Last Attempt CGEIT Questions

 An IT risk-aware culture is one that promotes a shared understanding of risk and supports the organization’s strategy, business model, operational practices, and competitive advantage1. It works to strengthen the core of an organization’s operations and protects customers, the brand, and the bottom line1. An IT risk-aware culture also involves the participation and collaboration of all stakeholders in identifying, assessing, and managing IT risks2. Therefore, the BEST evidence of an IT risk-aware culture across an enterprise is when business staff report identified IT risks. This indicates that the business staff are aware of the potential threats and impacts that IT risks can pose to the organization, and that they are willing and able to communicate and escalate them to the appropriate authorities3.

The other options are not as good as option A. While it is important to communicate IT risks to the business, publish IT risk-related policies, and ensure the resilience of the IT infrastructure, these are not sufficient to demonstrate an IT risk-aware culture across an enterprise. They are rather means to achieve the end goal of managing and mitigating IT risks. They do not necessarily reflect the level of awareness, attitude, and behavior of the organization’s employees toward risk and how risk is managed within the organization. References :=

• Cultivating a Risk Intelligent Culture - Deloitte US1
• Building an Effective Risk-Aware Culture - Magazine4
• 7 Steps to Create a Risk-Aware Culture | Treasury & Risk3

An enterprise is determining the objectives for an IT training improvement initiative from a governance perspective. Governance is the process of decision-making and implementation that involves various actors and structures, both formal and informal1. Governance aims to achieve good governance, which is characterized by participation, consensus, accountability, transparency, responsiveness, effectiveness, efficiency, equity, inclusion, and rule of law2. Therefore, it would be most important to ensure that the policies and processes for IT training address both the enterprise requirements and the professional growth of the IT employees. This would ensure that the IT training is aligned with the strategic goals and priorities of the enterprise, as well as the needs and expectations of the IT staff. It would also foster a culture of learning and development that enhances the performance, quality, and value of IT services345. The other options are not the most important objectives for an IT training improvement initiative from a governance perspective. Identifying courses of instruction that will maximize employee productivity, creating several different training strategies for final approval by the CIO, and surveying and interviewing IT employees to identify development needs are all useful steps or methods for designing and implementing an IT training improvement initiative, but they are not the ultimate objectives or outcomes. They are subordinate or instrumental to the main objective of addressing both the enterprise requirements and the professional growth of the IT employees through policies and processes that reflect good governance principles345. References:

• 3: https://topworkplaces.com/improving-training-and-development-strategies/
• 4: https://shrm.org/ResourcesAndTools/hr-topics/organizational-and-employee-development/Pages/Key-Steps-for-Better-Training-Development-Programs.aspx
• 5: https://www.forbes.com/sites/forbeshumanresourcescouncil/2021/07/13/12-ways-to-implement-successful-employee-training-initiatives/
• 1: https://link.springer.com/article/10.1007/s40647-017-0197-4
• 2: https://www.unescap.org/sites/default/files/good-governance.pdf

because this is a role that should approve major IT purchases to help prevent conflicts of interest. An IT steering committee is a group of senior executives and board members who are responsible for overseeing and directing the IT function and ensuring that it aligns with the enterprise’s vision, mission, goals, and strategy12. An IT steering committee should approve major IT purchases, such as hardware, software, services, or projects, to ensure that they are justified, prioritized, and aligned with the business needs and expectations, and that they deliver value and performance to the enterprise12. An IT steering committee should also ensure that the IT procurement process is transparent, fair, and ethical, and that there are no conflicts of interest or undue influence from the IT vendors or suppliers1

Data stewards are primarily responsible for applying frameworks for the governance of IT to balance the need for security controls with business requirements, as they are the custodians of the data quality, integrity, and security within an organization. Data stewards define and implement data policies, standards, and procedures, as well as monitor and report on data compliance and performance. Data stewards also collaborate with other stakeholders, such as data owners, data users, and data scientists, to ensure that the data is aligned with the business objectives and meets the regulatory and ethical requirements.

Data scientists, data analysts, and data processors are not primarily responsible for applying frameworks for the governance of IT, as they are more focused on the technical aspects of data collection, analysis, and processing. Data scientists use advanced methods and tools to extract insights and value from data. Data analysts use descriptive and inferential statistics to explore and interpret data. Data processors perform operations on data, such as entry, validation, transformation, storage, and retrieval.

References := What is a Data Steward? | Informatica; Data Governance Roles: The Ultimate Guide | Collibra; Data Governance Roles: Who Does What? | erwin; [What is IT governance? A formal way to align IT & business strategy].