According to common governance models, the governing body's role is to:
Domain 1
Answer: B · whyGovernance evaluates options, sets direction and monitors performance; management plans, builds, runs and monitors.
ISACA · IT Governance
CGEIT - Certified in the Governance of Enterprise IT
Senior IT governance, advisory and assurance professionals, CIO/CISO-track leaders and board advisers responsible for the governance of enterprise IT.
Overview
- Prerequisites
- Pass the exam and apply within 5 years. Certification needs 5+ years in an advisory or oversight role supporting the governance of IT; ISACA allows no experience waivers or substitutions. US$50 application fee.
- Maintenance
- ISACA CPE policy: at least 20 CPE hours every calendar year and 120 CPE hours over a rolling 3-year cycle, plus the annual maintenance fee (US$45 members / US$85 non-members; reduced to US$25/US$50 for a 3rd+ ISACA certification). From 1 January 2027 at least 90 of the 120 hours must align to the certification's exam content outline; up to 30 may be broader professional development.
- Outline in effect
- check official site
Domain weights and exam length are from ISACA's current Exam Candidate Guide; the outline's effective date was not stated on the pages checked.
Exam facts
- Questions
- 150
- Duration
- 4 hours (240 minutes)
- Question types
- Multiple choice, one best answer
- Passing score
- 450 on a 200-800 scaled score
- Format
- Linear (fixed form), computer-based
- Delivery
- PSI test centres or remote online proctoring
- Languages
- English, Chinese Simplified
Cost
- Member
- US$575
- Non-member
- US$760
- Notes
- Plus US$50 application fee.
Domains & weights
- Domain 1 - Governance of Enterprise IT40%
- Domain 2 - IT Resources15%
- Domain 3 - Benefits Realization26%
- Domain 4 - Risk Optimization19%
Upcoming changes
No announced changes as of 19 Oct 2026.
Study plan
- Week 1
Governance foundations
- COBIT 2019 governance vs management, governance system components, design factors.
- Diagnostic questions.
- Week 2
Domain 1 - Governance framework
- Roles of board, executive, IT strategy committee; decision rights; policies; ISO/IEC 38500 principles.
- Week 3
Domain 1 - Strategy and alignment
- Strategic planning, enterprise architecture, portfolio direction, stakeholder communication.
- Week 4
Domain 2 - IT resources
- Resource planning, sourcing strategy, capability and people management.
- Week 5
Domain 3 - Benefits realisation
- Business cases, value management (Val IT concepts), portfolio/programme management, performance measurement (BSC).
- Week 6
Domain 4 - Risk optimisation
- ERM integration, risk appetite, IT risk governance, risk reporting to the board.
- Week 7
Mixed practice
- Timed 150-question mock; review missed items by domain.
- Week 8
Review
- Re-study Domain 1 (40%); second mock; glossary review.
Exam tips
- Read every question for the role you are playing (auditor, risk practitioner, security manager): ISACA rewards the answer that fits that role, not the most technical one.
- Watch qualifier words such as FIRST, BEST, MOST, PRIMARY and GREATEST: several options are often true, and only one is the best next step.
- There is no penalty for wrong answers, so never leave a question blank.
- Budget about 1.5 minutes per question (150 questions in 240 minutes) and flag long scenario items to revisit.
- Bring a current, original, government-issued photo ID whose name exactly matches your ISACA profile; arrive 30 minutes early at a PSI centre, or run the PSI system check well before a remote exam.
- Answers should reflect the board/executive perspective: direction, evaluation and monitoring, not hands-on management.
Common pitfalls
- Treating governance and management as the same thing.
- Neglecting benefits realisation (26%) - many candidates over-study risk.
- Choosing project-level answers when the question asks about portfolio or enterprise level.
Resources & official links
Official
- CGEIT Exam Content Outline
- CGEIT Review Manual and QAE Database (300 questions)
- ISACA Certification Exam Candidate Guide (CISA, CRISC, CISM, CGEIT, CDPSE)
Also widely used
- COBIT 2019 Framework: Introduction and Methodology (ISACA)
- ISO/IEC 38500 governance of IT principles
Sources
- ISACA CGEIT page (fees)
- CGEIT Exam Content Outline
- ISACA Certification Exam Candidate Guide (CISA, CRISC, CISM, CGEIT, CDPSE)
- ISACA Support: requirements to maintain my certification
Last verified 19 Oct 2026. Values marked “check official site” could not be confirmed from an official source.
Practice questions
Who should own the decision on which IT investments best support strategy?
Domain 1
Answer: B · whyInvestment prioritisation is a governance decision linked to strategy.
Which BEST demonstrates IT-business strategic alignment?
Domain 1
Answer: B · whyTraceability from enterprise goals to IT goals shows alignment.
The PRIMARY purpose of a business case is to:
Domain 3
Answer: A · whyA business case supports investment decisions over the full life cycle.
Benefits realisation should be tracked:
Domain 3
Answer: B · whyBenefits are realised after delivery, so tracking must continue after go-live.
Which tool BEST balances financial and non-financial IT performance measures?
Domain 3
Answer: B · whyThe balanced scorecard combines financial, customer, process and learning perspectives.
A sourcing strategy decision (insource vs outsource) is MAINLY part of:
Domain 2
Answer: A · whySourcing is a resource optimisation decision.
Risk optimisation in IT governance aims to:
Domain 4
Answer: B · whyThe aim is to balance risk and value within appetite.
Which should be reported to the board about IT risk?
Domain 4
Answer: B · whyBoards need an aggregated, decision-useful view of risk against appetite.
An enterprise architecture function MOST helps governance by:
Domain 1
Answer: B · whyEA translates strategy into a coherent technology roadmap.