PECB ISO/IEC 38500 Foundation Exam Practice & IT Governance Study Guide common mistakes
PECB ISO/IEC 38500 Foundation Exam Practice & IT Governance Study Guide · Understand the traps and how to avoid them.
When a scenario asks what the governing body should do about a failing IT service, the candidate selects 'approve the recovery plan and reassign the incident team' instead of 'evaluate options, direct management, and monitor outcomes.'
Everyday usage treats governance as senior management decision-making; the exam applies the standard's separation between the governing body and management.
What to do instead
Rehearse the definition of governance of IT and the EDM split. For every scenario, ask whether the action is execution (management) or evaluation, direction, and monitoring (governing body).
Recites the six principles in order and then treats Responsibility as the first priority, or Strategy as more important than Conformance.
Mnemonics such as RSAPCH create a false sequence; the standard presents an interrelated set with no ranking.
What to do instead
Learn all six principles as simultaneous lenses. Use the mnemonic only for recall, and answer priority questions from scenario evidence, not list position.
Describes Human Behaviour as 'HR management' or 'ethics and whistleblowing' and omits accessibility, ergonomics, culture, and change impact.
The term sounds like a people-management principle, so candidates substitute familiar HR topics for the standard's actual scope.
What to do instead
Memorize the exact scope: IT policies, practices, and decisions respect and consider human behaviour and the needs of all people involved, including accessibility, usability, culture, and the impact of change.
Defines Responsibility as 'someone is accountable' but omits that the responsible party must also have authority to act.
Colloquial accountability language separates responsibility from authority; the standard deliberately pairs them.
What to do instead
Use the paired test: responsibility without authority is a governance finding. State both supply-side and demand-side responsibilities when answering.
Treats Acquisition as only the purchase of hardware or software licences and excludes cloud services, outsourced services, and internally developed systems.
A procurement framing narrows 'acquisition' to buying, which is only one route to obtaining IT capability.
What to do instead
Apply Acquisition to any IT asset or service across its lifecycle. Check for valid reasons, ongoing analysis, transparent decisions, and balance of benefits, opportunities, costs, and risks.
Answers Conformance with only 'compliance with laws and regulations' and omits internal policies, standards, and practices.
Compliance is a familiar synonym that dominates recall, so the internal half of conformance disappears.
What to do instead
State all three elements: mandatory legislation and regulations, plus policies, standards, and internal practices. Distinguish external obligation from internal commitment.
Names the governance model as 'Plan-Do-Check-Act' or 'Evaluate, Decide, Control.'
PDCA and COBIT-style verbs are more familiar than the standard's three tasks, so candidates auto-complete with the wrong set.
What to do instead
Commit EDM to memory: Evaluate, Direct, Monitor. Link each task to the governing body's ongoing cycle, not a one-off sequence.
Expects ISO/IEC 38500 to contain auditable 'shall' clauses, prescribed processes, or a certification scheme for organizations.
Experience with ISO/IEC 27001 or ISO 9001 leads candidates to treat every ISO standard as a certifiable management system.
What to do instead
Classify ISO/IEC 38500 as principles-based guidance for the governing body. Use ISO/IEC 38501 for implementation and ISO/IEC 38502 for a governance manual, and do not claim organizational certification.
Describes Evaluate, Direct, Monitor without connecting each task to the six principles, producing a generic governance cycle.
Principles and model are studied as separate chapters, but exam questions often combine them in one scenario.
What to do instead
Build a 6x3 matrix: for each principle, write one Evaluate action, one Direct action, and one Monitor action. Practise mapping scenario facts to the matrix.
Assumes the standard mandates an IT steering committee, a CIO role, or a specific board committee.
Common governance frameworks prescribe structures, so candidates import those structures into ISO/IEC 38500.
What to do instead
Remember that ISO/IEC 38500 is outcome-based and does not prescribe structures. The governing body may delegate but remains accountable; use 'governing body' language rather than naming a committee.