CGEIT flashcards
CGEIT · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- IT governance definition
- The structures, processes, and relational mechanisms used to direct and control enterprise IT so that it creates value while balancing risk and return against enterprise objectives.
- EDM vs management
- In COBIT, governance comprises Evaluate, Direct, and Monitor (EDM); management comprises the APO, BAI, DSS, and MEA domains that execute governance direction.
- Relational mechanisms
- Informal and formal connections such as executive committees, business-IT liaisons, and cross-functional networks that make governance structures work in practice.
- Governance operating model
- The chosen distribution of decision rights across centralized, federated, or decentralized models, selected per decision area such as architecture or investment.
- Separation of duties
- A control principle ensuring that approval, execution, and assurance of an IT activity are performed by different parties to prevent undetected error or fraud.
- Board IT accountability
- The governing body retains ultimate accountability for IT oversight; delegation to the CIO or committees transfers execution but never transfers accountability.
- Governance outcome metrics
- Measures of governance effectiveness such as benefit realization, residual risk exposure, and stakeholder satisfaction, rather than counts of governance activities performed.
- Framework tailoring
- Adapting a governance framework to enterprise context by mapping components, setting target maturity per process, and removing elements that do not fit.
- COBIT IT resources
- The four resource categories governance must optimize: applications, information, infrastructure, and people, each managed across its full lifecycle.
- Architecture review board
- A governance body that evaluates solution designs against enterprise architecture principles, approves justified exceptions, and tracks resulting technical debt.
- Data ownership vs stewardship
- Ownership is the accountable role for a data domain; stewardship is the custodial role responsible for data quality, standards, and day-to-day management.
- Data quality dimensions
- Attributes used to assess information as a resource, typically accuracy, completeness, timeliness, consistency, and validity against defined business rules.
- IT asset inventory
- An authoritative record of IT assets with ownership, lifecycle status, and cost; assets missing from the inventory represent ungoverned risk and cost.
- Capacity management
- Forecasting demand, modeling workloads, and setting service-level targets so infrastructure is right-sized for current and expected business needs.
- Sourcing mix decision
- The governed choice of internal, outsourced, and contracted staff for IT roles, balancing cost, capability, control, and risk.
- Resource retirement
- The governed end-of-life decision to decommission an IT resource, including data migration or archiving, contract closure, and risk sign-off.
- Resource optimization trade-off
- A cost reduction that degrades service quality or raises risk is a net loss; optimization must be assessed on total value, not cost alone.
- Benefits realization definition
- The process ensuring IT investments deliver expected outcomes, measured against a pre-agreed business case with an accountable benefit owner.
- Business case components
- Expected benefits, costs, risks, assumptions, and the named benefit owner accountable for realizing outcomes, agreed before investment approval.
- Benefit mapping
- Linking each expected benefit to a measurable KPI, a baseline, a target, and a measurement date before funding is approved.
- Stage gate funding
- Incremental release of investment funding at defined checkpoints as evidence of progress and benefit potential accumulates.
- Post-implementation review
- A structured comparison of realized benefits against the business case, producing variance analysis, lessons learned, and corrective actions.
- Benefit realization rate
- A value metric calculated as realized benefit divided by planned benefit, used to assess how completely an investment delivered its expected outcomes.
- Portfolio balancing
- Distributing IT investment across risk and return profiles so the overall portfolio matches enterprise strategy and risk appetite.
- Business-owned benefits
- Benefits realized outside IT, such as revenue growth or compliance, requiring governance to assign ownership to the accountable business executive.
- Risk optimization definition
- Balancing risk exposure against potential return to reach an optimal position; the objective is optimal risk, not elimination of all risk.
- Risk score calculation
- A qualitative risk rating computed as likelihood multiplied by impact, or a quantitative expected loss used to compare and prioritize risks.
- Risk treatment options
- The four responses to identified risk: avoid the activity, reduce or mitigate exposure, transfer it via insurance or contract, or accept it with documented tolerance.
- Risk appetite vs tolerance
- Appetite is the amount of risk the enterprise is willing to accept overall; tolerance is the acceptable deviation from appetite in a specific area.
- IT risk register
- A record of identified IT risks, each with an owner, treatment plan, residual rating, and review date; risks without owners are effectively unmanaged.
- Key risk indicators
- Leading metrics with defined thresholds that signal rising risk exposure and trigger escalation before a risk event materializes.
- Third-party risk management
- Vendor due diligence, contractual risk allocation, and continuous monitoring of critical providers across the IT supply chain.