CITM common mistakes
CITM · Understand the traps and how to avoid them.
Treating IT governance as a synonym for IT operations management, so questions asking who decides (board, steering committee, CIO, business unit) get answered with what process runs the decision.
Candidates study governance frameworks alongside service management frameworks and blur the accountability layer with the execution layer; many have operational backgrounds where the same person does both.
What to do instead
For each governance question, write down three things before choosing: the decision right (who decides), the accountability (who answers for it), and the mechanism (policy, charter, committee). If the stem asks about authority or escalation, eliminate any option that describes a process step or a tool. Build a one-page table mapping decision types to the typical accountable role.
Selecting the most technically complete answer on service management questions instead of the answer that matches the defined process step, role, or lifecycle stage named in the stem.
Experienced practitioners answer from habit and personal practice rather than from the reference model the exam tests, so a workable real-world shortcut looks better than the textbook sequence.
What to do instead
Underline the lifecycle stage or process named in the stem and reject options that belong to an adjacent process even if they are sensible. Practise classifying each option by process (incident vs problem vs change vs request) before judging quality. Keep a personal list of where your organisation deviates from the reference model and consciously set it aside during the exam.
Confusing project management with program and portfolio management, choosing project-level answers for questions about benefits realisation, interdependencies, or investment prioritisation.
The vocabulary overlaps heavily and many candidates have only worked inside single projects, so program and portfolio concepts feel abstract and get mapped onto the nearest familiar project activity.
What to do instead
Anchor on the object being managed: a project delivers outputs, a program delivers outcomes and benefits across related projects, a portfolio balances investment against strategy. When a stem mentions benefits, interdependency, or strategic alignment, look for the program or portfolio answer. Memorise three distinguishing questions for each level and apply them to the stem before reading options.
Answering information security questions with the strongest control rather than the control proportionate to the identified risk, and mixing up preventive, detective, and corrective categories.
Security training emphasises hardening, and candidates equate more control with a better answer; classification of control type is also frequently glossed over in study.
What to do instead
Before evaluating options, label each one as preventive, detective, or corrective, and as administrative, technical, or physical. Then ask which control addresses the specific risk in the stem at proportionate cost. If two options are both valid, prefer the one that fits the stated risk appetite or the layer (policy, process, technology) the stem is discussing.
Treating compliance as equivalent to risk management, so questions asking for the best response to a risk get answered with 'achieve compliance with the standard' even when the standard does not cover the exposure.
Audit and regulatory pressure dominate many candidates' working lives, making compliance feel like the default objective; the distinction between compliance obligation and risk treatment is rarely tested in internal training.
What to do instead
Separate the two explicitly: compliance is a minimum obligation, risk management is a decision about uncertainty. For any treatment question, rank options by whether they reduce likelihood, reduce impact, transfer, or avoid, and check the residual risk against appetite. Treat 'become compliant' as a valid answer only when the stem frames the issue as a legal or contractual obligation.
Choosing data governance or analytics answers that focus on tooling and reporting while ignoring data quality ownership, stewardship, and definitions.
Candidates often come from a BI or reporting background where the deliverable is the dashboard, so the organisational accountability for data is invisible in their experience.
What to do instead
For data questions, first identify who owns the data domain, who is accountable for quality, and where the definition is agreed. Prefer options that establish ownership, definitions, and quality measurement over options that add a tool or a report. Learn the distinction between data governance (decision rights and policy) and data management (execution).
Picking the newest technology as the answer to enterprise architecture questions, rather than the option that satisfies business capability, integration, and standards constraints.
Emerging technology topics generate excitement and heavy coverage, so candidates overweight novelty; architecture trade-off reasoning is harder to study than product features.
What to do instead
For architecture questions, restate the business capability and constraint from the stem, then eliminate options that add components without addressing the constraint or that violate stated standards. Practise writing a two-line trade-off note (benefit, cost or risk) for each option before choosing. Treat 'adopt the emerging technology' as correct only when the stem shows a clear capability gap and acceptable risk.
Confusing cost categories in IT financial questions, for example treating depreciation, capital expenditure, and run-rate operating cost as interchangeable, or ignoring total cost of ownership beyond licence price.
Budget exposure in most IT roles is partial, and vendor quotes emphasise licence and subscription pricing while hiding implementation, integration, and exit costs.
What to do instead
Build a one-page cost taxonomy: capital versus operating, fixed versus variable, direct versus indirect, plus one-time versus recurring. For any vendor or investment question, list acquisition, implementation, operation, and exit costs before reading options, and reject answers that consider only one category. Learn how depreciation and chargeback affect the answer when the stem mentions budget treatment.
Selecting recovery-time answers without distinguishing RTO, RPO, and maximum tolerable downtime, and choosing a backup strategy when the stem asks about service continuity.
The acronyms are similar and often taught together, and candidates who have run backups but not continuity exercises map the question onto the tool they know.
What to do instead
Write the three definitions from memory and, for every continuity question, extract the stated time tolerance and data loss tolerance from the stem before looking at options. Eliminate options whose recovery capability cannot meet the stated tolerance, even if they are cheaper or already in place. Remember that continuity is about maintaining the service, recovery is about restoring it, and backup is only one enabler of both.
Answering ethics and professional development questions with the option that protects the employer or the project rather than the option that follows the stated professional obligation, such as disclosing a conflict of interest.
Loyalty to the organisation and fear of escalation are strong workplace habits, and candidates read 'protect the project timeline' as the responsible choice.
What to do instead
For ethics stems, identify the duty in tension (to employer, profession, public, or law) and prefer transparency and escalation to the appropriate authority over quiet resolution. Eliminate options that conceal, delay disclosure, or bypass governance even if they appear pragmatic. For professional development questions, prefer options that build verifiable competence and give back to the profession over options that merely raise visibility.