Achieve Success in the Isaca CGEIT Exam: A Detailed Certified in the Governance of Enterprise IT Exam Guide

The first thing that should be done to address the issue of duplicate support contracts and underutilization of IT services is to review the enterprise IT procurement policy. This is because the IT procurement policy is a document that defines the rules, guidelines, and procedures for acquiring and managing IT products and services in an organization1. A well-designed IT procurement policy can help to:

• Align IT procurement with business strategy, objectives, and priorities1
• Optimize IT spending and maximize IT value1
• Ensure IT quality, security, and compliance1
• Avoid IT duplication, waste, and inefficiency1
• Define IT roles and responsibilities and assign accountability1

By reviewing the enterprise IT procurement policy, the organization can identify and address any gaps, issues, or inconsistencies that may have led to the problem of business divisions approaching technology vendors for cloud services without proper coordination or approval. The review can also help to update and improve the IT procurement policy to reflect the current and future needs and expectations of the organization and its stakeholders. Some of the best practices for developing an effective IT procurement policy are2:

• Involve all relevant stakeholders in the policy development process
• Conduct a thorough analysis of the current and future IT requirements
• Establish clear criteria and standards for selecting and evaluating IT vendors and services
• Implement a robust approval and authorization system for IT purchases
• Incorporate risk management and contingency planning into the policy
• Communicate and educate the policy to all employees and stakeholders
• Monitor and measure the policy implementation and outcomes

The other options, re-negotiating contracts with vendors to request discounts, requiring updates to the IT procurement process, and conducting an audit to investigate utilization of cloud services are not as effective as reviewing the enterprise IT procurement policy for addressing the issue. They are more related to the implementation and execution of the IT procurement policy, rather than its design. They may also be reactive or corrective measures, rather than proactive or preventive ones. They may not address the root cause of the problem, which is the lack of a clear and comprehensive IT procurement policy that guides and governs the acquisition and management of IT products and services in the organization.

Effective culture change is the process of transforming the values, beliefs, behaviors, and norms of the organization and its stakeholders to support the strategic alignment of business and IT goals. Effective culture change can enable the implementation of IT governance by:

• Creating a shared vision and understanding of the purpose, benefits, and expectations of IT governance
• Engaging and empowering the stakeholders to participate and collaborate in IT governance activities and decisions
• Fostering a culture of trust, transparency, accountability, and responsibility for IT governance outcomes
• Encouraging a culture of innovation, learning, and improvement for IT governance processes and practices
• Aligning the incentives and rewards with the IT governance objectives and performance

References:

• According to the CGEIT Review Manual 2022, "Culture is a key enabler for effective IT governance. Culture influences how people behave, communicate, collaborate, and make decisions. Culture also affects how people perceive, value, and use IT. Therefore, culture change is often necessary to implement IT governance successfully."1
• According to the ISACA article on Culture Change: A Critical Success Factor for Effective IT Governance2, “Culture change is not an easy task; it requires strong leadership, clear communication, stakeholder involvement, and continuous monitoring and feedback. However, culture change can also bring significant benefits for IT governance, such as improved alignment, engagement, performance, and value creation.”
• According to the CIO article on How to create a culture of innovation in IT3, “Creating a culture of innovation in IT requires more than hiring talented people and acquiring the latest technologies. It also requires a shift in mindset, behavior, and structure that fosters creativity, collaboration, experimentation, and learning.”

• This is because moving all IT applications to an external SaaS cloud provider means that the organization is outsourcing the development, deployment, maintenance, and operation of its IT applications to a third-party vendor. This implies that the organization is relinquishing some control and ownership over its IT applications, and relying on the vendor to provide the required functionality, performance, quality, and security1. Therefore, the organization needs to shift its focus from delivering IT services internally to managing IT services externally. This involves the following activities2:

The shift from service delivery to service management can have a significant impact on the IT governance framework, processes, policies, and practices of the organization. It can also affect the IT skills, roles, and responsibilities of the IT staff and stakeholders. Therefore, the organization needs to adapt and adjust its IT governance approach accordingly to ensure that it can effectively oversee and optimize its IT services in a SaaS environment3.

The other options, the integration of the IT department with business lines, the improvement of IT service alignment with business, and the necessity to update key risk indicators (KRIs) are not as significant as the shift from service delivery to service management for moving all IT applications to an external SaaS cloud provider from an IT governance perspective. They are more related to the outcomes or consequences of moving to a SaaS environment, rather than the impact or change itself. They may also not be unique or specific to a SaaS environment, as they may apply to other types or models of IT service delivery as well.

Performing a business impact analysis (BIA) is the first course of action when a shortfall of IT resources is identified because it helps to assess the potential impact of the resource gap on the business processes, objectives, and goals. A BIA can also help to prioritize the criticality of the IT resources, identify the minimum acceptable levels of service, and determine the recovery strategies and resource requirements. A BIA can provide a basis for making informed decisions on how to allocate the available IT resources or acquire additional resources to close the gap.

References:

• According to ISACA’s CGEIT Review Manual 2021, one of the key activities for ensuring effective IT resource management is to "perform a business impact analysis (BIA) to identify and prioritize critical IT resources."1
• According to ISACA’s COBIT 2019 Framework, one of the governance objectives for managing IT resources is to "ensure that a BIA is performed to determine the required level of availability, continuity and security of IT services and data."2
• According to ISACA’s Business Continuity Management guide, one of the steps for developing a business continuity plan is to "conduct a BIA to identify the critical business processes and IT resources that support them."3

Standardization is the process of establishing and applying common rules, formats, definitions, and methods for data collection, storage, processing, and exchange. Standardization is critical for enabling data interoperability, which is the ability of data to be shared and used across different systems, platforms, applications, and organizations. Standardization can help improve data interoperability by:

• Enhancing the quality, consistency, and accuracy of data
• Reducing the complexity and ambiguity of data
• Increasing the compatibility and comparability of data
• Facilitating the integration and analysis of data
• Promoting the reuse and sharing of data

References:

• According to the CGEIT Review Manual 2022, "Standardization is the process of developing and implementing technical standards. The goals of standardization can be to help with independence of single suppliers (commoditization), compatibility, interoperability, safety, repeatability or quality."1
• According to the UN Statistics Wiki on Data Interoperability Guide2, “Standardization is a key enabler for interoperability. It allows for a common understanding of data elements across different systems and domains.”
• According to the ISO/IEC 38500:2015 standard on Information technology — Governance of IT for the organization3, “Standardization can improve interoperability between systems within an organization or between organizations.”

 A root cause analysis is the first step to identify the factors that are causing the loss of top talent and to devise appropriate solutions. A SWOT analysis, an incentive and retention program, and an aggressive talent acquisition program are possible outcomes of a root cause analysis, but they are not the first action to take. References := CGEIT Review Manual, 7th Edition, page 103.

According to the web search results, the CEO is accountable for providing sponsorship for the IT-enabled change across the enterprise. The CEO is the highest-ranking executive in the organization, and has the authority and responsibility to lead the strategic direction and vision of the enterprise. The CEO also has the power and influence to allocate resources, prioritize initiatives, resolve conflicts, and communicate with stakeholders. Therefore, the CEO is the best person to provide sponsorship for the ERP implementation, which is a major and complex IT-enabled change that affects the entire enterprise12.

The other options are not as accountable as the CEO for providing sponsorship for the IT-enabled change across the enterprise. The HR director is responsible for managing the human resources functions of the organization, such as recruitment, training, compensation, and performance management. The HR director may support the ERP implementation by facilitating change management, employee engagement, and organizational development, but does not have the same level of authority and accountability as the CEO3. The IT strategy committee is a group of senior executives from different business units that provide guidance and oversight for the IT strategy and governance of the organization. The IT strategy committee may advise and approve the ERP implementation, but does not have the same level of leadership and visibility as the CEO4. The CIO is responsible for managing the IT functions of the organization, such as planning, implementing, and operating the IT systems and services. The CIO may lead and execute the ERP implementation, but does not have the same level of responsibility and influence as the CEO.

References: 1: What Is A Project Sponsor & Do You Need One When Implementing ERP?1 2: Building a Successful ERP Implementation Team | NetSuite2 3: What Does an HR Director Do? | Indeed.com 4: What Is an IT Strategy Committee? | Bizfluent : What is a CIO? Everything you need to know about the Chief Information Officer explained | ZDNet

The best way to address the risk associated with new IT investments is to integrate security requirements at the beginning of projects. This means that security is considered as a key factor in the planning, design, development and testing phases of IT projects. By doing so, organizations can ensure that security is built into the IT solutions, rather than added as an afterthought. This can help to prevent or reduce security vulnerabilities, breaches, incidents and costs. Integrating security requirements at the beginning of projects is also consistent with the IT risk management frameworks that recommend a proactive and preventive approach to IT risk management12. References := Proactive IT Risk Management in an Era of Emerging Technologies, IT Risk Management Process & Frameworks

A third-party audit report is the most comprehensive source of information regarding the current status and effectiveness of a cloud provider’s controls. A third-party audit report is an independent and objective assessment of the cloud provider’s security, compliance, and performance by a qualified and reputable auditor. A third-party audit report can provide assurance to the cloud customers that the cloud provider has implemented adequate and effective controls to meet the industry standards and best practices, as well as the contractual obligations and customer expectations12.

A globally recognized certification is a credential that demonstrates that a cloud provider has met certain criteria or standards for security, quality, or performance. A globally recognized certification can provide some level of confidence to the cloud customers that the cloud provider has achieved a minimum level of compliance or competence, but it may not provide enough details or evidence about the current status and effectiveness of the cloud provider’s controls3.

A control self-assessment (CSA) is a process that enables a cloud provider to evaluate its own controls internally, without involving an external auditor. A CSA can help a cloud provider to identify and address any gaps or weaknesses in its controls, as well as to monitor and improve its performance. However, a CSA may not provide sufficient assurance to the cloud customers, as it may lack objectivity, transparency, and validity4.

A maturity assessment is a process that measures the level of maturity or capability of a cloud provider’s processes or practices. A maturity assessment can help a cloud provider to benchmark its performance against industry standards or best practices, as well as to identify areas for improvement or innovation. However, a maturity assessment may not provide enough information about the current status and effectiveness of the cloud provider’s controls, as it may focus more on the process rather than the outcome5.

References: 1: Cloud Security Auditing: Challenges and Emerging Approaches - IEEE Journals & Magazine1 2: Cloud Security Audit: What You Need to Know | CloudHealth by VMware2 3: Cloud Security Certifications: What You Need to Know | CloudHealth by VMware3 4: Control Self-Assessment - ISACA4 5: Maturity Assessment - ISACA

The primary role of the CEO in IT governance is establishing enterprise strategic goals. The CEO is responsible for setting the vision and strategic direction of the organization, which includes ensuring that IT governance aligns with and supports these broader objectives. While managing the risk governance process, evaluating ROI, and nominating IT steering committee membership are important, these are typically shared responsibilities or delegated to other roles within the organization. The CEO's leadership in defining the strategic goals is fundamental to guiding all aspects of IT governance and ensuring alignment with the business strategy.

Upon learning that business units have been independently procuring cloud services, the IT steering committee's best course of action is to define a procurement strategy based on business unit needs. This approach ensures that cloud service procurement aligns with the enterprise's overall IT strategy and governance policies while still addressing the specific requirements of individual business units. It fosters collaboration between IT and business units, ensuring that cloud services are vetted for compliance, security, and interoperability. Requiring cancellation, including business unit leadership in the EA review board, or limiting usage to open-source solutions may address aspects of the issue but do not provide a comprehensive strategy that aligns business needs with IT governance.

To measure the value of IT-enabled investments, an enterprise needs to identify its drivers as defined by its business strategy. The business strategy is the document that defines the vision, mission, goals, and objectives of the enterprise and how they will be achieved. It also specifies the value proposition, competitive advantage, and target market of the enterprise. The drivers of value are the factors that influence or determine the value creation and delivery of the enterprise. They can include aspects such as customer satisfaction, revenue growth, cost reduction, innovation, quality, and efficiency. By identifying its drivers as defined by its business strategy, the enterprise can align its IT-enabled investments with its strategic priorities and expectations. It can also establish the criteria, metrics, and indicators for measuring and evaluating the value of IT-enabled investments in terms of their contribution to the business outcomes and performance.

• This is because training metrics are measurable values that indicate the effectiveness and impact of the training programs on the IT staff’s knowledge, skills, and performance1. By embedding training metrics into the annual performance appraisal process, the CIO can:

Embedding training metrics into the annual performance appraisal process can help to create a culture of learning, development, and accountability for IT-related training within the organization. It can also help to align the individual goals of the IT management team and direct employees with the organizational goals of IT governance.

The other options, developing training programs based on results of an IT staff survey of preferences, promoting IT-specific training awareness program, and researching and identifying training needs based on industry trends are not as effective as embedding training metrics into the annual performance appraisal process for ensuring that IT-related training is taken seriously by the IT management team and direct employees. They are more related to the design and delivery of the IT-related training, rather than its integration and evaluation. They may also not have a significant impact on the behavior and attitude of the IT management team and direct employees towards IT-related training, as they may not provide sufficient motivation, feedback, or recognition for participation or completion.

When an IT governance committee is reviewing its current risk management policy due to increased usage of social media within an enterprise, the first task should be to initiate an assessment of the impact on the business. This assessment will provide a comprehensive understanding of how social media usage affects various aspects of the business, including productivity, security, data privacy, and compliance with existing policies and regulations. Understanding the business impact will inform the committee's decisions on any necessary policy adjustments or controls to mitigate potential risks associated with social media usage. While reviewing current usage levels, blocking access, and reassessing BYOD policies are relevant considerations, they should be informed by an initial assessment of the business impact to ensure that any actions taken are aligned with the enterprise's strategic objectives and risk tolerance.

 The CTO should first understand the enterprise’s risk tolerance before assessing the impact of wearable technology. This will help the CTO to align the assessment with the enterprise’s objectives, culture, and appetite for risk. The other options are important steps in the assessment process, but they are not the first ones. Creating an IT risk scorecard and prioritizing wearable technology risk require a clear understanding of the enterprise’s risk tolerance, which is the basis for defining risk criteria and thresholds. References := ISACA, CGEIT Review Manual, 7th Edition, Chapter 2: Strategic Management, Section 2.3: Risk Optimization, p. 63-64.