CGEIT Certified in the Governance of Enterprise IT Exam Topics and Questions

This is the foundation the entire exam is built on, and at 40 percent of the marks it will decide your result. The domain asks you to think like a board-level decision-maker, not a technician. You need to know how governance structures are designed, how strategy connects to IT, and how information is governed as a business asset. Gaps here are expensive. Get this domain right and you carry real momentum into the rest of the exam.

– Governance framework design and accountability

The exam wants you to understand what a governance framework actually consists of: the components that give it structure, the organizational arrangements that make it work, and the roles that carry accountability. You need to be clear on who owns decisions versus who executes them, because the exam regularly places those two things in tension. Strategy development sits here too. The examinable point is not the definition of strategy but the process by which an enterprise translates its objectives into governance direction. Legal and regulatory compliance is tested at the governance level, meaning you are expected to know how compliance obligations get embedded into a framework, not just what laws exist. Organizational culture and business ethics round out this section. Culture is often treated as soft, but the exam treats it as a governance control: the right culture reinforces policies; the wrong one undermines them regardless of what the documents say.

– Aligning technology governance with enterprise direction

Governance strategy alignment is the connective tissue between corporate objectives and IT decision-making. The exam tests whether you can identify when IT strategy is drifting from enterprise intent, and what mechanism brings it back. Strategic planning process is covered not as a theoretical lifecycle but as something a governance body actively steers. Stakeholder analysis and engagement matter because governance decisions require buy-in across the enterprise; the exam asks you to distinguish stakeholders by their influence and interest, then match the engagement approach to that profile. Communication and awareness strategy is a practical governance tool, not a marketing exercise. Enterprise architecture appears here as the structural expression of strategy: the way the enterprise documents how its technology, data, processes, and people fit together. Policies and standards are the enforcement layer: they translate governance intent into operational rules, and the exam tests whether you know how they are developed, approved, and maintained.

– Information as a governed asset

Information governance is distinct from data management. The exam tests it from an ownership and stewardship angle: who is accountable for information quality, who makes classification decisions, and what happens to information at each stage of its lifecycle. Information architecture is the structural side: how information flows across the enterprise and how that flow is documented and controlled. The information asset lifecycle is the governance view of information from creation to disposal. Disposal, in particular, is a place candidates lose marks because it carries compliance and risk implications that are easy to overlook when you focus only on creation and storage. Information classification and handling is tested in terms of governance policy: who sets the scheme, how it is applied consistently, and what the consequences of misclassification are at the enterprise level. Ownership and stewardship are deliberately separated in the exam: the owner sets policy, the steward implements it.

How Governance of Enterprise IT is tested

At 40 percent of the exam, this domain generates more items than any other, and the difficulty is not recall but judgment. Items place you in a governance scenario and ask you to select the most appropriate action, the right escalation path, or the governance body with the correct mandate. The trap is choosing an operationally sensible answer when the question calls for a governance-level one. Many candidates default to what a capable IT manager would do, when the exam rewards what a governance board would direct. Culture and ethics items are particularly prone to this: they look like common sense but the answer that earns marks is the one grounded in governance accountability. Alignment items test whether you can detect a gap between IT direction and enterprise strategy, and the strongest option is always the one that closes that gap at the right level of the organization. Stakeholder engagement items reward matching the engagement approach to the stakeholder's role and influence, not applying a single method to everyone.

Where the first domain covers how governance is structured, this one asks what the enterprise governs with. IT resources, whether people, technology, or contracted services, have to be planned, acquired, and optimized within a governance framework. At 15 percent of the exam, the domain is focused but unforgiving: items here test decisions about sourcing, capacity, and lifecycle management where the wrong call has direct consequences for enterprise value.

– Planning and acquiring the right resources

Sourcing strategy is the governance decision that precedes everything else in this section. The exam tests it as a make-or-buy judgment with governance implications: which capabilities belong inside the enterprise, which are better contracted out, and what criteria drive that decision at the board level. Resource capacity planning follows from sourcing: once you know what you will own and what you will buy, you need a credible process for sizing it correctly. The exam is interested in how capacity decisions connect back to enterprise strategy, not in the mechanics of capacity modeling. Acquisition of resources is tested as a governance oversight responsibility. The question the exam asks is not how procurement works operationally but how governance ensures that acquisitions align with strategy, stay within risk appetite, and deliver the expected value. Candidates who treat acquisition as a purely operational matter tend to select answers that are technically correct but miss the governance dimension.

– Managing resources through their lifecycle

IT resource lifecycle and asset management is tested as a continuous governance responsibility. Assets do not stop requiring oversight once they are acquired: their value, risk profile, and fitness for purpose change over time, and governance is expected to track those changes. The exam often presents scenarios where an asset is past its useful life or misaligned with current strategy, and asks what governance action is appropriate. Human resource competency assessment and development sits here because people are IT resources too. The exam tests this at the governance level: ensuring the enterprise has the skills it needs to execute its IT strategy, identifying gaps early, and making development decisions that are tied to strategic direction rather than individual preference. Management of contracted services and relationships is the third strand. Vendor relationships require ongoing governance oversight, not just a contract at the start. The exam rewards answers that reflect active performance monitoring, clear accountability, and a process for dealing with underperformance.

How IT Resources is tested

At 15 percent of the exam, this domain delivers a focused set of items, but they are not straightforward. The scenarios tend to involve a resource decision with competing priorities: cost, capability, risk, and strategic alignment all pulling in different directions. The exam rewards the option that resolves the tension at the governance level, not the one that optimizes a single variable. Sourcing items are a common trap: candidates with a technical background often gravitate toward in-house solutions, while those with a procurement background favor outsourcing. The exam is not interested in either bias; it rewards the decision that fits the enterprise's strategy and risk appetite. Lifecycle items test whether you recognize the point at which a resource stops delivering value and governance action is required. Competency items often involve a gap between current skills and what the IT strategy demands, and the strongest answer addresses that gap through a governance mechanism rather than an ad hoc fix. Contracted services items reward active oversight over passive contract management.

After governance structure and resources, the exam turns to results: whether IT investments actually deliver what was promised and whether the enterprise has the mechanisms to know either way. At 26 percent, this is the second largest domain. The examinable territory spans performance oversight, investment management, and the methods used to evaluate whether benefits have materialized. Candidates who have worked in project or portfolio management will find familiar territory here, but the exam tests governance oversight of these processes, not the processes themselves.

– Oversight of IT performance

Performance management is the governance lens on whether IT is delivering. The exam tests it as an accountability mechanism: who sets targets, who monitors them, and what escalation path exists when performance falls short. Change management in this context is not the ITIL service transition variety; it is the governance oversight of organizational and IT change, ensuring that changes align with strategy and that their impacts are assessed before approval. Governance monitoring is distinct from operational monitoring. The exam expects you to know what a governance body watches, at what frequency, and through what reporting mechanism. Quality assurance appears here as a governance responsibility: ensuring that IT processes and outputs meet the standards the enterprise has set, and that deviations are surfaced to the right level. Process development and improvement is tested as a governance concern: when processes are redesigned or improved, governance ensures the changes are intentional, authorized, and measured against outcomes.

– Turning IT investment into measurable enterprise value

Business case development and evaluation is one of the highest-yield sub-topics in this domain. The exam tests both the construction of a business case and the governance review of one. A governance body reviewing a business case is looking for strategic alignment, realistic assumptions, and a credible benefits realization plan. Candidates lose marks by selecting answers that approve or reject on financial grounds alone. IT investment management and reporting is the ongoing governance activity after the business case is approved: tracking spend against plan, monitoring delivery, and reporting status to the appropriate governance body. Performance metrics are the measurement tools that make reporting meaningful. The exam tests whether metrics are linked to strategic objectives and whether they distinguish leading indicators from lagging ones. Benefit evaluation methods are the techniques used after delivery to determine whether the promised value arrived. The exam is interested in who conducts the evaluation, when it happens relative to project closure, and what governance action follows a negative result.

How BENEFITS REALIZATION is tested

At 26 percent, this domain produces a substantial share of the exam's items, and they tend to be scenario-heavy. A typical item describes an IT programme partway through delivery and asks what governance action is appropriate given the performance data presented. The trap is selecting an operational response when the scenario calls for governance intervention, or vice versa. Business case items reward the candidate who can read a scenario and identify the governance failure in how a case was constructed or approved, rather than simply knowing what a business case contains. Investment reporting items test the flow of information: what goes to which governance body and at what point. Benefit evaluation items are where candidates most often lose marks, because the evaluation step is easy to skip in practice and therefore under-studied. The exam specifically rewards knowing that evaluation happens after delivery and that its findings feed back into future investment decisions. Metrics items test the link between measurement and decision-making, not the definition of any particular metric.

The final domain shifts the frame from delivery to protection. Risk optimization asks whether the enterprise is making conscious, governed decisions about the risks attached to its IT capabilities and investments. At 19 percent, it is weighted to matter. The domain splits cleanly between strategy, where the enterprise decides its stance on risk, and management, where it identifies, assesses, and responds to specific risks. Both halves are tested, and confusing them in the exam is a reliable way to drop marks.

– Setting the enterprise's risk position

Risk frameworks and standards give the enterprise a structured way to think about risk. The exam does not test frameworks as trivia; it tests whether you can apply the right framework concept to a governance scenario. Enterprise risk management is the governance-level integration of risk thinking across the whole organization, including IT risk. The exam tests ERM as a governance responsibility: who owns it, how IT risk feeds into it, and how governance decisions reflect the enterprise's overall risk posture. Risk appetite and risk tolerance are the most examinable concepts in this section, and the distinction between them is the point candidates most often get wrong. Appetite is the amount of risk the enterprise is willing to accept in pursuit of its objectives; tolerance is the acceptable deviation from that appetite in practice. The exam places these concepts in scenarios where a decision has to be made and asks which governance response reflects the enterprise's stated position. Choosing an answer that is risk-averse when the enterprise has a stated appetite for risk, or aggressive when tolerance is narrow, is the common error.

– Identifying, assessing, and managing IT risk

IT-enabled capabilities, processes, and services introduce risk at every stage of their lifecycle, and the exam tests whether governance has visibility of that risk. This sub-topic is about recognizing that IT is not just a source of value but a source of exposure, and that governance is responsible for both. Business risk, exposures, and threats is the broader landscape: the exam asks you to connect specific IT risks to the enterprise risks they create or amplify, not treat them as separate categories. The risk management lifecycle is the governed process: identify, assess, respond, monitor. The exam tests the sequence and the accountability at each stage. Skipping assessment to move straight to response is a trap the exam sets deliberately. Risk assessment methods are the tools used to size and prioritize risk. The exam tests these at the selection level: given a scenario, which method is appropriate and why. Quantitative versus qualitative is the most common distinction tested, and the answer depends on the data available and the decision being made.

How RISK OPTIMIZATION is tested

At 19 percent, risk optimization items appear throughout the exam and tend to involve a governance body making a decision under uncertainty. The items reward candidates who can distinguish between setting risk strategy and executing risk management, because the two require different actors and different governance mechanisms. Risk appetite and tolerance items are the most precise in the domain: the exam constructs scenarios where the enterprise's stated position is given and asks you to identify the response that stays within it. Selecting a response that feels prudent but exceeds or ignores the stated appetite is the dominant error. Risk assessment method items reward matching the method to the scenario's constraints, not defaulting to the most rigorous method available. ERM items test integration: the strongest option is always the one that connects IT risk to the enterprise risk picture rather than treating IT as an isolated silo. Lifecycle items reward knowing the correct sequence and recognizing when a step has been skipped or performed by the wrong party. The exam is particularly interested in the monitoring step, which candidates under-prepare for.