CITP common mistakes
CITP · Understand the traps and how to avoid them.
Answering governance questions as if the IT department alone decides, choosing the option where the CIO or IT manager 'approves' a policy, funds a project, or accepts risk without board or executive involvement.
Candidates with hands-on IT backgrounds default to the chain of command they experience daily, so the most familiar-sounding option feels correct even though governance accountability sits with executive management and the board, not with the technology function.
What to do instead
For every governance scenario, ask 'who is accountable to the owners/shareholders?' and select the option where senior leadership or the board sets direction, approves policy, and owns risk, with IT in an enabling and executing role. Practice by rewriting each answer choice to name the accountable body before choosing.
Treating COBIT, ITIL, and ISO/IEC 38500 as interchangeable and picking an answer that applies ITIL service-management practices to a question about directing and controlling the enterprise.
All three are frequently mentioned in study material, and candidates memorize acronyms without internalizing scope: governance frameworks direct and control, service frameworks manage delivery, and standards specify requirements. Under time pressure the labels blur.
What to do instead
Build a one-line scope card for each framework: COBIT for governance objectives and control over enterprise IT, ITIL for service lifecycle and operations, ISO/IEC 38500 for principles of corporate governance of IT (evaluate, direct, monitor), ISO/IEC 27001 for an ISMS. Match the verb in the question (direct, deliver, certify) to the framework.
Choosing the option that restores service fastest in an incident scenario even when the question is asking what should have prevented the incident or what to do first to preserve evidence.
Operational reflexes reward immediate restoration, and many candidates skim the stem for keywords like 'outage' and jump to the recovery action without reading the actual ask, such as root-cause analysis, containment, or escalation.
What to do instead
Read the final sentence of the stem first to identify the required verb (prevent, detect, contain, recover, learn). Only then evaluate options, and eliminate any option that solves a different phase of the incident lifecycle than the one requested.
Assuming a control that exists on paper also operates effectively, and selecting 'the policy requires it' as sufficient evidence in audit or assurance questions.
Candidates equate documentation with assurance because policies are tangible artifacts, but exam scenarios repeatedly test the distinction between design and operating effectiveness of controls.
What to do instead
When a question involves assurance, prefer options that test or monitor actual operation (logging, sampling, reconciliation, independent review) over options that merely cite a documented requirement. Treat 'policy exists' as design evidence only.
Mixing up the roles of data owner, data custodian, and data user, for example assigning backup and access-provisioning duties to the data owner or letting the custodian decide classification.
In real organizations these roles are often combined or informally shared, so candidates answer from experience rather than from the model, where the owner classifies and authorizes and the custodian implements safeguards.
What to do instead
Memorize the accountability split: owner decides classification, access rules, and retention; custodian implements and operates controls; user complies. For each scenario, ask 'who decides?' (owner) versus 'who implements?' (custodian) and choose accordingly.
Selecting the strongest technical control (encryption, firewall, MFA) for a privacy question that is actually about lawful basis, consent, notice, or data subject rights.
Security and privacy vocabulary overlap, and candidates trained on security controls reach for a technical safeguard when the scenario concerns whether processing is permitted at all, which is a legal and governance question.
What to do instead
Classify the question first: if it concerns why data may be processed, who was informed, or what an individual can request, answer with a privacy principle or process (lawful basis, notice, consent, access/correction/deletion rights, minimization). Reserve technical controls for confidentiality and integrity questions.
Picking the most technically elegant SDLC model or tool for a scenario question that is really about requirements definition, stakeholder sign-off, or change control.
Candidates with development backgrounds enjoy methodology questions and gravitate to agile-versus-waterfall debates, missing that the stem is testing a control such as configuration management or user acceptance.
What to do instead
Identify the phase or control the stem describes (requirements, design, build, test, implement, maintain) and choose the option that addresses that phase's governance artifact, such as a signed requirements baseline or an approved change request, rather than a methodology preference.
Answering project-management scenarios by choosing to escalate to the sponsor or add resources before checking whether the change should go through the change control process or whether the baseline and scope were properly approved.
Escalation feels decisive and safe, so it attracts candidates who are unsure, but exam items usually reward following the defined process, reassessing the baseline, and documenting decisions before escalating.
What to do instead
Apply a fixed order: verify the approved scope and baseline, assess impact through the change control process, document the decision, then escalate only if authority or tolerance is exceeded. Eliminate options that bypass the process even when they sound proactive.
Ignoring the 'MOST likely', 'BEST', 'FIRST', and 'PRIMARY' qualifiers and choosing an answer that is true but not the best or first action.
Multiple options are often factually correct, and candidates who focus on factual accuracy rather than the question's qualifier select a defensible but non-optimal answer, which is a leading cause of near-miss scores.
What to do instead
Underline or mentally flag the qualifier before reading options, then rank surviving options against it. If two options are both true, ask which one is earlier in sequence (FIRST), broader in impact (PRIMARY), or more aligned with governance accountability (BEST).
Relying on memorized acronym expansions and vendor product names instead of the underlying concept, so a question phrased with different terminology is misread.
Cramming produces surface recall, and exams deliberately paraphrase concepts, so candidates fail to recognize the same idea when it appears without its familiar label.
What to do instead
For each key concept, write a one-sentence plain-language definition and one example of how it appears in a scenario, then practice mapping scenario wording back to the concept. If you cannot explain it without the acronym, you do not yet know it.