CGEIT key terms

The decision rights and accountability framework that directs how IT is used, who makes technology decisions, and how performance is measured and enforced across the whole organization.

A structured set of principles, structures, and processes (such as COBIT or ISO/IEC 38500) that organizes how IT is directed, monitored, and held accountable at enterprise level.

Documented statements describing what governance must achieve, such as value delivery, risk optimization, and resource optimization, used to design processes and measure whether governance is working.

The formally assigned authority to make a specific class of IT decision, such as approving architecture standards or funding a program, and the mechanism by which that authority is exercised.

A chart mapping decisions or activities to the roles responsible, accountable, consulted, and informed, making clear who owns an outcome versus who merely contributes input.

The governing body's duty to set IT direction, approve risk appetite, monitor major technology investments, and challenge management on performance without taking over day-to-day operational decisions.

A cross-functional executive forum that prioritizes IT investments, resolves competing demands for resources, and monitors delivery against agreed business outcomes and risk limits.

A subset of the governing body, typically independent of management, that oversees internal and external audit activity, including IT audit findings and remediation of significant control weaknesses.

A control principle that separates incompatible responsibilities, such as requesting, approving, and recording a transaction, so that no single person can both cause and conceal an error or fraud.

A staged scale describing how institutionalized and measured a governance practice is, from ad hoc activity to continuously optimized performance, used to plan improvement rather than to score individuals.

The assets IT governance directs and optimizes: applications, information, infrastructure, people, and the processes that combine them to deliver services to the enterprise.

Achieving the most value from available IT assets and capabilities at an acceptable cost, balancing capacity, performance, and investment so that resources support strategic objectives.

A maintained record of hardware, software, and related components with ownership, location, version, and lifecycle status, forming the basis for cost control and vulnerability management.

The discipline of identifying, recording, and controlling the components of IT services and their relationships, so changes can be assessed for impact and the environment stays known and consistent.

The organized description of how business, information, application, and technology components fit together, used to guide investment and prevent fragmented, redundant technology choices.

A governance body that evaluates proposed solutions against agreed architecture principles and standards, granting exceptions where justified and recording the rationale for each decision.

The accumulated future cost of shortcuts in design or code that speed delivery now but make later change slower and riskier, tracked as a liability against the architecture roadmap.

Planning each IT resource from acquisition through operation to retirement, so that end-of-support, refresh, and disposal are funded and scheduled rather than discovered as emergencies.

Forecasting demand for processing, storage, and people, then provisioning enough to meet service targets economically, avoiding both costly overcapacity and performance failures.

The documented skills, knowledge, and experience the IT workforce needs for current and planned services, managed through role profiles, skills assessment, and targeted development.

The disciplined process of defining expected business benefits, assigning owners, and tracking whether those benefits actually appear after a change is delivered.

A structured justification for an investment stating expected costs, benefits, risks, and alternatives, kept alive through delivery so that funding decisions can be revisited on evidence.

A log recording each expected benefit, its measure, baseline, target, timing, and accountable owner, used to compare promised outcomes with results achieved.

The named business manager accountable for a benefit being achieved and sustained, distinct from the project manager who is accountable only for delivering outputs on time.

Ensuring IT investments produce outcomes the enterprise actually wants, at a cost and risk it accepts, measured through agreed indicators rather than through activity or output volume.

The financial and nonfinancial techniques, such as payback, net present value, and scoring models, used to compare candidate investments and rank them for funding.

Selecting, balancing, and monitoring the collection of IT investments and services as a whole, so spending matches strategy and low-value or duplicated items are stopped.

A quantified measure tied to a specific objective, with a defined formula, target, and reporting frequency, used to judge whether performance is on track.

A documented commitment between a service provider and its customer specifying services, performance targets, responsibilities, and remedies when targets are missed.

Balancing the potential for loss against the potential for gain, so the enterprise takes the risks needed to create value while keeping exposure within its stated tolerance.

The amount and type of risk the governing body is willing to accept in pursuit of its objectives, expressed in qualitative statements and, where possible, quantified thresholds.

The acceptable variation around a specific objective or metric before action is required, translating broad appetite statements into operational limits managers can monitor day to day.

Choosing and applying a response to an identified risk, such as avoiding the activity, reducing likelihood or impact, transferring it, or knowingly accepting the residual exposure.

The exposure that remains after controls and other treatments have been applied, which must be compared with tolerance and formally accepted by an authorized owner.

A maintained record of identified risks with cause, potential impact, likelihood, owner, existing controls, treatment plans, and status, reviewed at a defined frequency.

A forward-looking metric whose movement signals rising exposure to a defined risk, chosen so management can act before losses occur rather than after.

Exposure created by suppliers, cloud providers, and partners whose failures or compromises affect the enterprise, managed through due diligence, contractual controls, and ongoing monitoring.

The overall tone, standards, structures, and oversight that determine how seriously controls are designed and followed, forming the foundation on which specific IT controls operate.

Independent or objective evidence that controls and governance arrangements are designed and operating as intended, gathered through audit, testing, and review activities.