I85PREP
⌘ K
PECB ISO/IEC 38500 Foundation Exam Practice & IT Governance Study Guide study materials
PECB ISO/IEC 38500 Foundation Exam Practice & IT Governance Study Guide study resources

PECB ISO/IEC 38500 Foundation Exam Practice & IT Governance Study Guide practice questions

One question at a time. Build your PECB ISO/IEC 38500 Foundation Exam Practice & IT Governance Study Guide understanding.

First 50 of 197 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental concepts and principles of governance of IT

In ISO/IEC 38500, which principle requires that people across the organization understand and accept their responsibilities for both the supply of and the demand for IT?

  1. Human behaviour
  2. Responsibility Correct answer.
  3. Strategy
  4. Acquisition

Explanation

ISO/IEC 38500's responsibility principle requires individuals and groups to understand and accept their responsibilities for both the supply of and the demand for IT. They must also have the authority and accountability needed to meet those responsibilities. The principle is about accepted duties across business and IT, not merely job titles.

Question 2Fundamental concepts and principles of governance of IT

Which three tasks make up the governance model that ISO/IEC 38500 expects the governing body to perform?

  1. Design, implement, and audit IT controls
  2. Plan, build, and run IT services and support
  3. Approve, procure, and retire IT assets and contracts
  4. Evaluate, direct, and monitor IT use Correct answer.

Explanation

ISO/IEC 38500 uses the Evaluate-Direct-Monitor model for governance of IT. The governing body evaluates current and future IT use, directs plans and policies, and monitors performance and conformance. Planning, building, and running services are management activities.

Question 3Fundamental concepts and principles of governance of IT

According to ISO/IEC 38500, governance of IT is best described as which of the following?

  1. The system that directs and controls current and future use of IT Correct answer.
  2. The technical design of enterprise architecture, security controls, and platforms
  3. The procurement process for selecting IT suppliers, products, and contracts
  4. The day-to-day operation of IT service desks, infrastructure, and applications

Explanation

Governance of IT is the system by which the current and future use of IT is directed and controlled. It involves evaluating, directing, and monitoring IT to support the organization's objectives and accountability. Day-to-day operations and technical design belong to management.

Question 4Fundamental concepts and principles of governance of IT

A company requires every major IT investment proposal to state which business objective it supports and how success will be measured against that objective. Which ISO/IEC 38500 principle is most directly demonstrated?

  1. Conformance
  2. Acquisition
  3. Human behaviour
  4. Strategy Correct answer.

Explanation

The strategy principle requires IT plans, policies, and investments to support the organization's business strategy and objectives. Requiring each proposal to show its business objective and success measure demonstrates that alignment. Acquisition would focus on the justification and analysis of the purchase itself.

Question 5Fundamental concepts and principles of governance of IT

Before committing to a multi-year cloud contract, an organization compares total cost, expected benefits, exit costs, and supplier lock-in risk. Which ISO/IEC 38500 principle is being applied?

  1. Strategy
  2. Acquisition Correct answer.
  3. Responsibility
  4. Performance

Explanation

The acquisition principle requires IT acquisitions to be made for valid reasons, on the basis of appropriate and ongoing analysis, with clear and transparent decision-making. It also requires a balance between benefits, opportunities, costs, and risks, including exit and lock-in considerations. Comparing total cost, benefits, exit costs, and lock-in risk directly applies this principle.

Question 6Fundamental concepts and principles of governance of IT

An IT steering committee reviews monthly service reports against agreed service levels and customer satisfaction targets. Which ISO/IEC 38500 principle does this primarily support?

  1. Conformance
  2. Acquisition
  3. Human behaviour
  4. Performance Correct answer.

Explanation

The performance principle states that IT should be fit for purpose and deliver quality services aligned with business requirements. Monitoring service levels and customer satisfaction against agreed targets is a direct application of that principle. It provides evidence that IT performance meets agreed needs.

Question 7Fundamental concepts and principles of governance of IT

A regulator requires an insurer to retain records for seven years. The board asks for assurance that IT records management policies and practices meet this obligation. Which principle is most relevant?

  1. Acquisition
  2. Strategy
  3. Conformance Correct answer.
  4. Performance

Explanation

The conformance principle requires IT to comply with mandatory legislation and regulations, and with the organization's own policies and practices. A seven-year record retention obligation is a legal requirement, so assurance over records management is a conformance matter. It is not primarily about strategy alignment or service performance.

Question 8Fundamental concepts and principles of governance of IT

An organization redesigns a customer-facing portal after usability testing with older users and people with disabilities, and adjusts change management to reduce staff resistance. Which principle is most directly addressed?

  1. Acquisition based on analysis of costs and risks
  2. Strategy for aligning IT with business direction
  3. Responsibility for accepted IT duties and authority
  4. Human behaviour, including user needs Correct answer.

Explanation

The human behaviour principle requires IT policies, practices, and decisions to demonstrate respect for human behaviour, including the needs of all people in the process. Usability testing with older users and people with disabilities, plus attention to staff resistance, addresses those human needs. It is broader than simply meeting a technical specification.

Question 9Fundamental concepts and principles of governance of IT

A board approves the IT risk appetite and the IT strategy, then receives quarterly assurance reports on risk and performance. It leaves vendor selection and service operations to executive management. Which statement best explains this allocation?

  1. The board is managing IT because it approves the strategy and risk appetite and receives assurance reports
  2. The board is conformance-focused because it receives assurance reports and approves the IT risk appetite
  3. The board governs through evaluate, direct, and monitor; management executes Correct answer.
  4. The board has delegated its accountability for IT risk to management by allowing executive decisions on vendors and operations

Explanation

ISO/IEC 38500 separates governance from management. The governing body evaluates, directs, and monitors IT, while management plans, builds, runs, and executes within the boundaries set by governance. Delegating execution does not remove the board's accountability for IT governance.

Question 10Fundamental concepts and principles of governance of IT

A governing body wants to apply the Evaluate-Direct-Monitor model to a proposed core banking replacement. It has already commissioned an independent business case review and approved the target architecture and funding envelope. Which action best completes the model at the governance level?

  1. Selecting the preferred software vendor and negotiating the contract terms and price
  2. Reviewing delivery performance and conformance at defined checkpoints Correct answer.
  3. Managing the daily migration of user accounts
  4. Writing the detailed test scripts for system acceptance

Explanation

In the Evaluate-Direct-Monitor model, evaluation reviews proposals and options, direction approves plans and boundaries, and monitoring checks performance and conformance. The governing body has evaluated the business case and directed the architecture and funding, so the next governance step is monitoring. Vendor selection, test scripts, and account migration are management activities.

Question 11Fundamental concepts and principles of governance of IT

In ISO/IEC 38500 terms, which statement best describes the relationship between governance of IT and management of IT?

  1. Governance of IT is the same as management of IT, because both are performed by the chief information officer.
  2. Governance of IT covers only the acquisition of hardware, while management of IT covers only software development.
  3. Governance of IT is carried out by IT operations staff, while management of IT is carried out by the board of directors.
  4. Governance evaluates, directs and monitors IT use; management executes day-to-day activities within that direction. Correct answer.

Explanation

ISO/IEC 38500 distinguishes governance from management: the governing body evaluates, directs and monitors the use of IT, while management implements plans and runs day-to-day operations within the direction set. The two are complementary but not interchangeable.

Question 12Fundamental concepts and principles of governance of IT

Which organizations does ISO/IEC 38500 state it is intended to apply to?

  1. All organizations, regardless of size, sector or legal form Correct answer.
  2. Only organizations listed on a stock exchange
  3. Only organizations that operate their own data centres
  4. Only public-sector bodies with a statutory audit obligation

Explanation

ISO/IEC 38500 is written for governing bodies of all organizations, whatever their size, sector, ownership or legal form. It addresses the governance of IT wherever IT is used, not only in large or listed enterprises.

Question 13Fundamental concepts and principles of governance of IT

Which set lists the six principles of ISO/IEC 38500?

  1. Responsibility, Security, Availability, Capacity, Continuity and Compliance
  2. Responsibility, Strategy, Acquisition, Performance, Conformance and Human Behaviour Correct answer.
  3. Strategy, Architecture, Delivery, Operations, Security and Risk
  4. Accountability, Efficiency, Innovation, Resilience, Transparency and Value

Explanation

ISO/IEC 38500 sets out six principles: Responsibility, Strategy, Acquisition, Performance, Conformance and Human Behaviour. They guide the governing body's evaluation, direction and monitoring of the use of IT.

Question 14Fundamental concepts and principles of governance of IT

A board delegates authority for a major IT programme to a CIO and an investment committee. What does ISO/IEC 38500 require regarding accountability?

  1. Accountability moves to the investment committee because it approves the funding.
  2. The board remains accountable and should monitor how delegated authority is used. Correct answer.
  3. The board may transfer all accountability to the CIO once the delegation is documented.
  4. External auditors become accountable for the programme because they review the board's controls.

Explanation

Delegation can assign authority and tasks, but the governing body remains accountable for the governance of IT. It should therefore monitor how delegated authority is exercised and whether outcomes match the agreed direction.

Question 15Fundamental concepts and principles of governance of IT

In the Evaluate-Direct-Monitor model, which activity is part of the Direct task?

  1. Assessing external pressures that may change the demand for IT
  2. Obtaining assurance that legal and regulatory requirements are met
  3. Assigning responsibilities and approving policies, plans and budgets Correct answer.
  4. Comparing actual service levels against agreed performance targets

Explanation

Directing covers the preparation and implementation of plans and policies, including assigning responsibility, setting direction and allocating budgets. Comparing performance and obtaining assurance are monitoring activities, while assessing pressures belongs to evaluation.

Question 16Fundamental concepts and principles of governance of IT

An online retailer's payment platform meets all current service targets, but a forecast tripling of transaction volume has not been assessed and no capacity plan exists. Which ISO/IEC 38500 principle is most directly relevant to this gap?

  1. Human Behaviour
  2. Conformance
  3. Acquisition
  4. Performance Correct answer.

Explanation

The Performance principle requires IT to be fit for purpose and to provide service levels sufficient for both current and future business requirements. Meeting only present targets without planning for forecast demand leaves future performance unaddressed.

Question 17Fundamental concepts and principles of governance of IT

Which statement best captures the Conformance principle in ISO/IEC 38500?

  1. IT complies with laws and regulations, and policies are defined, implemented and enforced. Correct answer.
  2. IT is acquired only after a transparent comparison of benefits, costs, opportunities and risks.
  3. IT is designed around the skills, culture and evolving needs of the people who use it.
  4. IT delivers the lowest-cost service that satisfies all current business demand.

Explanation

Conformance covers obedience to mandatory legislation and regulations, together with clearly defined, implemented and enforced internal policies and practices. Cost minimisation, acquisition analysis and human-centred design belong to other principles.

Question 18Fundamental concepts and principles of governance of IT

Beyond accessibility for users with disabilities, which concern falls within the Human Behaviour principle of ISO/IEC 38500?

  1. Considering the skills, culture and evolving needs of all people involved in or affected by IT Correct answer.
  2. Confirming that IT contracts include exit and transition clauses
  3. Ensuring every IT project has a documented business case
  4. Verifying that statutory record-retention periods are met

Explanation

Human Behaviour requires IT policies, practices and decisions to respect the current and evolving needs of all people in the process, including workforce skills and organizational culture. It is broader than accessibility alone.

Question 19Fundamental concepts and principles of governance of IT

Which set of activities best reflects the Evaluate task in ISO/IEC 38500's governing model?

  1. Assigning responsibilities, approving policies and issuing directions to management
  2. Measuring service levels, auditing compliance and reporting on conformance
  3. Assessing current and future use of IT, including business pressures, needs and opportunities Correct answer.
  4. Designing IT processes, running projects and resolving operational incidents

Explanation

Evaluation examines the current and future use of IT in the context of business pressures and needs, and considers opportunities and risks before direction is set. Directing and monitoring follow from that evaluation.

Question 20Fundamental concepts and principles of governance of IT

Which statement about ISO/IEC 38500 is accurate?

  1. It is principles-based and technology-neutral, and can be used alongside frameworks such as COBIT and ITIL. Correct answer.
  2. It is a mandatory regulation that imposes legal penalties on directors who fail to comply.
  3. It prescribes detailed ITIL service-management processes that organizations must certify against.
  4. It provides a technical reference architecture for cloud and data-centre infrastructure.

Explanation

ISO/IEC 38500 provides principles and a governance model rather than detailed process prescriptions, and it is technology-neutral. Organizations commonly combine it with management frameworks that supply detailed practices.

Question 21Fundamental concepts and principles of governance of IT

In ISO/IEC 38500, what does the term "governing body" refer to?

  1. The vendor steering committee that controls outsourced IT service delivery arrangements
  2. The board or equivalent group accountable for the organization Correct answer.
  3. The CIO and senior IT managers who operate the organization's technology services day to day
  4. The external auditor engaged to review the organization's financial statements and controls

Explanation

ISO/IEC 38500 uses "governing body" for the person or group with ultimate accountability for the organization, often the board or equivalent. It is not the IT management team, an auditor, or a supplier committee, because those roles support or execute governance rather than own it.

Question 22Fundamental concepts and principles of governance of IT

How does ISO/IEC 38500 position governance of IT in relation to corporate governance?

  1. Governance of IT is owned exclusively by the IT department and is independent of board oversight
  2. Governance of IT is part of corporate governance and aligns with overall governance Correct answer.
  3. Governance of IT applies only to publicly listed companies, while corporate governance applies to all organizations
  4. Governance of IT is a separate discipline that replaces corporate governance for technology decisions

Explanation

ISO/IEC 38500 treats governance of IT as part of the organization's overall governance, not as an isolated IT activity. It should be consistent with corporate governance arrangements and board-level accountability.

Question 23Fundamental concepts and principles of governance of IT

How does ISO/IEC 38500 expect an organization to apply its six governance principles?

  1. Apply all six principles together as an interrelated set Correct answer.
  2. Select one principle each year and ignore the others until the next annual review
  3. Apply only the principles that the IT department can measure with existing tools and reporting
  4. Apply the principles only after an external audit has confirmed full compliance

Explanation

The six principles are intended to be applied as a coherent set, because they reinforce one another and cover different aspects of governance. An organization should not treat them as optional items or as a checklist to be applied one at a time.

Question 24Fundamental concepts and principles of governance of IT

A board wants to follow ISO/IEC 38500 but has no fixed annual cycle for IT governance activities. How should it schedule its Evaluate, Direct and Monitor tasks?

  1. Only when a major IT incident or significant audit finding occurs
  2. Once every five years, coinciding with the strategic planning cycle
  3. As an ongoing cycle at intervals appropriate to the organization Correct answer.
  4. Only when the CIO requests a board decision or approval

Explanation

ISO/IEC 38500 presents Evaluate, Direct and Monitor as continuous governance tasks, not a one-off event or a fixed calendar ritual. The governing body should decide the cadence based on risk, change and the importance of the matter.

Question 25Fundamental concepts and principles of governance of IT

A director claims that ISO/IEC 38500 requires the organization to implement specific IT processes and tools. Which response best reflects the standard?

  1. It is principles-based and gives high-level guidance to the governing body Correct answer.
  2. It prescribes a single organizational structure for IT governance
  3. It requires certification against a fixed control catalogue before governance can begin
  4. It mandates a specific set of ITIL processes for every organization

Explanation

ISO/IEC 38500 sets out principles and a governing model; it does not prescribe detailed management processes, tools or a single structure. Organizations tailor the implementation to their context.

Question 26Fundamental concepts and principles of governance of IT

In ISO/IEC 38500, what does the term "IT" cover when governing its use?

  1. Only the computer hardware owned by the IT department
  2. Only externally hosted cloud services and related contracts
  3. All information and communication technology used across the organization Correct answer.
  4. Only the software applications developed in-house by IT staff

Explanation

The standard addresses the organization's use of IT broadly, not just one department's equipment or a single sourcing model. It includes the information and communication technologies that support business activities.

Question 27Fundamental concepts and principles of governance of IT

Which statement best describes the relationship between the six principles and the Evaluate-Direct-Monitor model in ISO/IEC 38500?

  1. Evaluate, Direct and Monitor are optional, while the principles are mandatory
  2. The principles apply only to management, while the model applies only to the board
  3. The principles replace Evaluate, Direct and Monitor when an organization is small
  4. The principles guide the governing body's evaluate, direct and monitor tasks Correct answer.

Explanation

The principles express expected governance behavior, and the Evaluate-Direct-Monitor model describes the tasks through which that behavior is applied. Together they form a framework in which principles inform the decisions and oversight activities.

Question 28Fundamental concepts and principles of governance of IT

A board focuses only on cutting IT costs and does not consider benefits, risks or conformance. Which statement best reflects ISO/IEC 38500's expectation for balanced governance?

  1. Governance of IT should balance value and performance with risk and conformance Correct answer.
  2. Benefits and risks are management concerns that the governing body should ignore
  3. Cost reduction is the sole legitimate objective of governance of IT
  4. Conformance matters only when a regulator performs an inspection

Explanation

ISO/IEC 38500 expects the governing body to consider whether IT delivers value and performance while also managing risk and ensuring conformance. A cost-only focus is unbalanced and can undermine both opportunity and compliance.

Question 29Fundamental concepts and principles of governance of IT

An organization's CIO argues that the six ISO/IEC 38500 principles are "for the IT department" and do not concern the board. How should the governing body interpret this?

  1. The principles apply only to the board's audit committee, not the full governing body
  2. The CIO is correct because the principles are operational IT controls
  3. The principles apply to governing body behavior and to delegated management Correct answer.
  4. The principles apply only to organizations that outsource all IT services

Explanation

ISO/IEC 38500 addresses the governing body and expects it to apply the principles when directing and controlling IT; management then applies them as delegated. The principles are governance expectations, not a set of operational IT controls.

Question 30Fundamental concepts and principles of governance of IT

Why does ISO/IEC 38500 focus on governing body accountability and principles rather than prescribing a specific IT governance structure?

  1. Because only external regulators may decide the structure of IT governance
  2. Because structures vary, it focuses on governance behaviors and outcomes Correct answer.
  3. Because all organizations must use the same committee structure to comply
  4. Because structure is irrelevant to whether IT is governed effectively

Explanation

ISO/IEC 38500 is designed to be applicable across different organizations, so it avoids a one-size-fits-all structure. It instead specifies principles and a governing model that the accountable body applies according to its context.

Question 31Fundamental concepts and principles of governance of IT

In ISO/IEC 38500, the governing body's tasks are summarized by the abbreviation EDM. What does EDM stand for?

  1. Evaluate, Direct, Monitor Correct answer.
  2. Establish, Direct, Measure
  3. Evaluate, Deploy, Monitor
  4. Envision, Deliver, Manage

Explanation

ISO/IEC 38500 summarizes the governing body's work as Evaluate, Direct and Monitor. Evaluate examines current and future use of IT, Direct sets direction and assigns responsibility, and Monitor measures performance and conformance. The other options use invented terms that are not the EDM model.

Question 32Fundamental concepts and principles of governance of IT

Which ISO/IEC 38500 principle requires that IT acquisitions be justified by appropriate analysis of costs, benefits, risks, and alternatives over the life cycle?

  1. Strategy
  2. Responsibility
  3. Acquisition Correct answer.
  4. Performance

Explanation

The Acquisition principle requires valid reasons for acquiring IT, supported by appropriate analysis of costs, benefits, risks and alternatives across the life cycle. It also expects transparent and clear decision-making. Strategic alignment, service quality and accountability are addressed by other principles.

Question 33Fundamental concepts and principles of governance of IT

Which ISO/IEC 38500 principle is primarily concerned with IT being fit for purpose and delivering the required quality of service?

  1. Risk
  2. Human Behaviour
  3. Performance Correct answer.
  4. Conformance

Explanation

The Performance principle focuses on IT being fit for purpose and delivering the required quality of service. It asks whether IT is meeting agreed service levels and supporting business needs effectively. Compliance, human factors and uncertainty are covered by other principles.

Question 34Fundamental concepts and principles of governance of IT

A company refreshes its IT strategy only after business changes have already been implemented, so IT consistently lags behind new products and channels. Which ISO/IEC 38500 principle is most directly undermined?

  1. Conformance
  2. Acquisition
  3. Strategy Correct answer.
  4. Human Behaviour

Explanation

The Strategy principle requires IT to support the organization's current and future business needs, so IT planning should inform and respond to business direction. An IT strategy that only reacts after business change consistently lags and undermines that principle. Compliance, acquisition justification and human factors are handled by other principles.

Question 35Fundamental concepts and principles of governance of IT

A board requires every major IT initiative to have a named business executive who accepts accountability for the outcome, while the CIO remains accountable for delivery. Which ISO/IEC 38500 principle does this primarily implement?

  1. Risk
  2. Strategy
  3. Responsibility Correct answer.
  4. Performance

Explanation

Responsibility requires individuals to understand and accept their responsibilities for both the supply and demand of IT. Naming a business executive and a CIO makes accountability explicit on both sides. Performance, Strategy and Risk address different governance concerns.

Question 36Fundamental concepts and principles of governance of IT

A board approves an IT programme that is strategically important but has no documented assessment of the likelihood and impact of key technology and supplier failures. Which principle is most directly neglected?

  1. Risk Correct answer.
  2. Performance
  3. Conformance
  4. Acquisition

Explanation

The Risk principle requires the governing body to ensure IT-related risks are understood and managed, including technology and supplier failures. A sound strategic case does not remove the need to assess likelihood, impact and treatment. Acquisition, Conformance and Performance address other aspects of governance.

Question 37Fundamental concepts and principles of governance of IT

A board receives IT performance reports six months after the end of each period and has no opportunity to question them before the next period's decisions. Which aspect of ISO/IEC 38500 governance is most directly impaired?

  1. The choice of software development methodology
  2. Timely monitoring and correction of IT direction Correct answer.
  3. The board's authority to approve the annual IT budget
  4. The delegation of IT operations to executive management

Explanation

Governance relies on timely, relevant information so the governing body can monitor performance and conformance and direct corrective action. Six-month-old reports prevent the board from questioning and correcting direction before decisions are made. Budget approval, delegation and methodology choice are not the aspect most directly impaired by delayed reporting.

Question 38Fundamental concepts and principles of governance of IT

An organization completes a one-off ISO/IEC 38500 assessment, files the results, and makes no further changes to its governance arrangements. Which statement best reflects ISO/IEC 38500's view of governance?

  1. Governance is complete once the six principles have been documented.
  2. Governance is a project that ends when the assessment report is signed off.
  3. Governance is primarily an annual audit exercise.
  4. Governance is a continuous cycle of evaluating, directing, and monitoring IT. Correct answer.

Explanation

ISO/IEC 38500 presents governance as a continuing cycle of Evaluate, Direct and Monitor, not a one-time assessment or document set. The governing body must keep reviewing IT as business needs and risks change. Audits and principle documentation may support governance but do not complete it.

Question 39Fundamental concepts and principles of governance of IT

A board outsources all IT operations to a cloud provider and states that the provider is now accountable for governance of IT. Which response is most consistent with ISO/IEC 38500?

  1. The provider becomes the governing body once the contract is signed.
  2. Provider certifications replace the board's governance duties.
  3. Accountability transfers automatically with operational control.
  4. The board remains accountable and must govern the outsourced arrangement. Correct answer.

Explanation

Under ISO/IEC 38500, the governing body remains accountable for governance of IT even when operations are outsourced. It must still evaluate the arrangement, direct the relationship and monitor performance and conformance. Provider certifications can inform monitoring but do not transfer or replace the board's accountability.

Question 40Fundamental concepts and principles of governance of IT

A governing body has strong Evaluate and Direct activity but no effective Monitor activity. Which consequence is most significant for governance of IT?

  1. The organization will automatically breach every applicable legal and regulatory IT requirement.
  2. The CIO will become the governing body for IT by default.
  3. The board will be unable to set any IT strategy or approve any future IT investment.
  4. The board cannot verify that its direction is followed or that IT performs and conforms. Correct answer.

Explanation

Monitoring provides evidence that direction is implemented and that IT performance and conformance meet expectations. Without it, the governing body has no feedback loop for corrective action. A monitoring gap does not automatically make the CIO the governing body or cause every legal requirement to be breached.

Question 41Fundamental concepts and principles of governance of IT

Which of the following is one of the six governance principles defined in ISO/IEC 38500?

  1. Responsibility Correct answer.
  2. Agility
  3. Scalability
  4. Profitability

Explanation

ISO/IEC 38500 sets out six principles: Responsibility, Strategy, Acquisition, Performance, Conformance and Human Behaviour. Responsibility is therefore the only listed item that belongs to that set. The other options describe financial, technical or delivery qualities rather than governance principles.

Question 42Fundamental concepts and principles of governance of IT

To which organizations does ISO/IEC 38500 apply its guidance on governance of IT?

  1. Only organizations that operate their own data centres
  2. Only public-sector bodies that are subject to procurement legislation
  3. All organizations, regardless of size or sector Correct answer.
  4. Only listed companies that have a statutory audit committee

Explanation

ISO/IEC 38500 is general guidance for governing bodies in organizations of any size, type and sector, whether public or private. It is not limited by ownership, regulatory status or whether IT is operated internally or outsourced.

Question 43Fundamental concepts and principles of governance of IT

How does ISO/IEC 38500 define governance of IT?

  1. The process of selecting and contracting IT suppliers
  2. The technical design of resilient systems and networks
  3. The daily operation of IT services against agreed service levels
  4. The system directing and controlling current and future IT use Correct answer.

Explanation

Governance of IT concerns the direction and control of IT use, both now and in the future, rather than operational or technical execution. It involves evaluating, directing and monitoring IT so that it supports the organization's objectives.

Question 44Fundamental concepts and principles of governance of IT

Within the Evaluate-Direct-Monitor model, what is the governing body primarily doing when it performs the Evaluate task?

  1. Writing detailed technical standards for system configuration, patching and hardening
  2. Approving operational change requests and closing incidents
  3. Negotiating software licences with external vendors
  4. Examining current and future IT use and supply arrangements Correct answer.

Explanation

Evaluate means assessing the organization's current and future use of IT, including strategies, proposals and arrangements for supplying IT, so that the governing body can judge whether they support business objectives. It is an oversight activity rather than operational execution.

Question 45Fundamental concepts and principles of governance of IT

A governing body has approved a digital strategy but has not assigned implementation responsibilities, set policies or allocated resources. Which EDM task is most directly missing?

  1. Monitor
  2. Evaluate
  3. Audit
  4. Direct Correct answer.

Explanation

Direct is the task in which the governing body assigns responsibility, sets direction through policies and plans, and ensures resources are allocated. Approval alone does not direct implementation, and monitoring follows only after direction has been established.

Question 46Fundamental concepts and principles of governance of IT

A retailer's new loyalty application collects personal data in breach of privacy law, and the board has no process for checking legal or contractual IT obligations. Which ISO/IEC 38500 principle is most directly neglected?

  1. Acquisition
  2. Conformance Correct answer.
  3. Strategy
  4. Human Behaviour

Explanation

The Conformance principle requires IT to comply with mandatory legislation and regulations and to align with internal policies and contractual obligations. A privacy-law breach and the absence of checks on legal obligations are therefore direct conformance failures.

Question 47Fundamental concepts and principles of governance of IT

An organization introduces an IT system that ignores accessibility needs and forces staff into impractical workflows, leading to workarounds. Which principle is most directly relevant?

  1. Performance
  2. Human Behaviour Correct answer.
  3. Acquisition
  4. Strategy

Explanation

The Human Behaviour principle states that IT policies and practices should respect human behaviour, including ergonomics, accessibility and the needs of people who use IT. Ignoring accessibility and forcing impractical workflows directly undermines that principle.

Question 48Fundamental concepts and principles of governance of IT

Which set of activities best represents the Monitor task in ISO/IEC 38500?

  1. Designing applications, operating service desks and resolving incidents
  2. Measuring performance against plans and checking conformance Correct answer.
  3. Selecting suppliers, negotiating contracts and building business cases
  4. Setting IT strategy, assigning decision rights and approving business cases

Explanation

Monitor involves measuring IT performance against plans and objectives and checking whether IT conforms to policies, obligations and expected behaviour. The governing body uses this oversight evidence to adjust direction. Setting strategy is primarily Direct, while building and operating are management activities.

Question 49Fundamental concepts and principles of governance of IT

A board spends most of its meeting time approving server configurations and resolving helpdesk escalations, while strategic direction and performance oversight are neglected. Which ISO/IEC 38500 concept does this best illustrate?

  1. Appropriate delegation of EDM tasks to management
  2. Confusion of governance with management Correct answer.
  3. Correct application of the Acquisition principle
  4. A necessary operational control for achieving conformance

Explanation

ISO/IEC 38500 assigns the governing body the tasks of evaluating, directing and monitoring IT use rather than managing operations. When a board performs technical and operational work itself, it substitutes management for governance and neglects direction and oversight.

Question 50Fundamental concepts and principles of governance of IT

An organization asks each department to self-score the six principles and reports the average score as proof of good IT governance. Which criticism is most consistent with ISO/IEC 38500?

  1. The principles apply only to the IT function, so other departments should not score them
  2. The principles are qualitative, so self-scores without evidence do not demonstrate governance Correct answer.
  3. The principles are mandatory legal requirements, so self-scoring is prohibited
  4. The six principles must be applied in strict sequence, so averaging them is invalid

Explanation

The six principles are statements of good practice that guide behaviour and outcomes; they are not a scoring instrument, and a self-assessed average without evidence of EDM activity proves little. Governance is demonstrated through consistent direction, oversight and behaviour, not through an aggregate score.