CGEIT Tests Board-Level IT Governance Judgment — Not IT Management Execution
CGEIT is for senior leaders who direct and oversee enterprise IT. Pick what a governing body or steering committee would own: evaluate, direct and monitor, with business owners accountable for value and risk.
Check Your Readiness →Most candidates understand ISACA Certified in the Governance of Enterprise IT (CGEIT) concepts — and still fail. This exam tests how you apply knowledge under pressure.
150 questions in four hours, written from the board or executive viewpoint. Stems often ask what to do FIRST or what is BEST; the right option usually establishes alignment, accountability or an assessment before any technical fix. The 2020 outline remains current, with no update announced.
Ask the board to choose between the two projects
Portfolio prioritization belongs to the IT steering committee, working within strategy and criteria the board approved. Score both against enterprise goals and their business cases; the board sets direction and monitors, it does not arbitrate projects.
Add further controls to reduce the risk anyway
When residual risk sits within appetite, the risk owner can formally accept it. Extra controls waste resources and may block value; risk optimization balances value delivered against risk taken.
Terminate the contract and switch providers
Verify performance independently first through audits, assurance reports or internal measurement, then check that SLAs reflect business requirements. Termination without verification and an executable exit plan can cause more disruption than the underperformance.
Add more detailed metrics to the board pack
Governance reporting should be concise, in business terms, linked to enterprise goals and focused on exceptions and decisions. An IT balanced scorecard with lead and lag indicators gives that view.
Benefits are realized through business use, so the business executive named as benefit owner is accountable. Project managers answer for delivery at go-live; realization is measured over time against a baseline captured before the change.
Money already spent is sunk. At a stage gate the choices are continue, change, pause or stop, judged only on future costs and benefits against the business case, with the benefit owner and steering committee deciding.
Only the business risk owner with authority can accept risk on the enterprise's behalf, and acceptance is documented. The board sets risk appetite; management works within measurable tolerances, all below the enterprise's risk capacity.
COBIT 2019 must be tailored using design factors such as enterprise strategy, risk profile, compliance needs, sourcing model and size. An untailored framework does not fix the specific accountability or alignment gap the scenario describes.
Execution moves to the provider; accountability for outcomes and compliance stays with the enterprise. Hence contracts need a right to audit, SLAs reflecting business requirements, independent assurance such as SOC 2 Type II, and an exit strategy agreed before signing.
Strengthen weak areas with exam-style practice questions and detailed explanations.
Simulate the real exam experience and assess your readiness under timed conditions.
Review key concepts, objectives, and exam topics in one place.
Get personalized explanations, learning recommendations, and instant answers.
Follow a structured learning path designed to help you prepare efficiently.
CGEIT asks what the board and its committees should own. Check whether your answers stay at governance level.