IT key risk indicators (KRIs) are metrics that measure the likelihood and impact of IT-related risks on the enterprise's objectives and goals. Therefore, the first step in determining appropriate IT KRIs is to identify the IT-related risks that are relevant and significant for the enterprise. IT controls, IT threats and IT objectives are also important factors in developing IT KRIs, but they are not the first step. IT controls are the measures that mitigate or reduce IT risks, IT threats are the sources of potential harm or loss to IT assets or processes, and IT objectives are the desired outcomes or results of IT activities that support the enterprise's strategy and goals.
References := ISACA, CGEIT Review Manual, 7th Edition, 2019, p. 90-91; Integrating KRIs and KPIs for Effective Technology Risk Management; Performance Measurement Metrics for IT Governance; State and Impact of Governance of Enterprise IT in Organizations: Key Findings of an International Study.

According to the CGEIT exam guide, the main focus of IT policies is to provide business value by aligning IT with business objectives and strategies, ensuring effective and efficient use of IT resources, and delivering IT-enabled capabilities that meet stakeholder needs and expectations. IT policies should also support the optimization of operational benefits, the enhancement of organizational capability, and the limitation of IT costs, but these are not the main focus of IT policies. : CGEIT Exam Candidate Guide, page
13. CGEIT Certification

The first consideration with regard to the IT service desk that will remain centralized is the effect of regional differences on service delivery. This is because regional differences can pose various challenges and opportunities for the IT service desk, such as:
* Language and cultural barriers: The IT service desk staff should be able to communicate effectively and respectfully with customers from different countries and backgrounds, and understand their needs, preferences, and expectations. This may require hiring multilingual staff, providing language training, using translation tools, or outsourcing some services to local providers1.
* Time zone differences: The IT service desk should be able to provide timely and consistent support to customers across different time zones, and avoid delays or disruptions in service delivery. This may require extending the service hours, implementing shift work, using automation tools, or outsourcing some services to local providers2.
* Legal and regulatory differences: The IT service desk should be aware of and comply with the local laws and regulations that apply to the IT services they provide, such as data protection, privacy, security, taxation, and consumer rights. This may require conducting a risk assessment, obtaining legal advice, implementing policies and procedures, or outsourcing some services to local providers3.
* Technical and operational differences: The IT service desk should be able to adapt to the technical and operational requirements and challenges of the different regions they serve, such as network connectivity, bandwidth, infrastructure, devices, software, standards, and best practices. This may require conducting a feasibility study, investing in technology upgrades, implementing quality assurance measures, or outsourcing some services to local providers4.
The other options, identification of IT service desk functions that can be outsourced, enforcement of a standardized policy across all regions, and availability of adequate resources to provide support for new users are also important considerations for the IT service desk that will remain centralized, but they are not the first one. They are more related to the implementation and execution of the IT service desk strategy, rather than its design. They are also influenced by the regional differences factor, as they depend on the level of variation and complexity that the IT service desk faces in different regions. References := Five Ways to Provide a World Class Service Desk Experience, How to Run an IT Service Desk in a Hybrid or Remote World - Gartner, Best Practices for Building a Service Desk | Atlassian, The Top 18 Help Desk Metrics and Best Practices - HubSpot Blog

A vendor risk assessment is the most important consideration when integrating a new vendor with an ERP system, because it helps to identify and evaluate the potential risks or hazards associated with the vendor's operations and products and their impact on the organization. A vendor risk assessment can cover aspects such as security, compliance, quality, reliability, performance, and contingency plans. By conducting a vendor risk assessment, the organization can mitigate the risks and ensure a smooth and secure integration with the ERP system. The other options are not as important as a vendor risk assessment, because they are either dependent on or secondary to it. IT senior management selects the vendor based on the results of the vendor risk assessment and other criteria. ERP data mapping is approved by the enterprise architect afterthe vendor risk assessment confirms that the vendor's data is compatible and consistent with the ERP system.
Procurement provides the terms of the contract after the vendor risk assessment validates that the vendor meets the organizational standards and obligations. References := Guide to Vendor Risk Assessment, 10 Risk Assessment Factors for ERP System Integration Projects, Ensuring Vendor Compliance and Third-Party Risk Mitigation