Which of the following groups would be MOST appropriate to decide whether to proceed with an IT-enabled investment at the individual program level?

A. Business sponsors
B. Program management office
C. IT steering committee
D. Board of directors

An enterprise recognizes that a large percentage of its IT employees are eligible for retirement in the next five years. A significant amount of institutional knowledge resides with retirement-eligible staff. From the board's perspective, which of the following is the GREATEST concern for the enterprise in this situation?

A. Service delivery to the business
B. Loss of key IT personnel
C. Lack of timeline for succession plan
D. Lack of process documentation

A large enterprise has decided to use an emerging technology that needs to be integrated with the current IT infrastructure. Which of the following is the BEST way to prevent adverse effects to the enterprise resulting from the new technology?

A. Develop key risk indicators (KRIs).
B. Develop key performance indicators (KPIs).
C. Implement service level agreements (SLAs).
D. Update the risk appetite statement.

Maintaining a list of all potential IT initiatives for implementing the business strategy should be the responsibility of the:

A. portfolio management function.
B. individual business units.
C. chief executive officer (CEO).
D. chief operating officer (COO).

Which of the following is the BEST way to provide effective IT risk management?

A. Implementing a cost-effective mitigation program
B. Appointing a chief risk officer
C. Embedding risk management in operations
D. Establishing an incident management program

A hospital's executive steering committee is concerned about the increasing number of cyber attacks on patient data systems across the industry. The committee has asked the CIO to provide regular reporting with information that will help provide better oversight of cyber-related risk to the hospital. Including which of the following in the report would be MOST helpful to the committee?

A. Status of key risk indicators
B. Current business impact levels
C. IT operations gap assessment
D. Cybersecurity risk benchmarks

Which of the following is the MOST important input for the development of a human resources strategy to address IT skill gaps?

A. Technology direction of the enterprise
B. Training budget allocated for IT staff
C. A recent IT skills matrix
D. Training effectiveness reports

The BEST way to ensure an IT steering committee meets enterprise objectives is to:

A. have key business stakeholders represented on the committee.
B. establish key performance indicators (KPIs).
C. require a member of the committee to have IT governance expertise.
D. benchmark against industry best practices.

Which of the following would BEST help a CIO enhance the competencies of an IT business analytics team?

A. Understanding current staff skill sets and identifying gaps
B. Defining the IT architecture and identifying training areas
C. Creating operational processes and identifying resources
D. Establishing team goals and identifying the proper structure

Which of the following is the MOST important reason for selecting IT key risk indicators (KRIs)?

A. Enabling comparison against similar IT KRIs
B. Increasing the probability of achieving IT goals
C. Assessing the current IT controls model
D. Demonstrating the effectiveness of IT risk policies