Isaca Updated CGEIT Exam Questions and Answers by inayah

The most important thing to review during IT strategy development is the current business environment, as it reflects the internal and external factors that affect the enterprise’s performance, objectives, and needs. The current business environment includes the analysis of the enterprise’s strengths, weaknesses, opportunities, and threats (SWOT), as well as the assessment of the market trends, customer demands, competitor actions, and regulatory requirements. Reviewing the current business environment can help align the IT strategy with the business strategy, as well as identify and prioritize the IT initiatives and investments that can support and enable the enterprise’s goals and value proposition.

Industry best practices, IT balanced scorecard, and data flows that indicate areas requiring IT support are also important things to review during IT strategy development, but they are not the most important thing. Industry best practices are the methods or techniques that have been proven to be effective or efficient in achieving a desired outcome or result in a specific domain or context. Industry best practices can help benchmark and improve the IT strategy, as well as adopt or adapt the best solutions or innovations from other enterprises or sectors. IT balanced scorecard is a set of metrics that measure the performance of IT in relation to the enterprise’s vision, strategy, and goals. IT balanced scorecard can help evaluate and communicate the effectiveness and efficiency of IT strategy, as well as its contribution to customer satisfaction, business value, and innovation. Data flows that indicate areas requiring IT support are the diagrams or models that show how data is collected, processed, stored, and distributed within or across the enterprise’s processes or systems. Data flows can help identify and address the gaps or issues in IT service delivery or data management, as well as optimize or integrate the data systems or tools.

This is because senior management is responsible for defining and communicating the IT strategy, objectives, and performance expectations for the organization. Senior management is also responsible for establishing and overseeing the IT governance framework, which includes the performance measurement metrics, processes, and tools. Senior management should ensure that the performance measurement metrics are aligned with the business goals and value creation, as well as the IT governance principles and policies. Senior management should also monitor and evaluate the IT performance results and take corrective actions if needed.

Some of the sources that support this answer are:

• 1: This source explains the roles and responsibilities of senior management in IT governance, and how they can use COBIT 5 to implement effective IT governance practices. It states that senior management should define the IT-related goals and objectives, establish the IT governance structure and processes, assign roles and responsibilities, and ensure adequate resources and capabilities for IT governance.
• 2: This source discusses the importance and benefits of IT performance measurement for IT governance, and provides some tips and tools for conducting it. It suggests that senior management should be involved in setting the IT performance measurement criteria, selecting the key performance indicators (KPIs), defining the targets and thresholds, and reviewing and reporting the IT performance outcomes.
• 3: This source provides a comprehensive guide on how to optimize IT project intake, approval, and prioritization. It mentions that senior management should be responsible for defining the strategic alignment, value delivery, risk optimization, and resource optimization criteria for IT projects, as well as for monitoring and evaluating the IT project portfolio performance.

Key risk indicators (KRIs) are metrics that measure the likelihood and impact of potential or actual risks. KRIs related to legal and regulatory compliance are designed to help the enterprise monitor and manage the risk of violating laws, regulations, standards, or ethical practices that apply to its operating environment. The primary governance objective for selecting KRIs related to legal and regulatory compliance should be to identify the risk of noncompliance, which means assessing the probability and severity of compliance breaches, as well as the root causes and consequences of such breaches. By identifying the risk of noncompliance, the enterprise can take proactive measures to prevent, mitigate, or remediate compliance issues, and to ensure that its compliance program is effective, efficient, and aligned with its business objectives and strategies. References: CGEIT Exam Content Outline | ISACA1, CGEIT Review Manual (Digital Version), Compliance Metrics and KPIs For Measuring Compliance Effectiveness — RiskOptics2, 11 Key Compliance KPIs + Examples (& Why You Should Track Them …3

 The best way to prevent adverse effects to the enterprise resulting from the new technology is to develop key risk indicators (KRIs), because they are metrics that measure the potential impact and likelihood of the risks associated with the new technology, and provide early warning signals for taking corrective actions. KRIs can help the enterprise to monitor and manage the risks of integrating the new technology with the current IT infrastructure, and to ensure that the expected benefits and value are realized12. References := ISACA, CGEIT Review Manual, 7th Edition, 2019, page 75-76.