I85PREP
⌘ K
ISO/IEC 38500 Lead IT Governance Manager study materials
ISO/IEC 38500 Lead IT Governance Manager study resources

ISO/IEC 38500 Lead IT Governance Manager practice questions

One question at a time. Build your ISO/IEC 38500 Lead IT Governance Manager understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

ISO/IEC 38500 describes the governance of IT primarily as the system by which the organization does what?

  1. Designs and operates data centres on behalf of the business
  2. Delivers software projects within agreed budgets
  3. Audits technology suppliers against contract terms
  4. Directs and controls the use of IT and evaluates the results Correct answer.

Explanation

ISO/IEC 38500 defines governance of IT as the system by which the current and future use of IT is directed and controlled, with evaluation of results. It is a leadership and oversight activity, not an operational delivery or assurance function.

Question 2Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

Which pair of activities does ISO/IEC 38500 assign to the governing body in relation to IT use?

  1. Procurement and vendor negotiation
  2. Recruitment and skills development
  3. Coding and configuration management
  4. Evaluation, direction and monitoring Correct answer.

Explanation

The standard's model gives the governing body three duties: evaluate the current and future use of IT, direct plans and policies, and monitor conformance and performance. These three tasks form the well-known evaluate-direct-monitor cycle.

Question 3Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

In the ISO/IEC 38500 model, what is the primary purpose of the 'monitor' activity?

  1. To approve the annual IT capital budget
  2. To negotiate service credits with suppliers
  3. To verify that IT performance and conformance meet the directed plans Correct answer.
  4. To select the technology stack for new products

Explanation

Monitoring checks whether IT is performing as directed and conforming to policies, using agreed measures and reporting. It closes the loop after evaluation and direction, allowing corrective action by the governing body.

Question 4Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

How many principles for good IT governance does ISO/IEC 38500 set out?

  1. Six Correct answer.
  2. Three
  3. Four
  4. Nine

Explanation

ISO/IEC 38500 lists six principles: responsibility, strategy, acquisition, performance, conformance and human behaviour. Each principle is expressed as a statement of expected behaviour for the governing body.

Question 5Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

Which ISO/IEC 38500 principle requires that individuals understand and accept their responsibilities for IT?

  1. Acquisition
  2. Performance
  3. Responsibility Correct answer.
  4. Conformance

Explanation

The responsibility principle states that individuals and groups within the organization understand and accept their responsibilities in respect of both supply of and demand for IT. It also requires that those with responsibility have the authority to discharge it.

Question 6Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

The ISO/IEC 38500 principle of 'strategy' requires that business and IT plans satisfy which condition?

  1. They are reviewed by the CIO alone
  2. They are published to shareholders annually
  3. They are approved by the external auditor
  4. They are integrated and aligned with organizational objectives Correct answer.

Explanation

The strategy principle requires that business and IT plans are integrated and aligned, with IT supporting and enabling the organization's objectives. It also expects the governing body to evaluate proposals and allocate resources consistent with that alignment.

Question 7Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

Under the 'acquisition' principle, IT acquisitions should be made for which type of reason?

  1. Valid and compelling business reasons on an appropriate basis Correct answer.
  2. Reasons driven by supplier discount deadlines
  3. Reasons that minimize the immediate cash outlay
  4. Reasons based on the latest market trend

Explanation

The acquisition principle expects IT acquisitions to be made for valid and compelling business reasons, on an appropriate analysis of costs, benefits, opportunities and risks. It also expects a suitable balance between benefits, opportunities, costs and risks over the short and long term.

Question 8Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

The ISO/IEC 38500 principle of 'human behaviour' requires IT to respect which consideration?

  1. Only the behaviour of the executive leadership team
  2. Only the behaviour of end customers
  3. Only the behaviour of external service providers
  4. Current human behaviour and the future needs of all people involved Correct answer.

Explanation

The human behaviour principle states that IT policies, practices and decisions demonstrate respect for current and evolving human behaviour, and that they consider the needs of all people involved. This includes staff, customers and other stakeholders affected by IT.

Question 9Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

A board delegates IT decision rights to a technology steering committee but keeps no reporting line and no defined limits on that delegation. Which governance principle is most directly weakened?

  1. Acquisition
  2. Responsibility Correct answer.
  3. Performance
  4. Conformance

Explanation

The responsibility principle requires that individuals and groups understand and accept their responsibilities and have the authority to discharge them. Delegation without defined limits, accountability or reporting undermines that principle even where performance or conformance are not yet affected.

Question 10Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

An organization's IT strategy document is written by the technology function and approved by the board, but it makes no reference to the corporate plan's growth targets. Which principle is most clearly breached?

  1. Responsibility
  2. Human behaviour
  3. Strategy Correct answer.
  4. Performance

Explanation

The strategy principle requires business and IT plans to be integrated and aligned with organizational objectives. An IT strategy disconnected from corporate growth targets fails that alignment test regardless of who approved it.

Question 11Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

A governing body approves a major cloud migration because a peer organization adopted the same platform, without any cost-benefit or risk analysis. Which principle is most directly violated?

  1. Conformance
  2. Human behaviour
  3. Acquisition Correct answer.
  4. Performance

Explanation

The acquisition principle requires valid and compelling business reasons supported by appropriate analysis of costs, benefits, opportunities and risks. Copying a peer's decision without such analysis fails that requirement.

Question 12Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

Which statement best describes the relationship between ISO/IEC 38500 governance and day-to-day IT management?

  1. Governance replaces management by centralizing all decisions in the board
  2. Governance and management are identical activities with different names
  3. Governance sets direction and constraints within which management operates Correct answer.
  4. Management sets direction and governance executes the resulting plans

Explanation

ISO/IEC 38500 positions governance as the direction and control framework that constrains and guides management, which then executes within it. The governing body evaluates, directs and monitors; managers plan, build, run and report.

Question 13Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

In the ISO/IEC 38500 model, which element sits between the governing body's direction and its monitoring?

  1. Regulatory filing with the sector supervisor
  2. Delegated execution by management within defined limits Correct answer.
  3. Independent audit of every IT project
  4. Supplier selection by the procurement team

Explanation

Direction is translated into plans and policies that management executes within delegated limits, and the results of that execution are then monitored. The model therefore relies on a clear delegation chain between direction and monitoring.

Question 14Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

A board wants assurance that IT is conforming to legal and regulatory requirements. Which ISO/IEC 38500 principle addresses this expectation?

  1. Human behaviour
  2. Acquisition
  3. Conformance Correct answer.
  4. Strategy

Explanation

The conformance principle requires that IT complies with all mandatory legislation and regulations, and that policies and practices are clearly defined, implemented and enforced. Legal and regulatory compliance therefore falls squarely under conformance.

Question 15Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

Which outcome is the clearest sign that the 'performance' principle is being applied?

  1. IT plans are merged with the corporate plan
  2. IT services are measured against agreed fitness-for-purpose criteria throughout their useful life Correct answer.
  3. IT purchases are justified by a business case before approval
  4. IT staff sign an annual code of conduct

Explanation

The performance principle requires IT to be fit for purpose, delivering required quality and service levels over its useful life, supported by clear metrics. Merging plans relates to strategy, business cases to acquisition and conduct to human behaviour.

Question 16Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

A hospital deploys an automated triage tool that clinicians find unusable, and patient-facing staff were never consulted. Which principle is most directly engaged?

  1. Acquisition
  2. Human behaviour Correct answer.
  3. Conformance
  4. Strategy

Explanation

The human behaviour principle requires IT decisions to respect the current and evolving needs of all people involved, including those who use and are affected by the system. Ignoring clinician and patient-facing staff needs in design and deployment directly engages it.

Question 17Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

Which statement correctly captures how ISO/IEC 38500 relates to other ISO management system standards such as ISO/IEC 27001?

  1. ISO/IEC 38500 replaces the need for any IT management framework
  2. ISO/IEC 38500 provides governing-body guidance that other standards can support Correct answer.
  3. ISO/IEC 38500 certifies organizations that meet its principles
  4. ISO/IEC 38500 specifies technical controls for IT infrastructure

Explanation

ISO/IEC 38500 is guidance for those who direct and control IT use, and it is designed to be used alongside frameworks and standards that address specific management disciplines. It is not a certifiable management system standard and contains no technical controls.

Question 18Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

Which audience is the primary target of ISO/IEC 38500's guidance?

  1. Data centre technicians operating hardware
  2. Software developers implementing secure code
  3. External auditors issuing IT opinions
  4. Governing bodies and those who direct IT use Correct answer.

Explanation

The standard is written for the governing body and those accountable for directing and controlling IT use, including boards and equivalent bodies. Technical and operational audiences are served by other standards.

Question 19Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

A board receives quarterly IT reports showing only project spend against budget, with no data on service availability, incidents or benefits realized. Which governance weakness is most evident?

  1. Monitoring is too narrow to confirm performance and conformance Correct answer.
  2. The acquisition principle is breached because spend is tracked
  3. The direction activity is absent because no new policy exists
  4. The responsibility principle is satisfied because reports exist

Explanation

Monitoring must confirm both conformance and performance; budget spend alone cannot show whether IT is fit for purpose or compliant. The board lacks the evidence needed to evaluate results and redirect if necessary.

Question 20Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

An organization applies all six ISO/IEC 38500 principles but has never assigned accountability for IT outcomes to named executives. What is the most accurate assessment?

  1. The responsibility principle is not genuinely met despite nominal coverage Correct answer.
  2. The performance principle is the only one that matters in this case
  3. Governance is fully effective because all six principles are addressed
  4. The organization must abandon the framework and adopt a different one

Explanation

The responsibility principle requires that individuals understand and accept their responsibilities and have authority to act. Applying the other principles without named accountability leaves the governance system without an owner, so coverage is nominal rather than effective.

Question 21Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

A regulator introduces a new data retention rule. The board directs compliance, but no mechanism exists to verify that legacy systems have been updated. Which combination of governance activities is deficient?

  1. Monitoring only, because verification was never performed
  2. Monitoring and evaluation, because verification is absent and results were never assessed Correct answer.
  3. Evaluation only, because the rule was not assessed before direction
  4. Direction only, because the board issued an instruction

Explanation

Direction was given, but the absence of verification means monitoring is deficient, and without verified results the board cannot evaluate whether the direction was effective. Governance requires the full evaluate-direct-monitor cycle to close.

Question 22Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

A group board sets IT principles centrally while business units execute projects locally. Which arrangement best reflects ISO/IEC 38500's intent?

  1. Delegation is incompatible with the standard's principles
  2. The board retains evaluation, direction and monitoring while units operate within delegated limits Correct answer.
  3. The board should approve every local project to ensure control
  4. Business units should set their own principles to remain agile

Explanation

The standard expects the governing body to retain evaluation, direction and monitoring while delegating execution within clearly defined limits and reporting lines. This preserves accountability without centralizing operational decisions.

Question 23Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

Two proposals compete for funding: one offers quick cost savings but creates long-term lock-in, the other offers modest savings with flexibility. Which principle guides the governing body's comparison?

  1. Acquisition, because it requires balancing benefits, opportunities, costs and risks over short and long term Correct answer.
  2. Strategy, because only the corporate plan matters
  3. Human behaviour, because staff prefer flexible systems
  4. Conformance, because contracts must be legally reviewed

Explanation

The acquisition principle explicitly calls for an appropriate balance between benefits, opportunities, costs and risks in both the short and long term. That framing is exactly what distinguishes the two proposals.

Question 24Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

Which statement about the ISO/IEC 38500 principles is most accurate?

  1. They are prescriptive controls that must be implemented in a fixed sequence
  2. They apply only to listed companies in regulated sectors
  3. They are statements of expected behaviour that apply to all organizations using IT Correct answer.
  4. They are optional recommendations with no bearing on accountability

Explanation

The six principles are expressed as statements of expected behaviour for the governing body and apply to organizations of any size or sector that use IT. They are not sequenced technical controls, and they carry accountability expectations.

Question 25Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

A governing body reviews IT only when a major incident occurs. Which characterization best fits ISO/IEC 38500?

  1. Acceptable, because incidents are the main governance trigger
  2. Inadequate only if the incident affected customers
  3. Inadequate, because evaluation, direction and monitoring should be continuous and planned Correct answer.
  4. Acceptable, provided an external audit is commissioned afterwards

Explanation

Governance under the standard is a continuous cycle of evaluating, directing and monitoring, supported by planned reporting. Reacting only to incidents leaves the governing body without the ongoing evidence it needs to direct IT effectively.

Question 26Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

Which three tasks does ISO/IEC 38500 assign to the governing body in its model for directing and controlling IT?

  1. Evaluate, direct and monitor Correct answer.
  2. Budget, procure and deploy
  3. Plan, build and run
  4. Audit, remediate and certify

Explanation

The ISO/IEC 38500 model describes governance as the governing body evaluating current and future IT use, directing preparation and implementation of plans and policies, and monitoring conformance and performance against those directions. Plan-build-run describes operational delivery rather than governance, and the other pairs describe assurance or procurement activities that sit below the governing body.

Question 27Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

In ISO/IEC 38500, what does the term 'governance of IT' refer to?

  1. The system by which the current and future use of IT is directed and controlled Correct answer.
  2. The contractual arrangements between an organization and its outsourcing vendors
  3. The process by which the IT function delivers help-desk services to users
  4. The set of technical standards used to configure servers and networks

Explanation

ISO/IEC 38500 defines governance of IT as the system by which the current and future use of IT is directed and controlled, involving the evaluation, direction and monitoring of IT use. It is a leadership and accountability system, not a technical standard set, a service-delivery process, or a vendor contract.

Question 28Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

Which ISO/IEC 38500 principle addresses the need to establish clear expectations of how IT will contribute to the organization's objectives?

  1. Conformance
  2. Performance Correct answer.
  3. Responsibility
  4. Human behaviour

Explanation

The performance principle requires that IT be fit for purpose and deliver the services, service levels and quality needed to meet current and future business requirements. Responsibility concerns accountability for IT, conformance concerns compliance with rules, and human behaviour concerns respecting people's needs.

Question 29Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

What is the primary purpose of the 'responsibility' principle in ISO/IEC 38500?

  1. To ensure that individuals understand and accept their responsibilities for IT and that authority is explicitly delegated Correct answer.
  2. To ensure that every IT system is certified against an international security standard
  3. To ensure that IT investments always deliver the lowest total cost of ownership
  4. To ensure that IT staff receive the same benefits as other employees

Explanation

The responsibility principle requires that individuals and groups within the organization understand and accept their responsibilities in respect of both supply of and demand for IT, with authority explicitly delegated. It is about clear accountability and decision rights, not cost minimization, certification, or employee benefits.

Question 30Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

According to ISO/IEC 38500, which principle requires IT to comply with legislation, regulation and internal policies?

  1. Performance
  2. Conformance Correct answer.
  3. Strategy
  4. Acquisition

Explanation

The conformance principle requires that IT and its use comply with all mandatory legislation and regulation, and with internal policies and practices. Strategy concerns alignment with business direction, acquisition concerns valid reasons for investment, and performance concerns fitness for purpose.

Question 31Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

Which ISO/IEC 38500 principle focuses on ensuring that IT acquisitions are made for demonstrable and valid reasons?

  1. Responsibility
  2. Conformance
  3. Human behaviour
  4. Acquisition Correct answer.

Explanation

The acquisition principle requires that IT acquisitions be made for valid reasons, on the basis of appropriate and ongoing analysis, with clear and transparent decision making. It targets the justification and decision quality behind IT investments, not compliance, conduct, or accountability placement.

Question 32Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

Which statement best describes the scope of ISO/IEC 38500?

  1. It provides principles and a model for governing IT that apply to organizations of all sizes, sectors and types Correct answer.
  2. It prescribes detailed technical controls for securing cloud infrastructure
  3. It specifies software development life-cycle processes for regulated industries
  4. It certifies organizations that have achieved a defined IT governance maturity level

Explanation

ISO/IEC 38500 is a high-level standard offering principles, definitions and a model for governance of IT, applicable to all organizations regardless of size, sector or type. It does not prescribe technical controls, define a maturity certification, or specify software development processes.

Question 33Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

In ISO/IEC 38500, which principle requires that IT respects and considers the needs of the people affected by it?

  1. Human behaviour Correct answer.
  2. Acquisition
  3. Strategy
  4. Performance

Explanation

The human behaviour principle requires that IT policies, practices and decisions consider and respect the current and evolving needs of the people involved, including staff and customers. Strategy, performance and acquisition address direction, delivery and investment justification respectively.

Question 34Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

A governing body wants each of the six ISO/IEC 38500 principles to be reflected in how the organization governs IT. How should the principles be treated?

  1. As mandatory requirements that only apply to publicly listed companies
  2. As a maturity ladder where each principle is adopted only after the previous one is fully achieved
  3. As a set of principles to be applied together, with each informing evaluation, direction and monitoring Correct answer.
  4. As an optional checklist from which an organization selects one principle per year

Explanation

The six principles form a coherent set that should be applied together, each informing the evaluate, direct and monitor tasks of the governing body. They are not a sequential maturity ladder, a menu of optional choices, or requirements restricted to particular company types.

Question 35Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

A governing body sets IT direction once and then reviews IT performance only against that original plan for several years, ignoring market and regulatory changes. Which ISO/IEC 38500 task is being performed inadequately?

  1. Acquisition of new hardware
  2. Compliance certification of suppliers
  3. Evaluation of current and future use of IT Correct answer.
  4. Assignment of responsibility to the CIO

Explanation

Evaluation requires understanding current and future use of IT in light of business needs and external change, and it feeds the direction and monitoring cycle. A one-off direction with no refreshed evaluation means the governing body is not evaluating, even if it continues to monitor. Responsibility assignment, hardware acquisition and supplier certification are subordinate activities that do not replace evaluation.

Question 36Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

A company's IT steering committee approves a new data platform, but no one can state who is accountable if the platform fails to meet business needs. Which ISO/IEC 38500 principle is most directly breached?

  1. Responsibility Correct answer.
  2. Performance
  3. Strategy
  4. Conformance

Explanation

The responsibility principle requires that individuals and groups understand and accept their responsibilities and that authority is explicitly delegated, including accountability for outcomes. An approval with no accountable owner leaves the decision orphaned, which is a responsibility gap rather than a compliance, delivery or alignment failure.

Question 37Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

An organization learns that a new privacy regulation applies to its customer analytics platform. Which ISO/IEC 38500 principle most directly requires the governing body to ensure the platform is brought into compliance?

  1. Performance
  2. Acquisition
  3. Human behaviour
  4. Conformance Correct answer.

Explanation

The conformance principle requires IT to comply with mandatory legislation and regulation, so a new privacy rule falls squarely within it. Acquisition concerns the reasons for investment, human behaviour concerns the needs of affected people, and performance concerns fitness for purpose.

Question 38Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

A governing body approves an IT investment only after the business sponsor demonstrates quantified benefits, risks and alternatives, and the decision rationale is recorded. Which principle is best evidenced?

  1. Human behaviour
  2. Acquisition Correct answer.
  3. Conformance
  4. Strategy

Explanation

The acquisition principle requires IT acquisitions to be made for valid reasons, based on appropriate and ongoing analysis, with clear and transparent decision making. Documented benefits, risks, alternatives and rationale demonstrate that requirement, whereas conformance, human behaviour and strategy address different concerns.

Question 39Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

What distinguishes the 'monitor' task in the ISO/IEC 38500 model from the 'direct' task?

  1. Monitor measures performance and conformance against direction, while direct assigns responsibility and sets policies and plans Correct answer.
  2. Monitor sets the IT strategy, while direct measures whether the strategy was achieved
  3. Monitor and direct are interchangeable labels for the same governance activity
  4. Monitor approves IT investments, while direct audits the resulting projects

Explanation

In the model, direction sets policies, plans and responsibility, while monitoring measures performance and conformance against that direction and feeds back into evaluation. Reversing the two, treating them as interchangeable, or mapping them to investment approval and audit misstates the model.

Question 40Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

A board asks how ISO/IEC 38500 relates to frameworks such as COBIT. Which description is most accurate?

  1. ISO/IEC 38500 and COBIT are identical documents published jointly by the same committee
  2. COBIT is a technical security standard that is unrelated to governance principles
  3. ISO/IEC 38500 provides governance principles and a model, while COBIT offers a more detailed framework of processes and practices that can support their implementation Correct answer.
  4. ISO/IEC 38500 supersedes COBIT and forbids its use in governed organizations

Explanation

ISO/IEC 38500 is a concise standard of principles and a model for governance of IT, whereas COBIT supplies a detailed framework of processes, practices and goals that organizations can use to operationalize those principles. They are complementary, and neither forbids the other.

Question 41Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

A governing body receives only a monthly count of IT incidents and no information on whether IT is meeting business service expectations. Which monitoring weakness does this represent under ISO/IEC 38500?

  1. Monitoring correctly focuses on operational metrics alone
  2. Monitoring lacks measures of performance against business requirements Correct answer.
  3. Monitoring should be delegated entirely to external auditors
  4. Monitoring is excessive and should be reduced

Explanation

Monitoring under ISO/IEC 38500 must cover both conformance and performance, meaning whether IT is fit for purpose and meeting business requirements. Incident counts alone are operational volume data and do not show whether service expectations are being met.

Question 42Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

Which outcome best demonstrates that the 'strategy' principle is being applied in an organization?

  1. IT costs are reduced by 10 percent year on year
  2. All IT staff hold a recognized service management certificate
  3. Every IT project is delivered within its original budget
  4. IT plans and business plans are developed together and IT investment is explicitly traced to business objectives Correct answer.

Explanation

The strategy principle requires that business and IT be aligned, with IT plans supporting and informing business objectives. Joint planning and explicit traceability from investment to objectives demonstrate that alignment, whereas cost reduction, certification and budget adherence are not evidence of strategic fit.

Question 43Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

A governing body sets IT principles and delegates project execution to business units, but requires each unit to report against those principles. Which ISO/IEC 38500 arrangement does this represent?

  1. Absence of any governance because execution is local
  2. Complete delegation of governance to business units
  3. Monitoring without any prior direction
  4. Direction with delegated execution and monitoring feedback Correct answer.

Explanation

The governing body retains governance by setting direction and requiring reporting, while execution is delegated to business units. This preserves the evaluate, direct and monitor cycle; it is not full abdication, an absence of governance, or monitoring without direction.

Question 44Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

Why does ISO/IEC 38500 address the governing body rather than the IT function?

  1. Because governing bodies write all software themselves
  2. Because the IT function is prohibited from reading the standard
  3. Because IT staff are exempt from compliance obligations
  4. Because accountability for the organization's use of IT rests with those who direct and control the organization Correct answer.

Explanation

ISO/IEC 38500 is written for those who govern, such as boards and equivalent bodies, because accountability for the organization's use of IT sits with them even when execution is delegated. The standard is not restricted from IT readers, does not assign software development to boards, and does not exempt IT staff from compliance.

Question 45Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

An organization has documented all six ISO/IEC 38500 principles in a policy manual but has no mechanism for the governing body to evaluate, direct or monitor IT. What is the most accurate assessment?

  1. The organization needs only to add more principles to its manual
  2. The principles are stated but not applied, because governance requires the evaluate, direct and monitor cycle to be operating Correct answer.
  3. Documentation of principles is irrelevant and should be deleted
  4. The organization is fully compliant because the principles are documented

Explanation

ISO/IEC 38500 couples the principles with a model of evaluate, direct and monitor; documenting principles without operating that cycle leaves governance as aspiration rather than practice. Adding principles or deleting documentation does not create the missing governance activity.

Question 46Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

Two IT proposals are compared: one offers short-term savings but long-term vendor lock-in, the other costs more now but preserves flexibility. Which ISO/IEC 38500 principle most directly guides the governing body's evaluation of this choice?

  1. Conformance, because lock-in is always a legal violation
  2. Acquisition, because it requires valid reasons and ongoing analysis of costs, benefits and risks over time Correct answer.
  3. Human behaviour, because vendor staff are affected
  4. Performance, because only current service levels matter

Explanation

The acquisition principle requires that IT investments be justified through appropriate and ongoing analysis, which includes weighing long-term risks such as lock-in against short-term savings. Conformance, human behaviour and performance do not frame a trade-off between cost, flexibility and risk over time.

Question 47Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

A board delegates IT decision rights to a technology committee but sets no reporting requirement and no limit on the committee's authority. Which aspect of the ISO/IEC 38500 model is missing?

  1. Evaluation of new and emerging technologies
  2. Directing the IT function to reduce costs
  3. Acquiring new IT systems for the committee
  4. Monitoring to confirm that delegated authority is exercised within the direction set Correct answer.

Explanation

Delegation is consistent with the model only when the governing body retains direction and monitors the delegate's performance and conformance. Without reporting or defined limits, there is no monitoring loop and no assurance that authority is exercised within the set direction.

Question 48Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

An organization applies the conformance principle thoroughly but ignores strategy and performance, reporting only legal compliance to the board. What is the most accurate ISO/IEC 38500 assessment?

  1. The principles are meant to be applied together, so reliance on conformance alone leaves governance incomplete Correct answer.
  2. Ignoring strategy is acceptable because strategy belongs to management
  3. Performance is irrelevant once legal compliance is assured
  4. Conformance is the only principle that matters for governing bodies

Explanation

The six principles are complementary and are intended to be applied as a set, so strong conformance reporting does not compensate for absent attention to strategy and performance. No single principle displaces the others, and legal compliance does not establish fitness for purpose.

Question 49Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

A governing body wants assurance that delegated IT decisions are both effective and lawful. Which pairing of ISO/IEC 38500 principles most directly covers these two concerns?

  1. Human behaviour and responsibility
  2. Acquisition and strategy
  3. Strategy and acquisition
  4. Performance and conformance Correct answer.

Explanation

Performance addresses whether IT is fit for purpose and delivers required services, while conformance addresses adherence to legislation, regulation and policy. Together they cover effectiveness and lawfulness, whereas the other pairs address alignment, investment justification, people and accountability.

Question 50Fundamental concepts and principles of IT corporate governance based on ISO/IEC 38500

A regulator asks a board to demonstrate that its use of IT complies with a new rule, and the board can show only that it issued a directive to the IT function. Which ISO/IEC 38500 task has the board not completed?

  1. Evaluation, to decide whether the rule is relevant
  2. Monitoring, to verify that the direction was implemented and conformance achieved Correct answer.
  3. Acquiring, to buy compliance tooling
  4. Directing, to instruct the IT function

Explanation

Direction alone does not establish conformance; the governing body must monitor whether the direction was carried out and the requirement met. Evaluation and direction have already occurred, and acquiring tooling is neither required by the standard nor a substitute for verification.