CGEIT Sample Questions & Answers

Approving enterprise architecture and standards

Defining IT project management methodology

Assigning a budget for IT governance applications

Assigning IT roles and responsibilities

Service level management

Balanced scorecard

Risk control self-assessment

Strengths, weaknesses, opportunities, and threats (SWOT) analysis

Organizational responsibility for IT risk management is not clearly defined.

IT risk training records are not properly retained in accordance with established schedules.

None of the members of the IT risk management team have risk management-related certifications.

Only a few key risk indicators identified by the IT risk management team are being monitored and the rest will be on a phased schedule.

Establishing an IT steering committee

Delegating IT investment decisions to centralized IT

Maintaining an inventory of IT investments

Increasing the frequency of IT investment audits

Internal audit director

CIO

The board of directors

Application users

Plan for the corresponding IT reorganization.

Recommend delaying the business change.

Report the risk to executive management.

Implement IT changes to align with the plan.

Reduces IT operational training costs

Reduces response time

Meets regulatory compliance requirements

Optimizes infrastructure investments

Benchmark how other IT organizations are treating the new requirements.

Adopt a zero-tolerance approach for noncompliance with regulatory matters.

Treat as a risk to be assessed before developing a response.

Use a cost-benefit analysis to determine if compliance is warranted.

Launch an enterprise-wide IT governance awareness program.

Designate a board representative to sponsor the IT governance program.

Ensure that there are IT policies, procedures, and standards in place.

Benchmark the program periodically against industry peers.

Local market common practices

Risk framework alignment

Technical gaps among subsidiaries

Compliance with local regulations