Isaca CGEIT - Questions & Answers

Performance indicators are quantitative measures that can be used to evaluate the availability of a system or service. They can include metrics such as uptime, downtime, response time, availability percentage, etc.
Balanced scorecard, capability maturity levels, and critical success factors are not directly related to availability objectives, but rather to strategic alignment, process improvement, and goal achievement respectively.
References:
1: Governance of Enterprise IT, Subdomain A: Governance Framework, Task
5: Establish and monitor key performance indicators (KPIs) and key goal indicators (KGIs) that are aligned with strategic objectives.

Establishing a steering committee with business representation is the most important factor when an IT-enabled business initiative involves multiple business functions, because it ensures that the initiative is aligned with the strategic goals and needs of the organization, and that the different business functions have a voice and a stake in the decision-making process. A steering committee can also provide guidance, support, and oversight to the IT team and help resolve any conflicts or issues that may arise among the business functions. A steering committee can also monitor the progress and performance of the initiative and ensure that it delivers the expected benefits and value to the organization.
References:
What is an IT Steering Committee? ?BMC Software | Blogs, Steering Committee: Definition, Roles &
Meeting Tips - ProjectManager, How To Create an IT Steering Committee in 6 Steps - Indeed

When evaluating benefits realization of IT process performance, the analysis must be based on key business objectives, as they define the desired outcomes and value that the IT processes are expected to deliver and support. Key business objectives are derived from the enterprise strategy and vision, and they provide the basis for measuring and monitoring the IT process performance and benefits.
References:
CGEIT Exam Content Outline, Domain 3, Subtopic B:
Performance Measurement and Optimization, Task 1: Establish and monitor IT performance measurement systems to evaluate the extent to which IT delivers on its strategic objectives and desired outcomes.

A policy is a document that defines the rules and guidelines for how an organization conducts its activities and operations. A policy can help to ensure the compliance, consistency, and quality of the organization's performance and outcomes. A policy typically consists of several components, such as purpose, scope, terms and definitions, roles and responsibilities, procedures, compliance, and review. From a governance perspective, one of the most important components of a policy is roles and responsibilities, because it clarifies who is accountable and responsible for implementing, enforcing, monitoring, and improving the policy. Roles and responsibilities can help to establish the authority, accountability, and communication among different stakeholders involved in the policy, such as the board of directors, senior management, business units, IT staff, customers, regulators, etc. Roles and responsibilities can also help to avoid confusion, duplication, or conflict of work among the stakeholders. The governance of enterprise IT (GEIT) is the system by which the current and future use of IT is directed and controlled by an organization. GEIT aims to ensure that IT supports the organization's strategy and objectives, delivers value and benefits, manages risks and resources, and measures performance and outcomes. GEIT requires a clear definition of roles and responsibilities for the IT governance policies, processes, structures, and relationships. Some of the common roles and responsibilities involved in GEIT are: The board of directors: provides strategic direction, oversight, and approval for IT governance
The senior management: provides leadership, support, and guidance for IT governance.
The business units: provide input, feedback, and collaboration for IT governance.
The IT function: provides execution, delivery, and improvement for IT governance.
The audit function: provides assurance, evaluation, and recommendation for IT governance.
The external stakeholders: provide requirements, expectations, and compliance for IT governance
References:
What is a Policy? Definition & Examples. Policy Components: Definition & Examples. Roles & Responsibilities in Policy Development. [Policy Development: Roles &
Responsibilities]. [What is IT Governance? Definition & Frameworks]. [IT Governance Roles &
Responsibilities]. [Roles & Responsibilities in IT Governance].

Culture is the most critical factor to understand while assessing the feasibility of introducing new IT practices and standards into the IT governance framework, because it influences the behavior, values, and beliefs of the organization and its stakeholders. Culture affects how IT governance is perceived, implemented, and evaluated in the organization. A mismatch between the organizational culture and the IT governance framework can lead to resistance, conflict, and poor performance. Therefore, it is essential to assess the current culture of the organization and its readiness for change before introducing new IT practices and standards.
References:
The Influence of Organizational Culture in Application of Information Technology Governance, The Value of IT Governance, Organisational Governance Explained: The Keys to Success

A process maturity framework and documented procedures are primary factors in ensuring the success of an enterprise quality assurance program because they provide a clear and consistent way of measuring, monitoring, and improving the quality of the processes and products. A process maturity framework, such as the Capability Maturity Model Integration (CMMI), defines the levels of maturity and the best practices for each level. Documented procedures, such as standard operating procedures (SOPs), define the steps, roles, responsibilities, and tools for each process. These factors help to ensure that the quality assurance program is aligned with the business objectives, customer expectations, and industry standards.

The most important reason for selecting IT key risk indicators (KRIs) is to increase the probability of achieving IT goals. IT KRIs are metrics that show the level of exposure or likelihood of occurrence of IT-related risks that may affect the achievement of IT objectives. By selecting and monitoring IT KRIs, the organization can identify and manage the potential threats and opportunities that may impact the IT performance and value. IT KRIs can also help to trigger corrective or preventive actions, communicate risk information, and support decision-making and improvement processes

Business data owners were not consulted is the answer that presents the greatest risk, as it implies that the information security function did not consider the needs, expectations, and requirements of the stakeholders who are responsible for the data. Business data owners should be involved in the development and implementation of data retention and backup policies, as they can provide input on the value, sensitivity, and classification of the data, as well as the legal and regulatory obligations for data preservation and protection. Without consulting the business data owners, the information security function may create policies that are inconsistent, ineffective, or detrimental to the enterprise's objectives and operations.

A business case is a document that justifies the initiation and continuation of a project based on its expected benefits, costs, risks, and alignment with the strategic objectives of the organization. If a project is experiencing a cost overrun, meaning that it has exceeded its initial budget, it is important to re-evaluate the business case to determine whether the project is still viable and worth pursuing. Re-evaluating the business case can help to identify the root causes of the cost overrun, assess the impact of the overrun on the project's value proposition, and decide whether to continue, modify, or terminate the project. Reviewing the IT investments, reorganizing the IT projects portfolio, and reviewing the IT governance structure are not the most important tasks to perform in this situation. They are more likely to be part of the portfolio management or governance processes that should be done regularly or periodically, not in response to a specific project issue. Moreover, they do not directly address the problem of the cost overrun or its implications for the project's feasibility and desirability.
References:
What is a Business Case?, How to Write a Business Case, Project Cost Overruns ?Reasons, How to Prevent and Manage

When introducing the concept of governance to the new acquisition, it is most important that executive management recognize the impact of cultural changes. This is because culture can influence how people understand and practice governance, and how they respond to different governance frameworks and policies. Culture can also change over time, either by choice or by external factors, and this can affect the governance arrangements of an organization. Therefore, executive management needs to be aware of the cultural differences and similarities between the multinational enterprise and the new acquisition, and how they can affect the governance objectives, processes, and outcomes. Executive management also needs to respect and value the cultural diversity of the new acquisition, and foster a culture of trust, collaboration, and alignment.
References:
How corporate culture affects governance - The CEO Magazine3, Governance | Diversity of Cultural
Expressions - UNESCO4, 2.0 Culture and governance - AIGI