CGEIT common mistakes
CGEIT · Understand the traps and how to avoid them.
Answering 'what should the IT manager do next' with an operational action such as escalating to the CIO, instead of the governance action the question is testing, e.g. taking the issue to the IT steering committee for a decision.
Candidates bring hands-on IT or project experience and default to escalation and firefighting reflexes. CGEIT is written from the perspective of the governing body and the enterprise IT governance function, so the correct answer is almost always the one that restores decision rights, accountability, or oversight rather than the one that solves the immediate technical problem.
What to do instead
Before choosing, identify the role named in the stem and the level of the question. If the actor is a steering committee, board, or governance council, eliminate options that are purely operational. Practice rephrasing each stem as 'which option re-establishes governance control?' and pick the answer that creates a decision, an accountability, or a reporting line rather than a fix.
Treating frameworks such as COBIT, ITIL, ISO/IEC 38500, and TOGAF as competing products and selecting the 'most complete' or 'most popular' one, rather than selecting the framework element that matches the specific governance objective in the stem.
Study guides summarize frameworks as lists of processes, so candidates memorize names and structures without learning what each framework is designed to govern. Exam items usually describe a situation and ask which approach or framework component fits, not which framework is best overall.
What to do instead
Build a one-page comparison of what each framework is for: COBIT for governance and management objectives and performance measurement, ISO/IEC 38500 for board-level principles and evaluation-direct-monitor, ITIL for service management practices, TOGAF for architecture development method and governance of architecture. For each practice question, name the governance objective first, then match the framework element to it.
Confusing the roles of the board, the executive management team, the IT steering committee, and the CIO, and assigning accountability to the wrong body, for example saying the CIO is accountable for enterprise IT governance outcomes.
In practice these roles blur, and many organizations use titles loosely. The exam tests a clean accountability model: the board and executive management are accountable for governance of IT, while the CIO and IT management are responsible for executing it. Candidates who have only seen governance from inside IT misassign accountability.
What to do instead
Memorize the accountability chain in ISO/IEC 38500 and COBIT terms: governing body evaluates, directs, and monitors; executive management sets direction and ensures resources; the steering committee prioritizes and makes investment decisions; IT management executes. For every option that names a role, ask whether that role has the authority and accountability the stem describes.
Choosing an answer that optimizes IT cost or efficiency when the stem asks about value or benefits, for example recommending consolidation to cut costs when the question is about realizing expected business benefits from an investment.
Cost reduction is the most familiar IT value story, and candidates equate good governance with spending less. Benefits realization is about defining, tracking, and confirming that expected outcomes are achieved, which may require continued or increased spend.
What to do instead
When a stem mentions benefits, outcomes, or value, scan options for the one that establishes a benefits register, baseline, owner, or measurement mechanism. Eliminate options whose only merit is lower cost or faster delivery unless the stem explicitly frames the goal as cost containment.
Skipping the business case and benefits ownership steps and jumping straight to a monitoring or reporting tool, such as proposing a dashboard or KPI report as the fix for weak benefits realization.
Dashboards and metrics are visible and easy to propose, so they feel like the governance answer. But measurement without a defined business case, baseline, and named benefits owner produces reporting with no accountability, which is exactly the gap the exam is testing.
What to do instead
Order the benefits realization lifecycle explicitly: business case with expected benefits and measures, approval and funding, assigned benefits owner, baseline, periodic review, and post-implementation review. When an option proposes reporting, check whether the prerequisites (owner, baseline, measures) already exist in the stem; if not, choose the option that establishes them first.
Treating risk management as a compliance checklist to be completed once, and selecting 'conduct a risk assessment' as the answer to every risk stem, including stems about risk appetite, tolerance, or portfolio-level risk optimization.
Risk assessment is the most rehearsed risk concept, so it becomes a default answer. CGEIT tests risk optimization: setting appetite and tolerance, integrating IT risk into enterprise risk management, and balancing risk against return, not merely identifying risks.
What to do instead
Classify each risk stem before answering: is it about identifying risk, setting appetite and tolerance, integrating with enterprise risk management, treating and monitoring, or optimizing a portfolio? Then pick the option that matches that specific stage. If an option says 'perform a risk assessment' but the stem already describes an assessment, it is a distractor.
Assuming the lowest-risk option is always correct, and rejecting options that accept or retain risk even when the stem describes a risk within the enterprise's stated tolerance or a risk taken deliberately for strategic return.
Candidates equate good governance with risk elimination. Risk optimization explicitly allows accepting risk when it is understood, within tolerance, and aligned with strategy, so an option that accepts or transfers risk can be the best answer.
What to do instead
Look for appetite and tolerance language in the stem. If the risk is within tolerance and the option that accepts it includes monitoring and ownership, it is likely correct. Reserve rejection of risk for cases where the stem shows the risk exceeds tolerance or threatens a critical objective.
Ignoring the human, information, and infrastructure dimensions of IT resources and answering every resource question as if it were about technology or budget, for example recommending a new tool when the stem describes a skills gap or unclear data ownership.
IT resources are often summarized as 'people, process, technology', and candidates collapse them into technology. The exam distinguishes human resources, information, infrastructure, and applications, and expects the answer to address the specific resource type named or implied in the stem.
What to do instead
For each resource question, label the resource type before reading the options: people (skills, roles, competencies), information (quality, ownership, classification), infrastructure (capacity, resilience, lifecycle), applications (portfolio, fit, support). Then eliminate options that address a different resource type than the one the stem describes.
Choosing a control or process improvement without connecting it to a measurable governance outcome, such as recommending a policy update without defining how compliance and effectiveness will be monitored and reported.
Candidates focus on the intervention and stop there, because policy and process design are familiar. Governance answers must close the loop: implement, measure, report, and adjust, which is what separates governance from management.
What to do instead
Prefer options that include a measurement or monitoring element when the stem describes an ongoing governance need. If two options both address the problem, choose the one that specifies who monitors, what is measured, and how results reach the governing body. A policy with no defined monitoring mechanism is usually the weaker answer.
Answering based on remembered keywords from practice exams and picking the longest or most comprehensive-sounding option, rather than reading the stem's qualifier words such as 'first', 'primary', 'most important', or 'best' and matching the option to that qualifier.
Under time pressure, candidates pattern-match familiar phrases and choose the option that contains the most governance vocabulary. Qualifiers change the correct answer, and comprehensive-sounding options often bundle several actions when the stem asks for the first or primary one.
What to do instead
Underline the qualifier in every stem before looking at the options. If the stem says 'first', eliminate options that describe later lifecycle stages. If it says 'primary' or 'most important', choose the option with the greatest governance leverage rather than the broadest scope. Practice with timed sets and review only the qualifiers and your reasoning, not the content.