CGEIT

CGEIT Exam Details

Domain Weight Breakdown

Who Should Take This Exam

• C-suite executives (CIO, CTO, CISO) responsible for IT governance strategy and oversight within their organizations
• IT governance managers and directors who define, implement, and maintain enterprise IT governance frameworks
• Board members and audit committee members who need to understand IT governance principles for effective oversight
• Enterprise architects and IT strategists who align IT capabilities with business objectives and governance requirements
• Risk and compliance professionals who assess and report on IT governance effectiveness and maturity

Tip: The CGEIT is an executive-level certification focused on governance at the enterprise level, not operational IT management. Questions test strategic thinking and the ability to align IT with business objectives. Always think from the board's perspective when answering questions.

IT Governance vs IT Management

Understanding the fundamental distinction between governance and management is the most critical concept for the CGEIT exam. Governance is the responsibility of the board of directors and involves setting direction, evaluating performance, and ensuring conformance. Management is the responsibility of executive leadership and involves planning, building, running, and monitoring activities to align with the direction set by the governing body. Governance answers the questions “Are we doing the right things?” and “Are we getting benefits?” while management answers “Are we doing things right?” and “Are we getting them done well?”

COBIT 2019 Framework

COBIT (Control Objectives for Information and Related Technologies) 2019 is the primary framework tested on the CGEIT exam. It provides a comprehensive framework for the governance and management of enterprise information and technology. COBIT 2019 introduced design factors and focus areas as key enhancements over COBIT 5.

COBIT 2019 Design Factors

• Enterprise Strategy: Growth/acquisition, innovation/differentiation, cost leadership, client service/stability
• Enterprise Goals: Mapped from balanced scorecard perspectives (financial, customer, internal, learning)
• Risk Profile: Current risk categories and associated risk appetite levels
• I&T-Related Issues: Current pain points such as project failures, regulatory non-compliance, or shadow IT
• Threat Landscape: Normal or high threat environment affecting governance priorities
• Compliance Requirements: Low, normal, or high regulatory burden
• Role of IT: Support, factory, turnaround, or strategic (McFarlan's strategic grid)
• Sourcing Model: Outsourcing, cloud, insourced, or hybrid delivery models
• IT Implementation Methods: Agile, DevOps, traditional/waterfall, or hybrid
• Technology Adoption Strategy: First mover, follower, or slow adopter
• Enterprise Size: Large enterprise, SME, or small organization

Tip: Design factors are a major COBIT 2019 enhancement. They help tailor the governance system to the organization's specific context. Expect questions that ask you to select the appropriate design factor or explain how a design factor influences governance process prioritization.

Governance Structures and Roles

IT Resource Optimization

IT resource management under the CGEIT framework encompasses the strategic planning, acquisition, development, and optimization of all IT-related resources including people, technology, information, and financial assets. The goal is to ensure that the enterprise has the right resources at the right time and cost to support business objectives. Resource optimization is one of the three COBIT governance objectives alongside benefits realization and risk optimization.

IT Sourcing Strategies

Tip: Regardless of the sourcing model, governance responsibility cannot be outsourced. The board and senior management remain accountable for the outcomes even when services are delivered by external parties. Always include right-to-audit clauses in outsourcing contracts.

IT Financial Management

• IT Budget Types: Operational expenditure (OpEx) covers day-to-day running costs. Capital expenditure (CapEx) covers investments in new assets. Cloud shifts spending from CapEx to OpEx
• Total Cost of Ownership (TCO): Full lifecycle cost including acquisition, implementation, operations, maintenance, training, and decommissioning. Essential for investment comparisons
• Chargeback: IT costs are allocated and billed to consuming business units. Promotes accountability and cost-aware behavior
• Showback: IT costs are reported to business units for transparency but not formally charged. Lower overhead than chargeback while still promoting awareness
• IT Portfolio Management: Treating IT investments as a portfolio similar to financial investments, with categories for run-the-business, grow-the-business, and transform-the-business spending

Enterprise Architecture (EA) Governance

Enterprise architecture governance ensures that all IT initiatives conform to the target architecture. Deviations require formal exception requests approved by the architecture board, with documented rationale and risk acceptance.

Benefits Realization Management (BRM)

Benefits realization management is the process of ensuring that IT-enabled investments deliver the expected value to the enterprise. It is a lifecycle process that starts with identifying potential benefits during the business case development and continues through monitoring and measuring actual benefits after implementation. BRM is one of the three governance objectives in COBIT 2019 and represents the largest content area on the CGEIT exam at 26% weight. The key principle is that business outcomes, not IT deliverables, define success.

Business Case Development

• Strategic Alignment: The business case must demonstrate how the investment supports the enterprise strategy and specific business objectives
• Financial Analysis: Include ROI (Return on Investment), NPV (Net Present Value), IRR (Internal Rate of Return), and payback period calculations
• Benefit Categories: Tangible benefits (quantifiable in financial terms, e.g., cost reduction), intangible benefits (qualitative improvements, e.g., customer satisfaction), and dis-benefits (negative outcomes or trade-offs)
• Risk Assessment: Identify and quantify risks that could prevent benefit realization, including technology, organizational change, and market risks
• Total Economic Impact: Consider all costs (TCO), all benefits (tangible and intangible), all risks, and the time value of money over the full investment lifecycle

Tip: The business case is a living document that should be revisited at key stage gates throughout the project lifecycle. If the business case is no longer valid (e.g., market conditions changed), the project should be re-evaluated or terminated regardless of sunk costs.

Investment Prioritization Methods

Performance Measurement

Tip: The IT Balanced Scorecard translates governance objectives into measurable metrics across four perspectives: Financial, Customer, Internal Process, and Learning & Growth. This is the governance-recommended approach to holistic performance measurement.

IT Risk Governance

Risk optimization in the CGEIT context means balancing IT risk with the enterprise's risk appetite to maximize value while maintaining an acceptable level of exposure. The governing body is responsible for defining risk appetite and tolerance levels, while management is responsible for implementing risk management processes that operate within those boundaries. COBIT 2019 addresses risk through the EDM03 (Ensured Risk Optimization) governance process and the APO12 (Managed Risk) management process.

Risk Management Process

Risk Response Strategies

Risk Frameworks and Standards

Tip: On the CGEIT exam, risk questions focus on the governance perspective. The board sets risk appetite, management implements risk management. If a question asks who is ACCOUNTABLE for risk, the answer is the board. If it asks who is RESPONSIBLE for managing risk, the answer is senior management.

Governance vs Management (Critical Distinction)

IT Strategy Committee vs IT Steering Committee

COBIT vs ITIL vs ISO 38500

COBIT provides the comprehensive framework. ITIL handles operational service management. ISO 38500 defines the high-level governance principles. They are complementary, not competing frameworks.

Exam Day Strategy

• Think like a board member: CGEIT is a governance certification. Every question should be answered from the perspective of strategic direction and oversight, not operational execution
• Governance first, then management: If a question asks what to do FIRST, look for the governance action (set policy, define appetite, establish direction) before the management action (implement controls, deploy tools)
• Value delivery is central: Domain 3 (Benefits Realization) is 26% of the exam. Master business case development, ROI/NPV calculations, and benefits tracking
• Know COBIT 2019 deeply: Understand the distinction between EDM (governance) and APO/BAI/DSS/MEA (management) domains. Know the design factors and their influence
• Watch for ISACA qualifiers: Words like “MOST important,” “BEST,” “FIRST” are critical. Multiple answers may be correct, but only one is the BEST governance answer
• Accountability vs responsibility: The board is ACCOUNTABLE (cannot delegate). Management is RESPONSIBLE (can be delegated). This distinction appears frequently

Tip: The CGEIT pass rate is lower than most ISACA certifications because candidates often answer from a management perspective rather than a governance one. Train yourself to always escalate your thinking to the board level. When in doubt, choose the answer that involves setting direction and ensuring oversight rather than hands-on implementation.