Full Access Isaca CGEIT Tutorials

Outsourcing IT services requires a clear distinction between core and non-core processes to ensure that strategic capabilities are retained in-house while non-core activities are outsourced. The CGEIT Review Manual 8th Edition highlights that identifying core and non-core processes is the most essential consideration for outsourcing decisions.

Extract from CGEIT Review Manual 8th Edition (Domain 5: Benefits Realization):"The most critical consideration in outsourcing IT services is identifying core and non-core business processes. Core processes, which provide competitive advantage, should typically be retained, while non-core processes can be outsourced to improve efficiency and focus on strategic priorities." (Approximate reference: Domain 5, Section on Outsourcing Strategy)

Identification of core and non-core business processes (option A) ensures that outsourcing aligns with the enterprise’s strategic goals and avoids compromising critical capabilities.

Why not the other options?

B. Compliance with enterprise architecture (EA): EA compliance is important but secondary to determining what processes should be outsourced.

C. Alignment with existing human resources (HR) policies and practices: HR alignment is operational and less critical than strategic process identification.

D. Adoption of a diverse vendor selection process: Vendor selection follows the decision to outsource and is not the primary consideration.

Comprehensive and Detailed Explanation:

The CGEIT Review Manual 8th Edition, in its Benefits Realization domain, emphasizes the importance of structured decision-making for IT investments to ensure they deliver value. A business case provides a comprehensive justification for an investment, including objectives, costs, benefits, risks, and alignment with business goals. It enables stakeholders to make informed decisions by presenting a clear rationale and expected outcomes. For example, a business case for a new CRM system would detail projected revenue increases and implementation costs. The manual likely references COBIT 2019’s APO05-Managed Portfolio, which highlights the business case as a critical tool for investment evaluation.

Option B: Technology roadmap outlines future technology plans but lacks the detailed financial and benefit analysis needed for investment decisions.

Option C: Program plan focuses on execution details, not the justification for investment.

Option D: Risk classification addresses risk but doesn’t encompass the full scope of benefits and costs.

Double Verification: The answer aligns with COBIT’s APO05 and the CGEIT domain’s focus on value-driven investment decisions. The business case is a standard ISACA tool for informed decision-making.

ISACA CGEIT Review Manual 8th Edition, Domain 3: Benefits Realization (focus on investment decision-making).

COBIT 2019, APO05-Managed Portfolio.

ISACA Glossary (for definitions of business case), available at

The most important thing for a data steward to verify when a system’s data is edited by an automated tool to fix an incident is that the change maintains consistency among databases and has no other impacts. Data consistency is a dimension of data quality that describes the data’s uniformity as it moves across applications and networks and when it comes from multiple sources1. Data is considered consistent if two or more values in different locations are identical and do not conflict1. Data consistency is related to data integrity and data currency1. To ensure data consistency, some steps include data governance, automated data integration, and regular data audits and quality control checks1. If the automated tool changes the data in one database, but not in others, it can create inconsistencies and errors that affect the reliability and usability of the data. Similarly, if the automated tool changes the data in a way that affects other processes or systems that depend on the data, it can cause disruptions and failures that impact the business operations and performance. Therefore, the data steward should verify that the change is consistent and has no other impacts before approving it.

The other options are not as important as verifying the data consistency and impact of the change. Requesting and approving the change by the business department and the data owner is a good practice, but not a verification step. Documenting the change in preparation for future audits is a necessary step, but not a verification step. Addressing the permanent solution for the incident by problem management is a relevant step, but not a verification step. References := What is Data Quality - Definition, Dimensions … - Simplilearn

Performing a gap analysisis the first step in understanding whether existing IT capabilities and resources are sufficient to meet the demands of a new enterprise strategy. A gap analysiscompares current capabilities with the strategic requirements, identifying shortfalls in skills, infrastructure, processes, and other resources.

Only after identifying the gaps can appropriate planning (e.g., capacity management, capability strategy, resource management) be effectively initiated.