ICAB PL IT Governance common mistakes
ICAB PL IT Governance · Understand the traps and how to avoid them.
Answering governance questions by describing what a single IT department does operationally, rather than describing who decides, who is accountable, and how oversight is exercised across the organisation.
Candidates carry over hands-on IT experience and default to technical or operational fixes; the syllabus frames governance as direction-setting and monitoring, so operational answers read as off-syllabus even when factually sensible.
What to do instead
Before writing, classify the scenario: if the question asks about direction, decision rights, accountability or oversight, answer in terms of governing body, delegated authority, escalation route and monitoring mechanism. Reserve operational detail for questions explicitly about execution or service delivery.
Treating IT governance as interchangeable with IT management, so answers assign accountability to the CIO or IT manager for outcomes that the board or an executive committee actually owns.
The two terms are used loosely in everyday workplaces, and candidates map the exam scenario onto their own reporting line instead of the accountability model the syllabus expects.
What to do instead
Memorise the distinction: management plans, builds and runs; governance evaluates, directs and monitors. In every accountability question, ask who is ultimately answerable to stakeholders, and place that responsibility with the governing body or its delegate, not the delivery function.
Producing a strategy answer that lists technology initiatives (cloud migration, ERP upgrade, tooling refresh) without linking each to a stated business objective, outcome measure or value case.
Candidates equate IT strategy with a technology roadmap because that is how plans are often presented internally; the exam rewards alignment logic, so pure initiative lists score poorly on the higher-mark parts.
What to do instead
Structure every strategy response as objective, then enabling capability, then measure of success. For each initiative named, state the business outcome it serves and how progress will be evidenced. If an initiative cannot be tied to an objective, cut it or flag it as unfunded.
Ignoring the distinction between strategic alignment and portfolio prioritisation, and answering a prioritisation scenario with a general statement that IT should 'support business goals'.
The generic alignment phrase feels safe and is easy to recall, so candidates use it as a catch-all instead of applying a decision method to competing demands.
What to do instead
For prioritisation questions, name an explicit mechanism: a documented intake and assessment process, agreed scoring criteria tied to strategic objectives, a decision forum with business representation, and a review cadence. Show how the mechanism resolves the specific conflict in the scenario.
Describing risk identification only, or listing threats, when the question asks for a full risk management approach covering assessment, treatment, tolerance and monitoring.
Identification is the most visible and intuitive step, and candidates run out of scope before reaching appetite, treatment options and reporting.
What to do instead
Use a fixed sequence in every risk answer: identify, analyse and evaluate against agreed criteria, treat (avoid, reduce, transfer, accept), record in a register with owners, monitor and report to the appropriate level. Check that appetite or tolerance is explicitly mentioned, since its absence is a common mark-loser.
Confusing risk appetite with risk capacity, or stating that the organisation has 'zero risk tolerance' as a credible position.
The terms are closely related and rarely distinguished in day-to-day language; 'zero tolerance' sounds rigorous and responsible to a candidate under time pressure.
What to do instead
Define appetite as the amount of risk the organisation is willing to pursue or retain in service of objectives, and capacity as the maximum it could bear before breaching constraints such as capital or regulatory limits. In answers, express appetite in qualitative thresholds or quantitative limits per risk category, and note that zero appetite is unrealistic for any organisation pursuing change.
Naming a framework such as COBIT or ITIL as the answer to a compliance question, without explaining which components of it apply, how they are tailored, and what evidence demonstrates compliance.
Framework names are memorable and feel authoritative, so candidates drop the label and stop, treating recall as application.
What to do instead
Name the framework only as a starting point, then state the specific processes or practices adopted, the tailoring decisions made for the organisation's context, the control evidence produced, and the assurance or audit route. A framework citation without tailoring and evidence earns little credit.
Treating regulatory obligations as a legal team's concern and omitting the IT governance response, such as assigning ownership, mapping obligations to controls, and evidencing adherence.
Candidates separate 'compliance' from 'IT' in their mental model, so the answer describes the regulation rather than the governance machinery that delivers and proves conformity.
What to do instead
For each regulatory scenario, state the obligation in one line, then describe the control that satisfies it, the named owner, the evidence retained, the monitoring or testing frequency, and the escalation path for breaches. Keep the regulatory description brief and spend the marks on the governance response.
Answering resource management questions by listing roles and headcount, without addressing competence development, sourcing decisions, capacity planning or succession for key IT positions.
Resource questions are read as staffing questions, and candidates overlook that the syllabus covers optimisation of people, infrastructure, applications and information over time.
What to do instead
Cover the full resource cycle: current inventory, demand forecast against business plans, gap analysis across skills and infrastructure, sourcing options with rationale, development or recruitment actions, and retention or succession for critical roles. Include how resource adequacy will be measured and reviewed.
Defining performance measurement as producing dashboards, and proposing metrics that are activity counts (number of tickets closed, number of projects started) rather than measures tied to value delivery and outcomes.
Activity metrics are abundant and easy to obtain, so they dominate candidates' answers; the syllabus expects linkage from IT performance to business value.
What to do instead
For each proposed metric, state the decision it informs and the outcome it proxies. Pair leading indicators with lagging outcome measures, include service levels, benefit realisation against the business case, and cost or value indicators. Show the reporting line from operational measures up to the governing body's objectives.