CITM EXIN EPI Certified Information Technology Manager Exam Topics and Questions

IT Strategy opens the exam because everything else, your org structure, your vendors, your projects, sits on top of the strategic decisions made here. The domain tests whether you can connect business need to IT capability in a disciplined way. Expect questions that force you to choose between plausible-sounding directions and to apply concepts like enterprise architecture and service catalogues in a management context rather than a purely technical one.

– Business need and architectural alignment

The exam wants you to reason about why IT exists in an organisation before it asks you how to run it. That means understanding how business drivers translate into IT investment decisions, and how enterprise architecture provides the structural discipline that stops IT from sprawling in every direction a department requests. Architecture here is not about drawing diagrams: it is about the governance layer that forces coherence between what the business needs and what IT actually delivers. When a question places you in a scenario where the business wants something that conflicts with the current architecture, the item rewards knowing which layer of decision-making takes precedence and why. The candidate who treats enterprise architecture as a technical concern rather than a management one will lose marks on those scenarios consistently.

– Service catalogue, service levels, and sustainability

A service catalogue is the formal record of what IT has agreed to provide, and service level management is the discipline that keeps those agreements honest. The exam tests these two together because a catalogue entry without measurable service levels is a promise with no accountability mechanism. Know the difference between what belongs in a service catalogue and what belongs in an SLA, and know which role owns each. Sustainable development appears in this topic as a strategic consideration, not a technical one. Items in this area tend to ask how sustainability factors into IT planning decisions, procurement choices, or the prioritisation of IT initiatives. The trap is treating sustainability as a compliance checkbox rather than a dimension of strategic planning that can affect which option a manager selects when resources are constrained.

How IT Strategy is tested

Items in this topic are scenario-based: you are placed in a managerial role and asked to make or evaluate a strategic decision. The weight of the question is on judgement, not recall. Knowing that enterprise architecture exists will not help you; knowing which architectural concern should drive a decision in a given context will. Service catalogue and service level questions often appear as gap-analysis scenarios, where something is described as missing or misaligned and you must identify the root cause at the strategic level rather than the operational one. The sustainable development sub-topic tends to catch candidates who have not thought about it as a management lens. Items reward linking sustainability to planning cycles and resource allocation rather than to environmental compliance alone. The most common way to lose marks here is to answer at the wrong level: picking an operational fix when the scenario is asking for a strategic one.

Where IT Strategy sets direction, IT Organization determines whether you have the right people to execute it. This is one of the broadest topic areas on the exam, covering the full arc of the employment lifecycle from workforce planning through to staff departures. The breadth is intentional: an IT manager who can plan strategy but cannot staff, develop, or retain a team cannot deliver on it. Expect questions that span HR process and management judgement in equal measure.

– Workforce planning and acquisition

The exam treats personnel need, sourcing, selection, and hiring as a connected sequence, not as isolated HR tasks. A question might give you a capability gap and ask you to determine the right sourcing strategy before you can even get to selection. Sourcing decisions here include the make-or-buy logic of insourcing versus outsourcing, and the exam expects you to apply that logic to a staffing scenario rather than a vendor scenario. The selection process and hiring sub-topics test procedural knowledge: what happens in what order, who is responsible for which step, and what the consequences are of skipping or mishandling a stage. Candidates who treat hiring as a simple checklist tend to miss questions where the scenario introduces a constraint, such as a legal requirement or an internal policy, that changes which step takes priority.

– Roles, responsibilities, and day-to-day management

Roles and responsibilities questions are deceptively straightforward. The exam does not ask you to recite an org chart; it places you in a situation where two roles have overlapping accountability and asks what the manager should do. Managing staff in this context includes delegation, performance monitoring, and handling underperformance, all framed as managerial decisions with organisational consequences. Career planning and training or job rotation appear as tools a manager uses to retain capability and develop people, not as HR department functions. The exam expects you to know when each tool is appropriate and what outcome it is designed to produce. Performance appraisal questions often test whether you understand the difference between appraisal as a development conversation and appraisal as a formal record with downstream consequences.

– Staff departures and continuity

Staff departures are the sub-topic most candidates underestimate. The exam treats a departure, whether voluntary, involuntary, or through retirement, as a risk event with knowledge-transfer and continuity implications. A question might ask you to identify what should happen before a key person leaves, or to evaluate whether an organisation handled a departure correctly given the circumstances described. The managerial concern here is not the HR paperwork; it is the organisational knowledge and access that walks out the door if the departure is not managed properly. Items in this area reward candidates who think in terms of continuity and risk rather than process compliance alone.

How IT Organization is tested

The ten sub-topics in this area mean the exam can draw on a wide range of scenarios without repeating itself. Items tend to present a people-management situation and ask you to identify either the correct next action or the root cause of a described problem. The trap in this topic is applying generic HR logic instead of IT-management-specific logic. For example, a sourcing question is not just about cost; it is about capability, risk, and strategic alignment in an IT context. Performance appraisal and career planning items reward candidates who understand these as managerial instruments with measurable outcomes, not as annual rituals. Staff departure questions reward a continuity-first mindset. The most common error is treating this topic as soft content that does not require the same precision as technical topics. The exam marks it exactly as precisely as any other area.

After building your team internally, the next management challenge is managing the external parties your IT function depends on. Vendor Selection and Management covers the complete lifecycle of a vendor relationship, from the first formal request for information through to recompeting a contract when the relationship ends or needs renewal. The exam treats this as a disciplined procurement and governance process, not a commercial negotiation exercise, and the questions reflect that framing.

– Structured selection and evaluation

The RFI and RFP are not interchangeable, and the exam will test whether you know the difference in practice. An RFI gathers market intelligence before you have defined your requirements in full; an RFP solicits formal proposals against a defined specification. Using one when you should use the other is a process error with real consequences, and the exam presents scenarios where the distinction matters. Proposal evaluation and vendor reference checks follow as quality gates: the exam expects you to know what each stage is designed to verify and what a failure at that stage implies for the decision. Vendor selection itself is tested as a weighted, structured decision, not a gut-feel call. Items in this cluster reward candidates who can identify what information is still missing before a selection decision can be made responsibly.

– Contracting, ongoing management, and recompete

Contract negotiation and contract management are tested as distinct activities. Negotiation is a pre-award activity; contract management is what happens after the signature, and it is where most vendor relationships either hold together or quietly fall apart. The exam wants you to know what belongs in a contract, what a manager monitors during the life of a contract, and what triggers a formal review. Vendor management in this context is the day-to-day relationship governance: performance measurement, escalation paths, and relationship health. Recompete is the sub-topic candidates most often skip, but the exam includes it because a manager who cannot plan a recompete puts the organisation at risk of either poor continuity or a weak negotiating position at renewal. Items here reward knowing when to start a recompete process relative to the contract end date.

How Vendor Selection and Management is tested

Items in this topic are process-sequence and judgement questions. A scenario might describe a vendor relationship at a particular point in its lifecycle and ask what the manager should do next, or it might describe a step that was skipped and ask what risk that creates. The RFI versus RFP distinction appears in scenarios where the organisation has not yet fully defined its requirements, and items reward the candidate who recognises that distinction rather than jumping to proposal stage. Contract management questions often describe a performance shortfall and test whether you respond at the governance level or the operational level. The recompete sub-topic tends to generate questions about timing and planning horizon. The most common error in this topic is treating vendor management as a relationship activity rather than a governance activity. Items consistently reward structure and process discipline over interpersonal framing.

Project Management is the most structurally dense topic on this exam. Eleven sub-topics span the full project lifecycle, from methodology choice through to communication, and the exam draws on all of them. The challenge here is not knowing that these concepts exist: most candidates working in IT already have some exposure. The challenge is applying them at the management level the exam demands, where the question is not how to do the work but how to govern it.

– Methodology, organisation, and initiation

Methodology questions test your ability to select and justify an approach given a described project context, not to recite the steps of any single framework. Project organisation tests who has authority over what and how that authority is structured. Starting-up and initiating are treated as distinct phases in some frameworks and the exam can test that distinction, particularly around what decisions must be made before a project is formally authorised to proceed. Candidates who blur initiation and planning tend to lose marks on sequencing questions. The items in this cluster reward knowing why each phase exists and what would go wrong if it were skipped or combined with the next one.

– Risk, quality, and scope

Risk, quality, and scope are each tested as active management disciplines, not as documents you produce at the start of a project and file away. Risk management questions place you in a scenario where a risk has materialised or is about to, and ask what the manager should have done or should do now. Quality in this context is about assurance and control mechanisms built into delivery, not about testing at the end. Scope questions are often the most scenario-rich: the exam regularly presents a situation where scope has drifted or is being challenged by a stakeholder, and items reward the candidate who knows the formal mechanism for handling that rather than the one who tries to manage it informally. The trap is treating these three as separate concerns rather than as interdependent constraints on the same delivery.

– Planning tools and delivery control

Work Breakdown Structure and Product Breakdown Structure are planning tools that the exam tests at the level of purpose and application. Knowing which one decomposes deliverables and which decomposes tasks matters when a scenario asks you to diagnose a planning problem. Scheduling and cost are tested together in the sense that a schedule decision always has a cost implication and vice versa; items that isolate one often have the other as the hidden constraint. Communication is the sub-topic candidates most frequently underweight. The exam treats communication planning as a governance activity with formal outputs, not as keeping people informed. Items in this cluster reward candidates who can identify the right communication mechanism for a given stakeholder relationship at a given project stage.

How Project Management is tested

With eleven sub-topics, Project Management generates a high variety of scenario types. Items tend to present a project in trouble and ask the manager to diagnose the cause or select the next action. The methodology sub-topic catches candidates who have memorised one framework and try to apply it universally; items reward situational judgement about approach selection. Risk and scope questions are the most scenario-layered: the situation described will have more than one plausible response, and the strongest option is the one that addresses the management-level concern rather than the technical one. WBS and PBS questions reward precision about what each tool is for. Communication questions are often the ones candidates get wrong because they underestimate how formally the exam treats communication planning. The broad coverage means you cannot afford a gap in any single sub-topic.

Project Management governs how you deliver; Application Management governs what you deliver and how you sustain it afterward. This topic covers the software lifecycle from requirements through to maintenance, with quality assurance woven through every stage. The exam tests this from an IT manager's perspective, which means the focus is on oversight, decision points, and governance rather than on writing code or designing test cases.

– Lifecycle structure and quality assurance

The Software Development Life Cycle gives the topic its backbone, and the exam uses it as a framework for placing management decisions in context. SDLC questions are rarely about the phases themselves; they are about what a manager is responsible for at each transition point. Software Quality Assurance is tested as a discipline that runs alongside development rather than following it. The exam distinguishes between quality assurance, which is process-oriented and preventive, and quality control, which is product-oriented and detective. Candidates who treat SQA as synonymous with testing will misread items that ask about the manager's role in quality. Items in this cluster reward understanding SQA as a management accountability, not a developer or tester accountability.

– Requirements, development, and the path to production

Requirements are the sub-topic where the most downstream problems originate, and the exam reflects that. Items test whether you can identify a requirements failure from its symptoms later in the lifecycle, not just whether you know what a requirement document contains. Development in this context is about the manager's oversight role: approvals, milestone reviews, and the signals that indicate a development effort is drifting. Testing as a sub-topic is treated as a formal stage with entry and exit criteria, and the exam can ask what should happen when those criteria are not met. Adoption or implementation is the transition from development to live operation, and items here test change readiness and stakeholder preparation. Maintenance closes the lifecycle and the exam treats it as a planned activity, not a reactive one: items reward candidates who understand that maintenance has its own resource and priority management requirements.

How Application Management is tested

Items in this topic ask you to apply lifecycle logic to a described situation. A common pattern is a scenario where something has gone wrong in production and the question asks you to identify which earlier lifecycle stage failed. This requires you to reason backwards through the SDLC, not just forwards. SQA questions reward candidates who understand the difference between assurance and control and can identify which one is missing in a given scenario. Requirements questions often describe a dispute between stakeholders and test whether you know the formal mechanism for resolving it. The adoption sub-topic generates questions about readiness criteria and what happens when they are not met before go-live. Maintenance items reward a planned-activity mindset. The most common error in this topic is answering from a developer's perspective rather than a manager's: the exam consistently rewards governance and oversight over technical execution.

Service Management brings the focus back to live operations after the delivery-oriented topics that precede it. With only two sub-topics, problem management and change management, the scope is narrow but the depth the exam expects is not. Both disciplines are tested as formal, process-driven activities with defined roles, triggers, and outputs. The candidate who treats either as informal troubleshooting or ad-hoc approval will find the items consistently unrewarding.

Problem management and change management are related but distinct. Problem management is reactive in origin but proactive in goal: it moves from fixing symptoms to eliminating root causes. The exam tests whether you know where that boundary sits. A question might describe an incident that has been resolved and ask what should happen next under problem management; items reward the candidate who recognises that resolution is not the end of the process. Change management in this context is the formal discipline for controlling modifications to the live environment. The exam tests the structure of the process: what types of changes follow which approval paths, what a change advisory board does and does not decide, and what happens when a change is implemented without following the process. The two disciplines intersect when a problem record generates a request for change, and the exam can test that handover point directly. Candidates who understand each process in isolation but have not thought about how they connect will miss those intersection questions.

How Service Management is tested

Items in this topic are process-knowledge and scenario-judgement questions in roughly equal measure. A process-knowledge item might ask what the formal output of a particular stage is, or who has authority to approve a given type of change. A scenario item describes a service event and asks what the manager should do, or asks you to identify which process has been bypassed given the described outcome. Change management questions often present an emergency change scenario, where the normal approval path is compressed, and test whether you know what controls still apply. Problem management questions frequently describe a pattern of recurring incidents and reward the candidate who identifies root-cause analysis as the missing step rather than improved incident response. The intersection between the two processes is a reliable source of harder items. Knowing both processes well individually is necessary but not sufficient: you need to know how they hand off to each other.

Business Continuity Planning closes the exam with the question of what happens when everything else fails. The topic covers the full BCP lifecycle, from assessing what resources and information the organisation cannot afford to lose, through building and testing a plan, to the ongoing review cycle that keeps it credible. The exam tests this as a management discipline with formal outputs at every stage, not as a list of contingency arrangements.

– Foundations: resources, information, and site decisions

The BCP process begins with understanding what must be protected and where it can be protected from. Resources and information requirements are assessed together because a continuity plan that protects systems but not the data those systems depend on is not a plan. The exam tests whether you can identify what belongs in an information requirements assessment and what the consequences are of gaps in that assessment when the plan is actually invoked. Site selection is a decision with multiple criteria, and the exam can test those criteria in a scenario where the obvious choice has a disqualifying constraint. Relocation of staff is tested as a logistics and communication problem as much as a facilities problem: items reward candidates who think about the human and information dimensions of relocation, not just the physical ones.

– Building, testing, and sustaining the plan

The Business Continuity Plan itself is tested as a formal document with defined components, and the exam can ask what is missing from a described plan or what a described component is supposed to achieve. Backup strategies appear here as a technical sub-topic embedded in a management context: the exam does not ask you to configure a backup system, but it does ask you to evaluate whether a described backup strategy is adequate for a given recovery requirement. Testing and exercising the plan is where many organisations fail in practice, and the exam reflects that by testing the difference between a test and an exercise, and between a tabletop exercise and a live invocation. Test review, reporting, and follow-up close the testing cycle: items reward candidates who understand that a test finding without a remediation action and a follow-up check is not a closed loop. Monitoring and review ensures the plan stays current, and the exam treats this as an ongoing management responsibility with a defined frequency and ownership.

How Business Continuity Planning is tested

BCP items tend to present a scenario where a plan exists but something about it is inadequate, and ask you to identify the gap or the next correct action. The most common trap is answering at the incident response level when the question is asking about the planning or testing level. Items about backup strategies reward candidates who connect the backup approach to the recovery time and recovery point objectives implied by the scenario, rather than selecting the most technically sophisticated option. Site selection questions often include a constraint that eliminates the intuitively obvious answer. Test and exercise questions reward understanding of what each exercise type can and cannot verify. The monitoring and review sub-topic generates items about ownership and frequency: who is responsible for keeping the plan current, and what triggers an unscheduled review. Candidates who have treated BCP as a one-time deliverable rather than a managed programme will find those items difficult.

Risk Management picks up where Business Continuity Planning leaves off: BCP is what you do when risk materialises; this topic is about the structured discipline that precedes that moment. The eight sub-topics follow the ISO 31000 process sequence, and the exam tests that sequence as a management framework, not as a theoretical model. What will cost you marks is treating risk management as an event rather than a cycle, or collapsing its distinct stages into a single undifferentiated activity.

– Setting the stage: guidelines and context

Guidelines in this topic refer to the principles and mandate that give a risk management programme its authority within the organisation. The exam tests whether you understand what must be established at this level before any risk-specific work can begin. Without a clear mandate, risk decisions lack organisational backing, and items in this cluster reward candidates who recognise that gap. Context establishment is the stage that defines the scope, boundaries, and criteria against which risks will be assessed. It is the step most often skipped in practice and most often tested in the exam. A question might describe a risk assessment that produced inconsistent results and ask you to identify what was missing; the answer almost always traces back to incomplete context setting. Candidates who treat context as a formality rather than a decision-shaping stage will lose marks on those diagnostics consistently.

– The assessment sequence: identification, analysis, and evaluation

Identification, analysis, and evaluation are three distinct stages that the exam tests both individually and as a sequence. Identification is about surfacing risks, not sizing them. Analysis assigns likelihood and consequence to what has been identified. Evaluation compares the analysed risk against the criteria established in the context stage to decide whether treatment is needed. The exam frequently presents scenarios where these stages have been run in the wrong order or where one has been skipped, and items reward the candidate who can identify which stage failure explains the described outcome. The analysis sub-topic can include both qualitative and quantitative approaches, and the exam tests when each is appropriate rather than asking you to perform a calculation. Evaluation is the decision gate: items here reward knowing what the output of evaluation is and who is accountable for acting on it.

– Acting and sustaining: treatment, communication, and monitoring

Risk treatment is where the process produces an action, and the exam tests the full range of treatment options: avoidance, reduction, sharing, and acceptance. Items in this area reward candidates who can match a treatment option to a described risk profile and organisational context, rather than defaulting to reduction as the universal answer. Communication runs through the entire risk process, not just at the end, and the exam reflects that. A question might ask at what point in the cycle a particular stakeholder should be informed, or what the consequence is of communicating a risk finding without the context that makes it interpretable. Monitoring and control is the sub-topic that closes the loop. The exam treats it as an ongoing management responsibility with defined triggers for reassessment, not as a periodic report. Items reward candidates who understand that a risk register that is never updated is a liability rather than an asset.

How Risk Management is tested

Items in this topic are heavily scenario-based and tend to present a risk management process that is partially described or partially broken. Your job is to identify which stage of the process is missing, misapplied, or out of sequence. The most common trap is answering at the wrong stage: a question about an evaluation failure will have treatment-level options that look plausible but are premature. The guidelines and context sub-topics generate items that candidates underestimate because they seem abstract; in practice, those items reward knowing exactly what each stage produces and what downstream decisions depend on it. Treatment questions reward matching the option to the risk profile, not selecting the most conservative or most active response by default. Communication items reward understanding it as a process-wide activity rather than a final output. Monitoring questions reward a continuous-management mindset. Candidates who have studied risk management as a one-pass process rather than a cycle will find the monitoring and context items particularly costly.

Risk Management asks what could go wrong; Information Security Management asks how you protect the organisation once you know. Nine sub-topics span from international standards through to incident response, and the exam tests all of them as management-level concerns. The candidate who approaches this topic from a technical security background will need to consciously shift frame: the exam rewards governance decisions, not configuration choices.

– Standards, the CIA triad, and what they demand of a manager

Standards in this topic means the frameworks that govern how information security is structured and audited within an organisation. The exam does not ask you to recite standard clauses; it asks you to apply the logic of a standards-based approach to a described management situation. Confidentiality, integrity, and availability are the three properties the exam uses as a classification lens throughout the topic. The examinable part is not the definitions but the conflicts: a control that strengthens confidentiality can degrade availability, and items reward candidates who can identify that trade-off in a scenario and select the response that addresses the right property. A scenario describing data that has been altered without authorisation is testing integrity, not confidentiality, and the distinction matters for which control response is appropriate. Candidates who treat the CIA triad as background knowledge rather than an active analytical tool will misclassify scenarios and lose marks.

– Controls: types, selection, and categories

Control types, the guideline for control selection, and control categories are three sub-topics the exam tests as a connected decision framework. Control types distinguish between preventive, detective, and corrective controls, and the exam tests which type is appropriate given the timing and nature of a threat. The guideline for controls selection is about the criteria a manager applies when choosing among available controls: proportionality to risk, cost, and feasibility all appear in scenario items. Control categories separate administrative, technical, and physical controls, and the exam can ask which category is missing from a described security posture. The trap across all three is treating controls as interchangeable. Items consistently reward candidates who can identify why a particular control type, selected through a defined criterion, belonging to a specific category, is the right fit for the described situation. Treating any one of these dimensions in isolation will produce a plausible but wrong answer.

– Awareness, and responding when security fails

An information security awareness programme is a management output, not a training department function. The exam tests whether you understand what an awareness programme is designed to change, how its effectiveness is measured, and what the manager's accountability is for its outcomes. Items in this area reward candidates who treat awareness as a risk-reduction control with measurable objectives rather than as a compliance activity. Security incident response closes the topic and is tested as a formal process with defined stages: detection, containment, eradication, recovery, and review. The exam can test the sequence, the roles involved, or the decision criteria that move an event from one stage to the next. Items reward containment-first logic. The most common error is conflating incident response with problem management from the Service Management topic: they share vocabulary but have different process owners, different triggers, and different outputs.

How Information Security Management is tested

Items in this topic use the CIA triad as a classification tool more often than candidates expect. A scenario will describe a security event or a control gap and the first cognitive step is to identify which property is at stake, because that determines which response is appropriate. Getting that classification wrong makes every subsequent option look equally plausible. Standards questions reward understanding a standards-based approach as a governance posture rather than a compliance checklist. Control questions reward matching type, selection criterion, and category to the scenario rather than selecting the most technically impressive option. Awareness programme items reward measurable-outcome thinking. Incident response items reward process-sequence knowledge and containment-first reasoning. The most consistent error across this topic is applying technical security logic to questions that are asking for management-level decisions. The exam marks the governance layer, and candidates who answer from a practitioner's instinct rather than a manager's will find their score reflects that gap.

Where Information Security Management asks how you protect information, this topic asks how you govern, exploit, and derive value from it. Five sub-topics move from the basics of information and data management through to the technologies that support them, the analytical capability that Business Intelligence provides, and the governance practices that determine whether any of it is trustworthy. The exam treats data as an organisational asset that requires active management, and every item in this topic flows from that premise.

How Information and Knowledge Management is tested

Items in this topic tend to present a described information or data management situation and ask you to identify either the governance failure or the appropriate next management action. Information management questions reward understanding the difference between managing information as a resource and managing the systems that store it: the exam asks about the former. Data management items test whether you know what a manager is accountable for in terms of data quality, lifecycle, and ownership. Technology questions are not about configuring tools; they test whether you can evaluate whether a described technology approach is fit for a given management purpose. Business Intelligence items reward connecting analytical output to decision-making rather than treating BI as a reporting function. Data governance questions are where the most marks are lost: the best practices and pitfalls sub-topic generates items that describe a governance arrangement and ask you to identify what is structurally weak about it. Candidates who have studied governance principles without applying them to realistic scenarios will find those items difficult.

Managing information well is a precondition for managing change well. Business Change Management covers the structured approach to initiating, governing, and sustaining change across an organisation, with particular attention to the relationship between IT and the business it serves. Seven sub-topics span from foundational frameworks through to alignment, and the exam tests each as a management discipline with defined roles and measurable outcomes.

– Frameworks, objectives, and the change lifecycle

Frameworks in this topic are the structured approaches that give business change management its shape and authority. The exam does not ask you to recite a framework's steps; it asks you to apply framework logic to a described change scenario and identify what is missing or misapplied. Objectives are tested as the anchor point for all subsequent change activity: an item might describe a change initiative that has drifted and ask you to trace the drift back to its origin, which is almost always an objectives failure. Life cycle activities are the operational heart of the topic. The exam tests the sequence and the purpose of each stage, and items reward candidates who can identify which lifecycle activity has been bypassed when a described change has produced an unexpected outcome. The trap is treating the lifecycle as a checklist rather than as a governance structure where each stage produces an output that the next stage depends on.

– Business Relationship Management and the customer dimension

Business Relationship Management is the sub-topic that most directly connects IT management to the business stakeholders it serves. The exam tests BRM as a formal discipline with defined roles and activities, not as a synonym for good communication. Items in this area reward candidates who can distinguish between the BRM role and the account management or service management roles it intersects with, and who understand what BRM is specifically accountable for producing. Customer relationship and building the business are tested together in the sense that both are about how IT sustains and grows its value to the organisation over time. A question might describe a relationship that has become transactional and ask what management activity is missing; items reward the candidate who identifies the BRM-level intervention rather than an operational one. These sub-topics are where candidates with a purely technical background most often lose marks, because the exam rewards relationship governance logic over technical delivery logic.

– Alignment: keeping IT and the business moving together

Alignment is the sub-topic that ties the rest of Business Change Management to the IT Strategy topic that opened the exam. The exam tests alignment as an active management responsibility, not as a state that exists once a strategy is agreed and then persists automatically. Items reward candidates who understand that alignment requires ongoing governance mechanisms: regular review points, defined escalation paths for misalignment, and clear ownership of the alignment process itself. A scenario might describe an IT initiative that was once strategically aligned but has drifted as business priorities shifted, and the item will ask what the manager should have done to detect and address that drift earlier. The trap is treating alignment as a planning-phase activity rather than a continuous one. Candidates who have thought about alignment only in the context of strategy development will find these items reward a broader, more operational definition of the concept.

How Business Change Management is tested

Items in this topic place you in a change scenario and ask you to evaluate a decision, identify a gap, or select the next management action. Framework questions reward knowing why a structured approach exists rather than what its steps are called. Objectives questions reward tracing a downstream problem back to its upstream cause. Lifecycle questions reward sequence knowledge and the ability to identify a missing output. BRM questions are the ones most likely to have two plausible-looking options, one framed as a relationship activity and one as a service or project activity; items reward the candidate who recognises the BRM-specific accountability. Customer relationship and building-the-business items reward a value-creation lens rather than a service-delivery lens. Alignment questions reward continuous-governance thinking. The most common error across this topic is treating business change management as a project management variant. The exam treats it as a distinct discipline with its own framework, roles, and accountability structure, and answers that import project management logic into a change management scenario will consistently miss the mark.

Technology Trends shifts the frame from governing what exists to evaluating what is emerging. Four sub-topics cover the organisational function that produces new technology capability, and three specific technologies that the exam treats as representative of the current landscape. The exam does not test deep technical knowledge of any of these; it tests whether an IT manager can reason about their implications, limitations, and appropriate application at a strategic and managerial level.

How Technology Trends is tested

Items in this topic reward managerial judgement about technology rather than technical expertise in it. Research and Development questions test the manager's role in evaluating and governing technology investment decisions, not the mechanics of how R&D is conducted. Blockchain items reward understanding of where distributed ledger properties are and are not appropriate for a given organisational context, rather than knowledge of cryptographic implementation. Big Data questions test the management implications of scale, variety, and velocity in data environments: what governance challenges they create and what capabilities a manager needs to address them. Artificial Intelligence items reward understanding of the managerial and organisational considerations around AI adoption, including accountability, bias as a governance concern, and the conditions under which AI-assisted decisions require human oversight. The trap across all four sub-topics is answering from a technical frame. Items consistently reward the candidate who asks what a technology means for the organisation's management structure rather than how the technology works.

Quality closes the exam by asking how you measure and sustain the performance of everything the preceding topics describe. Nine sub-topics span from standards and objectives through to the formal instruments, KPIs, metrics, scorecards, and registers, that make quality management auditable and actionable. The exam treats quality as a management discipline with defined outputs and ownership, and the candidate who approaches it as a vague aspiration toward improvement will find the items consistently unrewarding.

– Standards, objectives, and the review cycle

Standards and guidelines in this topic provide the normative framework within which quality objectives are set and evaluated. The exam tests whether you can apply standards logic to a described quality situation, not whether you can cite specific clauses. Objectives and activities are tested as a connected pair: objectives define the target, activities are the management actions that move the organisation toward it, and items reward candidates who can identify when an activity is misaligned with the objective it is supposed to serve. Service review is the formal mechanism for assessing whether quality commitments are being met, and the exam tests it as a structured process with defined inputs, participants, and outputs. A question might describe a service review that produced no actionable outcome and ask what was structurally missing; items reward candidates who understand what a service review is supposed to produce and who is accountable for acting on its findings.

– Listening to the customer: feedback and surveys

Customer feedback and surveys are tested as management instruments rather than as satisfaction exercises. The exam distinguishes between collecting feedback and acting on it in a structured way, and items reward candidates who understand the governance steps between receiving a piece of customer input and closing the loop on it. Survey design is not tested at a statistical level; it is tested at the level of what a survey is designed to measure and whether the design is fit for that purpose. A question might describe a survey that consistently produces high satisfaction scores while service complaints are rising, and ask what the manager should conclude about the survey itself. Items in this cluster reward critical thinking about measurement validity rather than acceptance of reported results at face value. Candidates who treat customer feedback as an input to be filed rather than a signal to be acted on will lose marks on these scenarios.

– Measurement instruments: KPIs, metrics, scorecards, and the quality register

KPIs and metrics are related but distinct, and the exam tests that distinction in practice. A metric is a measured value; a KPI is a metric that has been designated as an indicator of performance against a strategic or operational objective. The exam can present a scenario where an organisation has many metrics but no KPIs, or KPIs that are not connected to any defined objective, and ask you to identify the governance gap. Scorecards and reports are the communication layer: they translate measurement data into management information, and items test whether the right information is reaching the right decision-maker at the right frequency. The quality register is the formal record that gives a quality management programme its audit trail. Items reward candidates who understand what belongs in a quality register, who owns it, and what the consequence is of a register that is incomplete or not maintained. These four sub-topics are interconnected: a measurement framework that lacks any one of them has a structural gap that the exam will find.

How Quality is tested

Quality items present a described quality management situation and ask you to identify a gap, evaluate a measurement approach, or select the appropriate management action. Standards and objectives questions reward applying normative logic to a scenario rather than reciting framework content. Service review items reward understanding the formal structure of the review process and its required outputs. Customer feedback and survey questions reward critical evaluation of measurement validity, not just acceptance of results. KPI and metrics items reward the distinction between a measured value and a performance indicator tied to an objective. Scorecard and report questions reward matching the right information to the right audience at the right decision point. Quality register items reward understanding of ownership, completeness, and the audit function the register serves. The most common error across this topic is treating quality management as a monitoring activity rather than a governance one. Items consistently reward candidates who understand quality management as a structured discipline with formal instruments, defined accountability, and a closed-loop review cycle.