7 governance traps the CGEIT exam sets
Internalise the seven scenarios CGEIT recycles, so you spot the trap before you read the options.
CGEIT questions are engineered around a handful of recurring traps. Once you recognise the pattern, you stop guessing. Here are the seven that show up most.
1 · Governance / management blur
A CIO "does governance" by picking a vendor; a board "manages" by approving a config. Best answer: restore the split — the board evaluates, directs and monitors; management plans, builds and runs.
2 · IT sets investment priorities alone
IT decides which projects get funded. Best answer: prioritisation is a business decision informed by IT, owned by a senior, business-led steering body.
3 · The sunk-cost trap
"We've spent too much to stop now." Best answer: judge remaining value vs. remaining cost — and be willing to terminate.
4 · Over-control
A risk-averse leader kills a valuable initiative whose risk sits within appetite. Best answer: optimise risk to appetite; over-control destroys value and is itself a governance failure.
5 · The isolated risk register
A detailed IT risk register that never reaches the board. Best answer: integrate IT risk into enterprise risk management with board visibility.
6 · Wholesale framework adoption
Copying COBIT verbatim until governance becomes bureaucracy. Best answer: tailor the framework to context using design factors.
7 · The AI accountability gap
"The model decided." Best answer: every automated decision needs a named, accountable human owner; AI is governed through the existing system, extended.
Key concepts to lock in
- Spot the trap before reading the options
- BEST/FIRST/MOST = rank, don't just identify
- Default to the governance answer
- These 7 patterns cover a large share of the exam