The main reason for an enterprise to implement an IT risk management framework is the need to enable IT risk-aware decisions by executives, as it helps to ensure that the IT risks are aligned with the enterprise strategy, objectives, and risk appetite. IT risk management also provides a consistent and structured approach to identify, analyze, treat, and monitor IT-related business risks, and to communicate and report them to the relevant stakeholders12. References := CGEIT Exam Content Outline, Domain 4, Subtopic B: IT Risk Management, Task 1: Ensure that an IT risk management framework exists to identify, analyze, mitigate, manage, monitor, and communicate IT-related business risk, and that the framework for IT risk management is in alignment with the enterprise risk management (ERM) framework.

A business case is a document that justifies the initiation and continuation of a project based on its expected benefits, costs, risks, and alignment with the strategic objectives of the organization. If a project is experiencing a cost overrun, meaning that it has exceeded its initial budget, it is important to re-evaluate the business case to determine whether the project is still viable and worth pursuing. Re-evaluating the business case can help to identify the root causes of the cost overrun, assess the impact of the overrun on the project's value proposition, and decide whether to continue, modify, or terminate the project. Reviewing the IT investments, reorganizing the IT projects portfolio, and reviewing the IT governance structure are not the most important tasks to perform in this situation. They are more likely to be part of the portfolio management or governance processes that should be done regularly or periodically, not in response to a specific project issue.
Moreover, they do not directly address the problem of the cost overrun or its implications for the project's feasibility and desirability. References := What is a Business Case?, How to Write a Business Case, Project Cost Overruns - Reasons, How to Prevent and Manage