redesign the governance framework is to conduct a portfolio review to assess the benefits realization of IT investments and ensure that they are aligned with the business strategy and deliver value.

2: This source discusses how to prioritize IT tasks and projects, and provides some expert tips and a downloadable template. It advises that one of the criteria for prioritizing IT projects is strategic alignment, which means that the project supports the organization’s strategic goals and objectives.

3: This source describes the process of how to use the Technology Governance Framework to determine if a proposal requires approval from a formal IT governance body, then how a submitted proposal would proceed on its path to acceptance. It states that one of the factors that influence the prioritization of proposals is alignment with strategic direction, which means that the proposal supports the organization’s vision, mission, values, and goals.

Comprehensive and Detailed Explanation:

The CGEIT Review Manual 8th Edition, in its Risk Optimization domain, underscores the CIO’s role in managing risks associated with new technology deployments. Rapid adoption of a mobile application introduces risks (e.g., security vulnerabilities, integration issues), which the CIO must prioritize to protect the enterprise. Ensuring risk is properly managed involves risk assessments, mitigation plans, and compliance checks (e.g., for data privacy). The manual likely references COBIT 2019’s APO12-Managed Risk, which emphasizes risk management for new IT initiatives.

Option A: Metrics for usage are important but secondary to risk management during implementation.

Option B: Business unit awareness is a communication task, not the CIO’s main responsibility.

Option C: EA review is relevant but less urgent than addressing immediate implementation risks.

Double Verification: The answer aligns with COBIT’s APO12 and the CGEIT domain’s focus on risk management for new technologies. Risk management is a core CIO responsibility in ISACA’s frameworks.

ISACA CGEIT Review Manual 8th Edition, Domain 4: Risk Optimization (focus on technology implementation risks).

COBIT 2019, APO12-Managed Risk.

ISACA Glossary (for definitions of risk management), available at

The most efficient approach for using risk scenarios to evaluate a new business opportunity is to identify risk events from both bottom-up and top-down perspectives. This means that the risk identification process should consider both the specific details of the opportunity, such as the market, customer, product, service, technology, and resources involved, as well as the broader context of the opportunity, such as the strategic objectives, vision, mission, values, and culture of the organization. By using both bottom-up and top-down approaches, the risk identification process can capture a comprehensive and balanced view of the potential risks that could affect the success of the opportunity. This will help to create realistic and relevant risk scenarios that can be analyzed and evaluated for decision-making purposes. A bottom-up approach alone may miss some important risks that are related to the organization’s strategy, governance, or environment, while a top-down approach alone may overlook some specific risks that are unique to the opportunity or its implementation. Therefore, a combination of both approaches is the most efficient way to use risk scenarios for evaluating a new business opportunity. References := What is business risk? | McKinsey, How to Write Strong Risk Scenarios and Statements - ISACA, Finding your blind spots: Recognising emerging risks and opportunities

The board’s concern about the total cost of IT requires a clear explanation of how IT spending is structured. The CGEIT Review Manual 8th Edition notes that providing a breakdown of operational versus capital expenditures is critical to helping stakeholders understand IT costs and their alignment with business value.

Extract from CGEIT Review Manual 8th Edition (Domain 5: Benefits Realization):"When addressing concerns about IT costs, the CIO should provide a clear breakdown of operational expenditures (e.g., maintenance, salaries) versus capital expenditures (e.g., new systems, infrastructure). This transparency helps the board understand cost drivers and their contribution to business value." (Approximate reference: Domain 5, Section on Cost Management)

A breakdown of operational versus capital expenditures (option D) directly addresses the board’s concern by showing how IT funds are allocated, distinguishing between ongoing costs and investments in new capabilities.

Why not the other options?

A. A summary of benefits that will be achieved once key IT initiatives are completed: While benefits are important, they do not directly address the total cost concern, which requires cost transparency first.

B. A mapping of IT employee roles to the balanced scorecard: This is a performance management tool, not directly relevant to explaining total IT costs.

C. A benchmark of IT employee salary costs against comparable organizations: Benchmarking salaries is a narrow focus and does not provide a comprehensive view of total IT costs.