CGEIT cheat sheet

Governance of enterprise IT is the set of structures, processes, and relational mechanisms that direct and control IT to create value and balance risk versus return.

COBIT 5/2019 separates governance (Evaluate, Direct, Monitor - EDM) from management (Align, Plan, Organize; Build, Acquire, Implement; Deliver, Service, Support; Monitor, Evaluate, Assess - APO, BAI, DSS, MEA).

Board-level accountability: the governing body owns IT oversight; the CIO and IT management execute. Delegation does not transfer accountability.

Relational mechanisms (executive committees, business-IT liaisons, informal networks) close the gap between formal structures and actual behavior.

Governance operating model choices: centralized, federated, or decentralized, selected per decision area (principles, architecture, investment, prioritization).

IT governance frameworks are tailored, not adopted wholesale: map framework components to enterprise context, then define target maturity per process.

Separation of duties: the party that approves IT investment is distinct from the party that executes and the party that assures.

Governance performance is measured with outcome metrics (benefit realization, risk exposure, stakeholder satisfaction), not only activity metrics.

COBIT IT resources: applications, information, infrastructure, and people - the four resource categories IT governance must optimize.

IT resource management covers the full lifecycle: plan, acquire/build, operate, maintain, and retire; retirement is a governed decision, not an afterthought.

Architecture governance: enterprise architecture principles constrain solution design; architecture review boards approve exceptions and track technical debt.

Information as a resource: data ownership (accountable), data stewardship (custodial), and data quality dimensions (accuracy, completeness, timeliness, consistency).

Capacity and performance management uses demand forecasting, service-level targets, and workload modeling to right-size infrastructure.

IT asset management: maintain an authoritative inventory with ownership, lifecycle status, and cost; unmanaged assets are ungoverned risk.

People resource governance: competency frameworks, succession planning for key IT roles, and sourcing mix (internal, outsourced, contracted) decisions.

Resource optimization trade-off: cost reduction that degrades service quality or increases risk is a net loss, not a benefit.

Benefits realization is the process of ensuring that IT investments deliver the outcomes and value expected, measured against a pre-agreed business case.

Business case components: expected benefits, costs, risks, assumptions, and a benefit owner accountable for outcomes.

Benefit categories: financial (revenue, cost avoidance), non-financial (compliance, customer satisfaction), and strategic (capability, market position).

Benefit mapping links each benefit to a measurable KPI, a baseline, a target, and a measurement date before investment approval.

Portfolio management balances investment across risk/return profiles; stage gates release funding incrementally as evidence accumulates.

Post-implementation review compares realized benefits to the business case; variance analysis drives lessons learned and corrective action.

Benefits are often realized by the business, not IT; governance must assign ownership outside IT where the outcome is business-owned.

Value delivery metrics include net present value, payback period, and benefit realization rate (realized benefit / planned benefit).

Risk optimization is the process of balancing risk exposure against return, not eliminating risk; the goal is an optimal, not minimal, risk position.

Risk components: likelihood, impact, velocity, and vulnerability; risk score = likelihood × impact (qualitative) or expected loss (quantitative).

Risk treatment options: avoid, reduce/mitigate, transfer (insurance, contracts), and accept (with documented tolerance and owner).

Risk appetite is the amount of risk the enterprise is willing to accept; risk tolerance is the acceptable deviation from appetite for a specific area.

IT risk register: each entry has an owner, a treatment plan, a residual risk rating, and a review date; unowned risks are unmanaged.

Risk aggregation: individual low risks can combine into a material portfolio exposure; governance reviews aggregate risk, not only individual items.

Key risk indicators (KRIs) are leading metrics with thresholds that trigger escalation before a risk event occurs.

Third-party and supply-chain risk: vendor due diligence, contractual risk allocation, and continuous monitoring of critical providers.