I85PREP
⌘ K
CGEIT study materials
CGEIT study resources

CGEIT practice questions

One question at a time. Build your CGEIT understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Governance of Enterprise IT

Which document establishes the mandate, authority, and accountability for IT decision-making across an enterprise?

  1. The application test strategy
  2. The IT governance charter approved by the board Correct answer.
  3. The disaster recovery plan
  4. The network capacity plan

Explanation

A governance charter defines who has authority to make IT decisions, what outcomes are expected, and how performance is reported. Operational plans such as recovery, testing, and capacity documents execute within that mandate rather than establishing it.

Question 2Governance of Enterprise IT

An enterprise IT steering committee is being formed. Which membership design best supports effective IT governance?

  1. Only IT infrastructure managers
  2. Senior business and IT executives with decision authority Correct answer.
  3. Only external auditors
  4. Front-line developers elected by their peers

Explanation

Effective steering committees require participants who can commit business resources and align IT investment with enterprise strategy. Membership drawn from senior business and IT leadership provides that authority and cross-functional perspective.

Question 3Governance of Enterprise IT

Which principle distinguishes governance from management in an enterprise IT context?

  1. Governance is a project-level activity
  2. Governance is performed only by external regulators
  3. Governance evaluates and directs while management executes Correct answer.
  4. Governance applies solely to security operations

Explanation

Governance sets direction, evaluates performance, and monitors outcomes through accountable bodies. Management plans, builds, and runs the activities that deliver those outcomes.

Question 4Governance of Enterprise IT

Which artifact most directly translates enterprise IT governance objectives into measurable targets for accountable owners?

  1. An IT balanced scorecard with defined metrics Correct answer.
  2. A software licensing inventory
  3. A change advisory calendar
  4. A service desk runbook

Explanation

A balanced scorecard expresses governance objectives as measurable targets with assigned owners and reporting cadence. Runbooks, inventories, and schedules support operations but do not set accountability for governance outcomes.

Question 5Governance of Enterprise IT

What is the primary purpose of establishing an IT governance framework such as COBIT within an enterprise?

  1. To provide a structured set of practices for directing and controlling IT Correct answer.
  2. To standardize software development languages
  3. To guarantee the removal of all IT risk
  4. To replace the internal audit function

Explanation

Frameworks such as COBIT supply a structured reference of governance and management practices that organizations tailor to their context. They inform direction and control but do not eliminate risk, replace audit, or dictate technology choices.

Question 6Governance of Enterprise IT

Which body typically holds ultimate accountability for ensuring that enterprise IT risk is governed appropriately?

  1. The board of directors Correct answer.
  2. The external hosting provider
  3. The database administration team
  4. The help desk supervisor

Explanation

Ultimate accountability for risk oversight rests with the board, which delegates execution to management while retaining responsibility for oversight. Operational teams and vendors execute controls but do not own enterprise accountability.

Question 7Governance of Enterprise IT

Which characteristic most clearly indicates that IT governance is being applied effectively?

  1. IT investment decisions are traceable to documented business priorities Correct answer.
  2. All IT projects are approved without review
  3. IT reports only to the infrastructure group
  4. Technology standards are refreshed annually without input

Explanation

Traceability between investment decisions and documented business priorities demonstrates that governance is directing IT toward enterprise value. Unreviewed approvals, narrow reporting lines, and input-free standards indicate weak or absent governance.

Question 8Governance of Enterprise IT

An organization wants a single point of accountability for IT governance outcomes reported to the executive team. Which role assignment fits that need?

  1. A vendor account manager
  2. An independent penetration tester
  3. A chief information officer accountable for IT governance outcomes Correct answer.
  4. A rotating intern coordinator

Explanation

A CIO or equivalent executive provides a clear line of accountability for IT governance outcomes to the executive team. Interns, vendors, and testers hold defined but limited roles that do not carry enterprise accountability.

Question 9Governance of Enterprise IT

A multinational enterprise has separate IT governance arrangements in each region, producing conflicting investment priorities. Which action best addresses this fragmentation?

  1. Delegate all decisions permanently to regional teams
  2. Establish an enterprise governance council with defined decision rights and escalation paths Correct answer.
  3. Increase the number of regional steering committees
  4. Remove investment approval controls from headquarters

Explanation

Fragmentation is resolved by clarifying enterprise-level decision rights and providing an escalation route for conflicts. Adding committees or removing controls would deepen inconsistency rather than align priorities.

Question 10Governance of Enterprise IT

Senior management asks how IT governance performance should be reported to the board. Which approach is most appropriate?

  1. Provide raw server logs for the reporting period
  2. Report only the number of IT staff employed
  3. Present anecdotal success stories without measures
  4. Report a small set of outcome-oriented metrics mapped to strategic objectives Correct answer.

Explanation

Board reporting should be concise, outcome-oriented, and explicitly linked to strategic objectives so directors can evaluate performance and risk. Raw logs, headcount, and anecdotes do not convey governance outcomes.

Question 11Governance of Enterprise IT

An enterprise is defining which IT decisions require board approval versus management approval. Which concept is being established?

  1. Capacity planning
  2. Decision rights allocation Correct answer.
  3. Data migration sequencing
  4. Incident triage

Explanation

Decision rights allocation specifies who is empowered to make which decisions and at what level. Capacity planning, incident triage, and migration sequencing are operational activities that follow from those rights.

Question 12Governance of Enterprise IT

A governance review finds that IT projects are approved by business units without any assessment of enterprise architecture fit. Which governance mechanism is most directly deficient?

  1. The user acceptance test plan
  2. The asset disposal procedure
  3. The service continuity plan
  4. The investment and architecture review gate Correct answer.

Explanation

An investment review gate that evaluates architecture fit ensures projects align with enterprise standards before approval. Continuity, testing, and disposal procedures address different control objectives.

Question 13Governance of Enterprise IT

Which practice best supports alignment between IT strategy and enterprise strategy?

  1. Measuring IT only on system uptime
  2. Publishing the IT strategy once and archiving it
  3. Jointly developing IT and business roadmaps with shared objectives Correct answer.
  4. Allowing each department to procure technology independently

Explanation

Joint roadmap development with shared objectives keeps IT investment synchronized with business direction over time. One-time publication, independent procurement, and single-dimension metrics weaken alignment.

Question 14Governance of Enterprise IT

A board wants assurance that IT risk appetite is being respected. Which evidence most directly supports that conclusion?

  1. Periodic risk reports showing exposures against approved tolerance thresholds Correct answer.
  2. A list of installed operating systems
  3. The number of change requests submitted
  4. The vendor contract renewal schedule

Explanation

Comparing reported exposures with approved tolerance thresholds demonstrates whether risk remains within appetite. Asset lists, change volumes, and renewal schedules do not measure exposure against tolerance.

Question 15Governance of Enterprise IT

Which structure is most appropriate for ensuring that IT governance policies remain current as regulations change?

  1. Annual deletion and reissue of all policies
  2. A periodic policy review cycle with assigned ownership and defined triggers Correct answer.
  3. A one-time policy approval at project inception
  4. Delegation of policy ownership to external auditors

Explanation

Assigning ownership and defining review triggers, including regulatory change, keeps policies current and accountable. One-time approval, auditor ownership, and wholesale deletion create gaps or confusion.

Question 16Governance of Enterprise IT

A governance committee must prioritize two competing IT investments. Which criterion best reflects sound IT governance?

  1. The proposal with the largest technical scope
  2. The proposal requiring the least documentation
  3. The proposal submitted by the largest department
  4. The proposal with the strongest expected contribution to strategic objectives and managed risk Correct answer.

Explanation

Governance prioritization weighs expected strategic contribution against risk and resource use. Technical scope, submitter size, and documentation effort are not valid proxies for enterprise value.

Question 17Governance of Enterprise IT

Which mechanism best enables an enterprise to hold IT service providers accountable for governance obligations?

  1. Contractual service levels with reporting and remedy provisions Correct answer.
  2. Verbal assurances from vendor sales staff
  3. Relying on the provider's public marketing claims
  4. Informal quarterly lunches with account managers

Explanation

Contracts that specify measurable service levels, reporting duties, and remedies create enforceable accountability. Verbal assurances, informal contact, and marketing claims lack binding force.

Question 18Governance of Enterprise IT

An enterprise discovers that business units are building shadow IT solutions outside governance oversight. Which response best addresses the root governance cause?

  1. Immediately ban all business unit technology use
  2. Transfer all business unit budgets to the IT department
  3. Provide a fast, transparent intake path for business technology needs with clear accountability Correct answer.
  4. Ignore shadow IT because it delivers local value

Explanation

Shadow IT often reflects governance processes that are slow or opaque. A streamlined intake path with clear accountability channels demand into governed delivery while preserving responsiveness. Bans and budget transfers address symptoms, and ignoring the issue perpetuates uncontrolled risk.

Question 19Governance of Enterprise IT

A governance framework is being tailored for a highly regulated enterprise. Which tailoring approach is most defensible?

  1. Adopt only practices that require no documentation
  2. Perform a risk-based gap assessment and tailor practices to regulatory and business context Correct answer.
  3. Adopt every practice at maximum maturity regardless of cost
  4. Copy a peer organization's framework without modification

Explanation

Tailoring should follow a risk-based gap assessment that accounts for regulatory obligations, business context, and cost. Maximum maturity everywhere, minimal documentation, and unmodified copying ignore the organization's specific risk profile.

Question 20Governance of Enterprise IT

Which situation most strongly indicates that an IT governance committee has become ineffective?

  1. It reviews a risk-based portfolio of investments each quarter
  2. It maintains minutes and tracks action items
  3. It escalates unresolved conflicts to the executive team
  4. It meets regularly but decisions are routinely reversed outside the committee Correct answer.

Explanation

A committee whose decisions are consistently overridden lacks real decision authority, which is the defining failure of governance effectiveness. Regular review, record keeping, and escalation are all healthy governance behaviors.

Question 21Governance of Enterprise IT

An enterprise's IT governance metrics show high project delivery speed but declining stakeholder satisfaction and rising technical debt. Which interpretation is most sound?

  1. Efficiency gains are being achieved at the expense of value and sustainability, indicating unbalanced objectives Correct answer.
  2. Stakeholder satisfaction should be removed from the scorecard
  3. Governance is fully effective because delivery speed improved
  4. Technical debt is irrelevant to governance performance

Explanation

Balanced governance measurement must weigh speed against value, quality, and sustainability. Rising technical debt and falling satisfaction signal that the objective set is skewed toward output volume.

Question 22Governance of Enterprise IT

Which factor most influences the design of an enterprise's IT governance decision-making model?

  1. The organization's size, structure, and risk profile Correct answer.
  2. The number of printers in each office
  3. The preferred programming language of developers
  4. The brand of network hardware deployed

Explanation

Governance design must fit organizational scale, structure, and risk exposure so that decision rights and oversight are proportionate. Technology brand and peripheral counts are operational details that do not shape governance design.

Question 23Governance of Enterprise IT

Which outcome best demonstrates that IT governance is delivering value to the enterprise?

  1. IT staff receive more training hours than peers
  2. IT costs are minimized in every quarter
  3. All IT requests are fulfilled within one day
  4. IT investments demonstrably enable business outcomes and risks are kept within tolerance Correct answer.

Explanation

Value delivery in governance means IT enables business outcomes while risk remains within approved tolerance. Cost minimization, training volume, and request speed are inputs or activities that do not by themselves prove value.

Question 24Governance of Enterprise IT

An audit finds that IT governance roles are documented but several key responsibilities have no named owner. Which governance weakness does this represent?

  1. Unclear accountability assignment Correct answer.
  2. Excessive automation
  3. Insufficient network bandwidth
  4. Overinvestment in security tooling

Explanation

Documented roles without named owners leave accountability unassigned, which undermines enforcement and oversight. The other options describe technical or resource conditions unrelated to role ownership.

Question 25Governance of Enterprise IT

A board member asks why IT governance should address regulatory compliance explicitly rather than leaving it to legal counsel. Which rationale is most accurate?

  1. Compliance obligations translate into IT controls that must be designed, operated, and evidenced Correct answer.
  2. Compliance is solely a marketing concern
  3. Legal counsel is prohibited from advising on technology
  4. Regulators prefer that boards avoid compliance topics

Explanation

Regulatory obligations become IT controls that require design, operation, and evidence, which governance must direct and monitor. Legal counsel interprets obligations but does not operate the resulting IT controls.

Question 26Governance of Enterprise IT

In COBIT, which concept describes the translation of stakeholder needs into enterprise goals, IT-related goals, and enabler performance?

  1. The release management pipeline
  2. The IT chargeback model
  3. The governance system cascade Correct answer.
  4. The service desk escalation path

Explanation

COBIT uses a cascade to connect stakeholder drivers and needs to enterprise goals, then to IT-related goals, and finally to enabler and component performance. This makes governance objectives traceable from board-level expectations down to operational metrics. The other options describe operational or financial mechanisms, not governance goal alignment.

Question 27Governance of Enterprise IT

Which document formally authorizes an IT governance committee, defines its mandate, and states to whom it reports?

  1. The configuration baseline
  2. The terms of reference or charter Correct answer.
  3. The disaster recovery plan
  4. The service level agreement

Explanation

A committee charter or terms of reference establishes mandate, scope, membership, authority, and reporting lines, which is what gives a governance body legitimacy. Without it, decision rights and accountability are ambiguous. The other documents address recovery, configuration control, or service commitments.

Question 28Governance of Enterprise IT

Which principle distinguishes governance from management in enterprise IT?

  1. Governance operates the data center; management approves the budget
  2. Governance executes projects; management sets the risk appetite
  3. Governance performs testing; management defines the audit universe
  4. Governance evaluates and directs; management plans, builds, runs, and monitors Correct answer.

Explanation

Governance sets direction and evaluates performance and conformance, while management executes activities to achieve objectives. Keeping these distinct prevents the same body from both setting and executing controls without oversight. The other options invert or confuse these responsibilities.

Question 29Governance of Enterprise IT

An enterprise wants its IT governance framework to be repeatable and measurable across business units. Which enabler category in COBIT primarily addresses this need?

  1. Culture, ethics, and behavior
  2. Principles, policies, and frameworks
  3. Information
  4. Processes Correct answer.

Explanation

Processes are the enabler category that turns governance intent into repeatable, measurable practices with defined inputs, outputs, and performance metrics. Policies and culture influence behavior but do not by themselves provide measurable process capability. Information supplies data rather than the mechanism for repeatability.

Question 30Governance of Enterprise IT

Which role typically chairs the IT steering committee that prioritizes enterprise IT investments?

  1. A senior business executive with delegated authority from the executive team Correct answer.
  2. The external audit partner
  3. The data center operations supervisor
  4. The lead developer of the largest program

Explanation

IT steering committees are chaired by senior business leadership so that prioritization reflects enterprise strategy and has authority to commit resources. Technical or operational roles lack the mandate to arbitrate cross-enterprise investment trade-offs. External auditors provide assurance and cannot chair governance decisions.

Question 31Governance of Enterprise IT

Which statement best describes the purpose of an IT governance maturity assessment?

  1. It establishes a baseline capability level so improvement priorities can be targeted Correct answer.
  2. It certifies that the enterprise is compliant with all regulations
  3. It replaces the need for internal audit testing
  4. It ranks individual employees by performance

Explanation

A maturity assessment measures current capability against defined levels, producing a baseline that informs where improvement effort yields the most value. It is a diagnostic tool, not a compliance certificate, and it does not substitute for independent audit testing or individual performance review.

Question 32Governance of Enterprise IT

Which artifact communicates to the whole enterprise how IT-related decisions are made and who is accountable for them?

  1. A network topology diagram
  2. A vendor price list
  3. An application test plan
  4. A published IT governance decision-rights matrix Correct answer.

Explanation

A decision-rights matrix maps decision types to accountable roles and is the standard way to make governance transparent across the enterprise. It reduces ambiguity about who decides and who is consulted. The other artifacts describe technical, testing, or commercial detail.

Question 33Governance of Enterprise IT

Which statement best captures the relationship between enterprise goals and IT-related goals in a governance framework?

  1. Enterprise goals are derived only after IT goals are met
  2. Enterprise goals replace IT-related goals entirely
  3. IT-related goals are independent of enterprise strategy
  4. IT-related goals contribute to the achievement of enterprise goals Correct answer.

Explanation

IT-related goals exist to support enterprise goals, forming a traceable line from strategy to IT contribution. This linkage is what allows governance to demonstrate IT value. Treating them as independent or sequential in the reverse direction breaks the cascade logic.

Question 34Governance of Enterprise IT

A newly appointed CIO finds that project funding decisions are made informally by whoever sponsors the project. Which action best establishes governance discipline?

  1. Delegate all funding decisions to project managers to speed delivery
  2. Require every project to be approved by the CIO personally regardless of size
  3. Define and publish investment decision criteria and the approving body for each investment tier Correct answer.
  4. Suspend all projects until the next fiscal year

Explanation

Publishing criteria and assigning approving bodies by investment tier creates transparent, proportionate decision rights that replace informal sponsorship. This scales decisions appropriately and makes accountability explicit. Centralizing every decision or halting delivery creates bottlenecks without fixing the underlying governance gap.

Question 35Governance of Enterprise IT

An enterprise's governance committee reviews only projects above a high financial threshold, and several mid-sized risky initiatives proceed unscrutinized. Which change best addresses the gap?

  1. Increase the threshold so the committee can focus on the largest projects
  2. Introduce tiered review criteria that consider risk and strategic impact as well as cost Correct answer.
  3. Lower the financial threshold to zero so all spending is reviewed
  4. Abolish the committee and rely on business unit judgment

Explanation

Tiered criteria based on risk, impact, and cost ensure oversight is proportionate and that risky initiatives are captured regardless of size. A purely financial threshold misses risk concentration. Reviewing all spending or raising the threshold worsens the mismatch between oversight and exposure.

Question 36Governance of Enterprise IT

A regulated enterprise must demonstrate that IT controls are designed and operating effectively to its regulator. Which governance arrangement most directly supports this?

  1. A monthly newsletter summarizing IT achievements
  2. A defined control framework mapped to regulatory requirements with periodic independent assurance Correct answer.
  3. A policy stating that compliance is everyone's responsibility
  4. An annual employee satisfaction survey on IT services

Explanation

Mapping a recognized control framework to specific regulatory obligations, then obtaining independent assurance over design and operation, produces evidence a regulator can rely on. Broad statements of responsibility or communications do not demonstrate control effectiveness.

Question 37Governance of Enterprise IT

During a governance review, two business units claim authority to approve the same class of cloud procurement. Which governance deficiency does this most directly illustrate?

  1. Insufficient technical training for procurement staff
  2. Excessive vendor concentration risk
  3. Ambiguous decision rights leading to duplicated or conflicting authority Correct answer.
  4. Inadequate disaster recovery testing

Explanation

When two parties believe they can approve the same decision, decision rights are not clearly assigned, which creates inconsistency and weakens accountability. The problem is structural authority, not skills, vendor mix, or recovery readiness. Clarifying the accountable owner resolves it.

Question 38Governance of Enterprise IT

An enterprise's IT strategy is refreshed annually, but business unit plans are set on a three-year cycle and rarely reference IT. Which governance response is most appropriate?

  1. Instruct IT to shorten its strategy cycle to one month
  2. Establish a joint business-IT planning forum that aligns planning cycles and shared objectives Correct answer.
  3. Require business units to adopt IT's planning template without discussion
  4. Leave the cycles as they are and rely on annual budget reconciliation

Explanation

Misaligned planning cycles undermine strategy alignment, and a joint forum that synchronizes cycles and co-owns objectives addresses the root cause. Unilateral template imposition or extreme cycle compression does not create shared ownership. Budget reconciliation is too late and too narrow to align strategy.

Question 39Governance of Enterprise IT

A board requests assurance that IT governance is conforming to its own policies. Which source of evidence is most appropriate?

  1. Independent internal audit reports on governance process compliance Correct answer.
  2. Vendor marketing materials describing best practice
  3. Employee suggestions submitted through an idea portal
  4. The CIO's verbal confirmation during a board meeting

Explanation

Independent audit provides objective, evidence-based conclusions about conformance with policies and is the appropriate basis for board assurance. Self-reporting, vendor claims, and informal suggestions lack the independence and rigor required. Boards should rely on assured information for conformance conclusions.

Question 40Governance of Enterprise IT

An enterprise wants IT governance to remain relevant as new technologies emerge. Which mechanism best supports this?

  1. A scheduled governance framework review triggered by significant technology or regulatory change Correct answer.
  2. A policy prohibiting adoption of technologies not in the current framework
  3. A fixed five-year framework review with no interim triggers
  4. Delegation of framework ownership to the service desk

Explanation

Governance frameworks need periodic and event-driven review so they reflect emerging technology and regulatory shifts. Trigger-based review keeps the framework current without waiting for a long cycle. Prohibiting new technology or assigning ownership to an operational function undermines responsiveness and authority.

Question 41Governance of Enterprise IT

A governance committee's meetings consist mainly of status reporting with no decisions recorded. Which intervention most directly restores its effectiveness?

  1. Add more status reports to improve visibility
  2. Reduce meeting frequency to quarterly
  3. Refocus the agenda on decision items with pre-read materials and a decision log Correct answer.
  4. Invite more attendees from operational teams

Explanation

A governance committee adds value by making and recording decisions; shifting the agenda to decision items with pre-reads and a decision log restores that purpose. More reporting, fewer meetings, or larger attendance does not create decision output. Effectiveness is measured by decisions and outcomes, not attendance or volume of updates.

Question 42Governance of Enterprise IT

An enterprise's governance metrics emphasize cost reduction, while business stakeholders report declining service quality and rising rework. Which action best improves the governance measurement set?

  1. Add balanced measures covering value, risk, and stakeholder outcomes alongside cost Correct answer.
  2. Remove stakeholder satisfaction metrics to reduce reporting effort
  3. Weight cost metrics more heavily to drive discipline
  4. Report only metrics that show improvement

Explanation

Governance measurement should be balanced across value, risk, and stakeholder outcomes so that cost gains are not achieved at the expense of quality. Adding outcome measures exposes trade-offs and supports better decisions. Removing or skewing metrics hides the problem rather than resolving it.

Question 43Governance of Enterprise IT

An enterprise is designing its governance model and must decide how much authority to delegate to business units. Which factor should most strongly shape that decision?

  1. The number of applications in the portfolio
  2. The age of the current data center
  3. The personal preference of the IT operations manager
  4. The enterprise's structure, risk profile, and degree of business unit autonomy Correct answer.

Explanation

Delegation design depends on organizational structure, risk appetite, and how autonomous business units are, because these determine where decisions can safely be made. Personal preference, application counts, and facility age do not reflect governance risk or accountability needs.

Question 44Governance of Enterprise IT

An enterprise's IT governance committee includes only IT managers and excludes business and risk representatives. Which consequence is most likely?

  1. Decisions may lack enterprise perspective and fail to reflect business risk appetite Correct answer.
  2. Decision-making will accelerate because fewer viewpoints are involved
  3. Regulatory compliance will be automatically assured
  4. Technical accuracy of decisions will necessarily improve

Explanation

Governance bodies need cross-functional membership so decisions reflect business priorities, risk appetite, and compliance obligations. An IT-only committee risks optimizing for technology rather than enterprise value. Fewer viewpoints may speed decisions but at the cost of quality and legitimacy.

Question 45Governance of Enterprise IT

An enterprise wants to demonstrate that IT governance delivers value. Which outcome is the most credible indicator?

  1. IT investments are traceable to strategic objectives and realized benefits are measured Correct answer.
  2. The number of governance meetings held has increased
  3. IT has the lowest cost per employee in its industry
  4. The IT department has the fewest staff turnover events

Explanation

Value from IT governance is shown when investments are demonstrably linked to strategy and benefits are measured after delivery. Cost ratios, turnover, and meeting counts are activity or efficiency indicators that do not demonstrate strategic value realization.

Question 46Governance of Enterprise IT

A governance committee is asked to approve an investment that conflicts with the enterprise's stated risk appetite. What is the most appropriate governance response?

  1. Approve it because the business case shows high return
  2. Decline or escalate the investment with documented rationale tied to the risk appetite statement Correct answer.
  3. Defer the decision indefinitely to avoid conflict
  4. Approve it and amend the risk appetite statement afterward to match

Explanation

Risk appetite is a governance constraint, so proposals that breach it should be declined or escalated with documented reasoning. Approving on return alone or retroactively changing the appetite to fit the decision inverts the governance relationship. Indefinite deferral avoids accountability.

Question 47Governance of Enterprise IT

An enterprise operates in multiple jurisdictions with conflicting data protection obligations. Which governance approach is most defensible?

  1. Let each local team decide its own controls without documentation
  2. Suspend operations in all but one jurisdiction
  3. Adopt a baseline control set meeting the strictest applicable requirement and document justified local deviations Correct answer.
  4. Apply the least stringent jurisdiction's rules uniformly to simplify operations

Explanation

A strictest-common-denominator baseline with documented, justified local deviations provides consistent protection while accommodating legal differences. Choosing the least stringent rules creates compliance exposure, and undocumented local discretion prevents assurance. Withdrawing from markets is a business decision, not a governance control design.

Question 48Governance of Enterprise IT

A governance review finds that IT policies exist but are unknown to staff and inconsistently applied. Which root cause should the review prioritize?

  1. Ineffective policy communication, training, and enforcement mechanisms Correct answer.
  2. Overly detailed technical standards
  3. Insufficient server capacity
  4. Excessive audit frequency

Explanation

When policies exist but are unknown and inconsistently applied, the failure lies in the awareness, training, and enforcement components of the governance system rather than in policy content. Addressing communication and enforcement converts documented policy into practiced behavior. Capacity, standard detail, and audit frequency do not explain unawareness.

Question 49Governance of Enterprise IT

An enterprise's board delegates IT oversight to an audit committee that focuses solely on financial controls. Which governance risk does this create?

  1. IT-related risk and value may go unexamined because the delegated body lacks IT scope and expertise Correct answer.
  2. IT budgets will automatically increase
  3. The internal audit function will lose its independence
  4. Financial reporting will become less reliable

Explanation

Delegation is only effective when the receiving body has the scope, expertise, and mandate to examine IT risk and value. A financially focused committee may leave technology risk and strategic IT contribution unaddressed. Financial reliability, audit independence, and budget levels are not direct consequences of this scope gap.

Question 50Governance of Enterprise IT

An enterprise is deciding whether to centralize or federate IT governance decision-making across highly autonomous divisions. Which analysis is most relevant?

  1. Weigh the need for enterprise-wide consistency against the value of divisional responsiveness and local risk context Correct answer.
  2. Review the number of governance meetings each division holds
  3. Compare the age of each division's hardware
  4. Count the number of IT staff in each division

Explanation

Centralization versus federation is a trade-off between consistency and control on one side and responsiveness and local context on the other. That trade-off should be analyzed against risk and strategy. Staff counts, hardware age, and meeting frequency do not capture the governance implications of each model.