Test your basic knowledge |

CGEIT: Certified In The Governance Of Enterprise It

Subjects : certifications, cgeit, it-skills

Instructions:

Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can study here.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.

1. A widely used definition of operational risk is the one contained in the Basel II [1] regulations. This definition states that operational risk is the risk of loss resulting from ____________ - people and systems - or from external events.
Trust Service Contracts
inadequate or failed internal processes
executive tasks: prioritization - resource alloc - project tracking
Controls at the corporate level - are internal controls that help Ensure that management directives pertaining to the entire entity are Carried out. They are the second level of a top-down approach to understanding the risks of an organization. Gener

2. COBIT framework
To take the residual risk a company is willing risk
basic ingredients - basic principles - enterprise enablers - goals cascade - maturity model
operational risk (HR - Law - Nature - IT) - reputational risk
iter (interview - test analysis - detecting / hold / summarize - Discuss with auditee

3. ISO 9000
QA
executive tasks: prioritization - resource alloc - project tracking
Encourages the identification of a few relevant high-level financial measures. In Particular - designers were encouraged to choose measures that helped inform the answer to the question 'How do we look to shareholders?'
The identification of measures that answer the question 'What must we excel at?'

4. Derivation Cobit practices / control objectives
Financial - Operational - Reputation
To take the residual risk a company is willing risk
Review process for software system - The functional size is determined - where you split the functional requirements of an application into small - meaningful to the user activities that elementary processes. Same elementary processes are evaluated o
(hierarchy) 5 domains (EDM - po ad ds me) - processes 37 - 211 practices

5. Detection risk
risk that the controls are inadequate
risk that something will NOT be revealed - ill-prepared - not tested properly - misinterpreted findings weighted wrong
Benefits realization management (BRM) (also benefits management or benefits realization) is the explicit planning - delivery and management of whole life benefits from an investment. An investment is only successful if Intended benefits are Realised
informations inherited

6. To address three types of risk in the ICS
basic ingredients - basic principles - enterprise enablers - goals cascade - maturity model
Financial - Operational - Reputation
implementation - information security - assurance - Risk
TQM - BPM /BPR (... reengineering) - BSC - Six Sigma - CMMI

7. Audit risk consists of...
Signature - statement - audit trail
risk that something will NOT be revealed - ill-prepared - not tested properly - misinterpreted findings weighted wrong
inherent risk - control risk: insufficient control system - detection risk: insufficient testing
plan-prepare-execute-track-report

8. Control risk
plan-prepare-execute-track-report
Encourages the identification of a few relevant high-level financial measures. In Particular - designers were encouraged to choose measures that helped inform the answer to the question 'How do we look to shareholders?'
implementation - information security - assurance - Risk
risk that the controls are inadequate

9. risk governance
risk and risk response evaluation
what are the drivers - where are we now - where do we want to be - what needs to be done (project plan) - how do we get there (execute) - did we get there - how to keep the momentum going
iter (interview - test analysis - detecting / hold / summarize - Discuss with auditee
create an environment conductive to innovate - Maintain / understand the enterprise environment - monitor / scan the technology environment - assess the potential of emerging tech.- recommend appropriate further initiatives - monitor the implication

10. Three different control categories?
a technique for analysis and presentation of responsibilities - the name is derived from the initial letters of the words Responsible - Accountable - Consulted and Informed.
implementation - information security - assurance - Risk
informations inherited
Preventive controls - detective controls - corrective controls (troubleshooting instructions)

11. ISO 9000
Business goals with Gov. goals priorisiern - IT goals with U-prioritize targets (script 82) - prioritize process with IT goals
A quality management standard describes the requirements that must be satisfied by the management system of a company in order to meet a certain standard in the implementation of quality management. It can serve both informative for implementation wi
COBIT provides the means of risk management - Riskit provides the ends.
risk that something will NOT be revealed - ill-prepared - not tested properly - misinterpreted findings weighted wrong

12. Best practices in dealing with policies Policies (not principles)
Scoping - formal enactment - clear Vogaben at exceptions - verification of compliance
COBIT provides the means of risk management - Riskit provides the ends.
critical success factors
Tests - Extensive testing

13. COBIT cascading goals
Business goals with Gov. goals priorisiern - IT goals with U-prioritize targets (script 82) - prioritize process with IT goals
Benefits realization management (BRM) (also benefits management or benefits realization) is the explicit planning - delivery and management of whole life benefits from an investment. An investment is only successful if Intended benefits are Realised
To take the residual risk a company is willing risk
create an environment conductive to innovate - Maintain / understand the enterprise environment - monitor / scan the technology environment - assess the potential of emerging tech.- recommend appropriate further initiatives - monitor the implication

14. Good starting points forIT Gov
Define risk owners (possibly delegate to process owners) - avoid the formation - reduction - sharing - acceptance - cost benefit measures to keep the residual risk within defined tolerance limits
risk and risk response evaluation
pain points - improvment opportunities
basic ingredients - basic principles - enterprise enablers - goals cascade - maturity model

15. Operational risk is...

16. IT Steering Committee
executive tasks: prioritization - resource alloc - project tracking
TQM - BPM /BPR (... reengineering) - BSC - Six Sigma - CMMI
risk and risk response evaluation
The identification of measures that answer the question 'What must we excel at?'

17. The 3 themes of the ICS economic / financial risk
Used in business administration figures - references which can be the progress or the level of compliance with regard to important objectives or critical success factors measured within an organization and / or calculated - Important KPIs in the serv
operational risk (HR - Law - Nature - IT) - reputational risk
only known processes enabling
A strategic performance management tool - a semi-standard structured report - supported by proven design methods and automation tools - that can be used by managers to keep track of the execution of activities by the staff within their control and .

18. ISO 31000
enterprise risk management
plan: align - plan - Organize (PO) - build: build - Aquire - Implement (AI) - run: Deliver - servie - Support (DS) - Monitor: Monitor - Evaluate - control ME
Define risk owners (possibly delegate to process owners) - avoid the formation - reduction - sharing - acceptance - cost benefit measures to keep the residual risk within defined tolerance limits
Benefits realization - risk optimization - resource optimization

19. Types of assertions
COBIT provides the means of risk management - Riskit provides the ends.
Signature - statement - audit trail
inherent risk - control risk: insufficient control system - detection risk: insufficient testing
Value analysis - was initially applied WA - to identify and eliminate unnecessary costs. WA is equally successful in improving the performance and function of resources other than the costs. In the course of time - extended the WA applications from p

20. Balanced scorecard - Learning and Growt

21. Anual loss expectancy ALE
quantitative risk analysis approach - damage cost per year * enter frequency
Controls at the corporate level - are internal controls that help Ensure that management directives pertaining to the entire entity are Carried out. They are the second level of a top-down approach to understanding the risks of an organization. Gener
inadequate or failed internal processes
To take the residual risk a company is willing risk

22. Risk analysis methodology
Financial - Operational - Reputation
Scoping - formal enactment - clear Vogaben at exceptions - verification of compliance
A strategic performance management tool - a semi-standard structured report - supported by proven design methods and automation tools - that can be used by managers to keep track of the execution of activities by the staff within their control and .
Scenarios set in a risk environment

23. IT governance life cycle
what are the drivers - where are we now - where do we want to be - what needs to be done (project plan) - how do we get there (execute) - did we get there - how to keep the momentum going
Encourages the identification of a few relevant high-level financial measures. In Particular - designers were encouraged to choose measures that helped inform the answer to the question 'How do we look to shareholders?'
Trust Service Contracts
risk that the controls are inadequate

24. IT Strategy Committee
general: magmt change - security - operations control Application: do everything to do with app. pgm. has zb source management - authentication validation
informations inherited
Benefits realization - risk optimization - resource optimization
VR level - integration and business strategy it - Chaired by a business executive / board member

25. Return on security investment ROSI
what are the drivers - where are we now - where do we want to be - what needs to be done (project plan) - how do we get there (execute) - did we get there - how to keep the momentum going
Saving the cost of damage (eg ALE) minus cost of mitigation
(hierarchy) 5 domains (EDM - po ad ds me) - processes 37 - 211 practices
general: magmt change - security - operations control Application: do everything to do with app. pgm. has zb source management - authentication validation

26. Refine the innovation process management
Signature - statement - audit trail
Encourages the identification of measures that answer the question? 'How can we continue to improve and create value. '
QA
create an environment conductive to innovate - Maintain / understand the enterprise environment - monitor / scan the technology environment - assess the potential of emerging tech.- recommend appropriate further initiatives - monitor the implication

27. The report stage of a review
only known processes enabling
Observations / findings - risks - recommendation / report
Financial - Operational - Reputation
5 gov processes (GL - PR) - std (users realize - risks opt opt ress) and framework - stakeholder transparency create - it gov: provide direction - evaluate performance - it Mgmnt: translate strategy into direction - and report performance mesure - 32

28. Balanced scorecard - Financial

29. Procedure for Governance Compliance Review
critical success factors
COBIT provides the means of risk management - Riskit provides the ends.
Financial - Operational - Reputation
plan-prepare-execute-track-report

30. IT Governance and COBIT
stratecic establish alignment / framework - value delivery - risk management - resource mgmt - performance mgmt / stakeholer transparency
5 gov processes (GL - PR) - std (users realize - risks opt opt ress) and framework - stakeholder transparency create - it gov: provide direction - evaluate performance - it Mgmnt: translate strategy into direction - and report performance mesure - 32
Financial - Operational - Reputation
processes are assets that create value for the customer

31. Hierarchy of policies
plan-prepare-execute-track-report
To take the residual risk a company is willing risk
risk that the controls are inadequate
policy - principles - statements

32. Escrow contracts
Trust Service Contracts
a risk Arising from execution of a company's business functions. It is a very broad concept Which Focuses on the risks you Arising from the people - systems and processes through Which a company operates. It therefore includes other categories examin
The identification of measures that answer the question 'What must we excel at?'
risk that something will NOT be revealed - ill-prepared - not tested properly - misinterpreted findings weighted wrong

33. Value management
Value analysis - was initially applied WA - to identify and eliminate unnecessary costs. WA is equally successful in improving the performance and function of resources other than the costs. In the course of time - extended the WA applications from p
QA
who should do what? - establishing accountability - VR / goals objectives - GL translate strategy into action (automation - cost - risk mgmt)
Financial - Operational - Reputation

34. Inherent risk
Define risk owners (possibly delegate to process owners) - avoid the formation - reduction - sharing - acceptance - cost benefit measures to keep the residual risk within defined tolerance limits
unavoidable risk
Review process for software system - The functional size is determined - where you split the functional requirements of an application into small - meaningful to the user activities that elementary processes. Same elementary processes are evaluated o
Controls at the corporate level - are internal controls that help Ensure that management directives pertaining to the entire entity are Carried out. They are the second level of a top-down approach to understanding the risks of an organization. Gener

35. Risk treatment process
Define risk owners (possibly delegate to process owners) - avoid the formation - reduction - sharing - acceptance - cost benefit measures to keep the residual risk within defined tolerance limits
Business goals with Gov. goals priorisiern - IT goals with U-prioritize targets (script 82) - prioritize process with IT goals
Signature - statement - audit trail
Observations / findings - risks - recommendation / report

36. Comprehensive audits
Tests - Extensive testing
pain points - improvment opportunities
what are the drivers - where are we now - where do we want to be - what needs to be done (project plan) - how do we get there (execute) - did we get there - how to keep the momentum going
An internally controlled collection and analysis of values. In a control self-assessment fill out one or more units surveyed questionnaires - which can then be evaluated independently. This survey can help the units (individuals - groups - department

37. Raci carts (RACI)
Signature - statement - audit trail
Scenarios set in a risk environment
a technique for analysis and presentation of responsibilities - the name is derived from the initial letters of the words Responsible - Accountable - Consulted and Informed.
Benefits realization management (BRM) (also benefits management or benefits realization) is the explicit planning - delivery and management of whole life benefits from an investment. An investment is only successful if Intended benefits are Realised

38. Valit content framework
plan-prepare-execute-track-report
inadequate or failed internal processes
Scoping - formal enactment - clear Vogaben at exceptions - verification of compliance
extract optimal value from investments it - value management: processes - monitor - portfolio management: funds - human - investment management: business case - Manging program / projects

39. CSFs
Value analysis - was initially applied WA - to identify and eliminate unnecessary costs. WA is equally successful in improving the performance and function of resources other than the costs. In the course of time - extended the WA applications from p
Define risk owners (possibly delegate to process owners) - avoid the formation - reduction - sharing - acceptance - cost benefit measures to keep the residual risk within defined tolerance limits
Controls at the corporate level - are internal controls that help Ensure that management directives pertaining to the entire entity are Carried out. They are the second level of a top-down approach to understanding the risks of an organization. Gener
critical success factors

40. COBIT professional guides
implementation - information security - assurance - Risk
plan-prepare-execute-track-report
Used in business administration figures - references which can be the progress or the level of compliance with regard to important objectives or critical success factors measured within an organization and / or calculated - Important KPIs in the serv
Controls at the corporate level - are internal controls that help Ensure that management directives pertaining to the entire entity are Carried out. They are the second level of a top-down approach to understanding the risks of an organization. Gener

41. application vs. controls. IT general controls
TQM - BPM /BPR (... reengineering) - BSC - Six Sigma - CMMI
Review process for software system - The functional size is determined - where you split the functional requirements of an application into small - meaningful to the user activities that elementary processes. Same elementary processes are evaluated o
general: magmt change - security - operations control Application: do everything to do with app. pgm. has zb source management - authentication validation
plan-prepare-execute-track-report

42. Control self assessment Self-assessment (kd) or a Control Self Assessment (CSA supervised self-assessment
An internally controlled collection and analysis of values. In a control self-assessment fill out one or more units surveyed questionnaires - which can then be evaluated independently. This survey can help the units (individuals - groups - department
create an environment conductive to innovate - Maintain / understand the enterprise environment - monitor / scan the technology environment - assess the potential of emerging tech.- recommend appropriate further initiatives - monitor the implication
general: magmt change - security - operations control Application: do everything to do with app. pgm. has zb source management - authentication validation
inherent risk - control risk: insufficient control system - detection risk: insufficient testing

43. 3 Governance Objectives
only known processes enabling
Benefits realization - risk optimization - resource optimization
Financial - Operational - Reputation
Scoping - formal enactment - clear Vogaben at exceptions - verification of compliance

44. Structure of the 32 COBIT processes mgmt.
performance monitoring - to demostrate the effectivness if IT and communicate about it - Performance - risk and capabilities
plan: align - plan - Organize (PO) - build: build - Aquire - Implement (AI) - run: Deliver - servie - Support (DS) - Monitor: Monitor - Evaluate - control ME
Preventive controls - detective controls - corrective controls (troubleshooting instructions)
implementation - information security - assurance - Risk

45. Function point analysis
Review process for software system - The functional size is determined - where you split the functional requirements of an application into small - meaningful to the user activities that elementary processes. Same elementary processes are evaluated o
Tests - Extensive testing
A strategic performance management tool - a semi-standard structured report - supported by proven design methods and automation tools - that can be used by managers to keep track of the execution of activities by the staff within their control and .
general: magmt change - security - operations control Application: do everything to do with app. pgm. has zb source management - authentication validation

46. Methods for continuous process improvement
implementation - information security - assurance - Risk
TQM - BPM /BPR (... reengineering) - BSC - Six Sigma - CMMI
To take the residual risk a company is willing risk
who should do what? - establishing accountability - VR / goals objectives - GL translate strategy into action (automation - cost - risk mgmt)

47. ISO 27000
informations inherited
iter (interview - test analysis - detecting / hold / summarize - Discuss with auditee
Define risk owners (possibly delegate to process owners) - avoid the formation - reduction - sharing - acceptance - cost benefit measures to keep the residual risk within defined tolerance limits
a technique for analysis and presentation of responsibilities - the name is derived from the initial letters of the words Responsible - Accountable - Consulted and Informed.

48. KPI
policy - principles - statements
plan-prepare-execute-track-report
Used in business administration figures - references which can be the progress or the level of compliance with regard to important objectives or critical success factors measured within an organization and / or calculated - Important KPIs in the serv
stratecic establish alignment / framework - value delivery - risk management - resource mgmt - performance mgmt / stakeholer transparency

49. Entity level controls
Controls at the corporate level - are internal controls that help Ensure that management directives pertaining to the entire entity are Carried out. They are the second level of a top-down approach to understanding the risks of an organization. Gener
Value analysis - was initially applied WA - to identify and eliminate unnecessary costs. WA is equally successful in improving the performance and function of resources other than the costs. In the course of time - extended the WA applications from p
risk that the controls are inadequate
extract optimal value from investments it - value management: processes - monitor - portfolio management: funds - human - investment management: business case - Manging program / projects

50. Balanced scorecard (BSC)
risk and risk response evaluation
A strategic performance management tool - a semi-standard structured report - supported by proven design methods and automation tools - that can be used by managers to keep track of the execution of activities by the staff within their control and .
general: magmt change - security - operations control Application: do everything to do with app. pgm. has zb source management - authentication validation
Preventive controls - detective controls - corrective controls (troubleshooting instructions)