Pass CGEIT Exam Guide

According to the CGEIT certification guide, the best method for determining an enterprise’s current appetite for risk is interviewing senior management. This is because senior management is responsible for setting the risk appetite and tolerance of the enterprise, and for balancing the security and business needs. The risk appetite reflects the amount and type of risk that an organization is willing to take in order to meet their strategic objectives. Interviewing senior management can help to understand their perspectives, expectations, and preferences regarding risk taking1. The other options are less effective than option A, as they do not directly capture the senior management’s input or risk-based decision making. References := CGEIT certification guide, domain 3: Risk Optimization, section 3.1: Risk Governance, page 87.

The most important action to address the concern of executive management about the current strategy of executing projects as they are submitted is to create a combined business/IT committee to determine project prioritization. This action will help to ensure that the IT projects are aligned with the enterprise’s objectives, strategies, and values, and that they deliver the highest value and impact to the business and the customers. A combined business/IT committee can also facilitate the communication, collaboration, and coordination among the stakeholders involved in the IT projects, and resolve any conflicts or issues that may arise. A combined business/IT committee can use various project prioritization methods, such as scoring models, prioritization matrices, payback periods, or portfolio dashboards, to evaluate and rank the IT projects based on criteria such as business value, urgency, feasibility, risk, and resource availability

 One of the main benefits of ERP systems is that they can integrate and streamline various business processes across an enterprise, such as accounting, inventory, sales, human resources, etc. However, this also means that different regions or departments may have to adopt common or standardized processes that are supported by the ERP system, rather than using their own customized or localized ones. This can reduce the complexity and cost of implementing and maintaining the ERP system, as well as improve data quality and consistency. According to one of the web search results1, “it’s important to always keep those processes at the core of yourimplementation plan” and “an ERP implementation is an opportunity to introduce a better process, not simply to automate an existing inefficient one.” Another web search result2 states that “standardizing ERP processes across regions” is one of the best practices for a successful ERP implementation. Therefore, the best approach in the planning phase of the project is to minimize customization by standardizing ERP processes across regions. References := 9 Key ERP Implementation Best Practices | NetSuite, 6 Best Practices for a Successful ERP Implementation

The primary reason this situation should be escalated to the IT steering committee is B. Ethical concerns. This is because using data for a purpose that is outside the original intention may violate the principle of purpose limitation, which states that personal data should be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes1. Using data for a different purpose may also breach the trust and expectations of the individuals who provided the data, and may harm their rights and interests. Therefore, the IT director should consult the IT steering committee, which is a group of senior executives who are responsible for developing and enforcing the organization’s IT priorities and policies2, to determine whether the new use of data is ethical, lawful, and transparent. The IT steering committee should also consider the following aspects before making a decision:

The link between the original purpose and the new/upcoming purpose: How closely related are the two purposes? Is the new purpose compatible with the original purpose or does it contradict it?

The context in which the data was collected: What was the relationship between the organization and the individuals at the time of data collection? What did the individuals consent to or expect from the data processing?

The type and nature of the data: Is the data sensitive, personal, or confidential? Does it reveal any information about the individuals’ identity, preferences, behavior, or opinions?

The possible consequences of the intended further processing: How will the new use of data affect the individuals and the organization? Will it benefit or harm them? Will it create any risks or opportunities?

The existence of appropriate safeguards: What measures are in place to protect and manage the data according to the data protection principles and standards? How can the data quality, security, privacy, and compliance be ensured or improved?

By escalating this situation to the IT steering committee, the IT director can ensure that the ethical implications of using data for another purpose are properly assessed and addressed.