Managing IT risks, exploiting IT opportunities and aligning IT with business strategy
What the exam tests
How the governing body sets and uses risk appetite, exploits IT opportunities for value, and keeps IT aligned with business strategy - the Strategy, Acquisition and Performance principles in practice.
Core rules
- Alignment is continuous. Business objectives drive IT capabilities, investment and metrics; the cycle repeats as strategy shifts. An annual IT plan that never references business goals is not alignment.
- Risk is business risk. The governing body sets risk appetite and tolerance, requires IT risk to be managed with a recognised process (ISO 31000: scope, identify, analyse, evaluate, treat, monitor and review, with communication and consultation throughout), and reviews aggregate exposure - not just a register.
- Opportunity matters as much as protection. ISO/IEC 38500's acquisition principle balances benefits, opportunities, costs and risks. Governance that only blocks innovation drives it underground.
- Benefits are tracked. Approve investments with a benefit case, benefit owner and realisation reviews; close or re-scope failing initiatives.
- Segregate assurance. Management reports progress; independent assurance tests it.
Worked example
A logistics firm's board considers IoT telematics for its fleet. Alignment: the investment maps to two strategic goals - lower cost per delivery and higher on-time reliability. Acquisition analysis: vendor options, total cost, and a new revenue opportunity (selling predictive-maintenance data to customers). Risk: driver privacy, device security, data residency, vendor lock-in; the privacy exposure exceeds the stated appetite unless data is minimised, so the board directs that condition. Direct: appoint a benefit owner, set stage gates, require a security assessment. Monitor: cost per delivery, on-time rate, incident count, and a 12-month benefit review. The opportunity proceeds because risk is treated within appetite and the benefit is measurable.
Traps
- Confusing risk appetite (willingness to take risk) with risk tolerance (acceptable variation).
- Delegating IT risk entirely to the IT function.
- Treating alignment as a document rather than a decision test.
- Approving an opportunity with no benefit owner or review point.
- Counting only cost savings and ignoring strategic or revenue benefits.