Consistent application of IT standards across the enterprise is best achieved through a well-defined enterprise architecture (EA), which provides a blueprint for IT processes, technologies, and standards. The CGEIT Review Manual 8th Edition emphasizes that EA practices ensure standardization and alignment with enterprise objectives.
* Extract from CGEIT Review Manual 8th Edition (Domain 1: Governance of Enterprise IT):"Enterprise architecture provides a structured approach to defining and enforcing IT standards across the organization. By establishing common frameworks, policies, and guidelines, EA ensures consistency in the application of IT standards, reducing variability and enhancing interoperability." (Approximate reference: Domain 1, Section on Enterprise Architecture) Established enterprise architecture practices (option D) provide a governance mechanism to enforce IT standards, ensuring that all IT initiatives adhere to predefined guidelines, thus promoting consistency.
* Why not the other options?
* A. Enterprise risk management (ERM) reviews: ERM focuses on identifying and mitigating risks, not on enforcing IT standards.
* B. Mandatory systems development training: Training may improve skills but does not directly ensure consistent application of standards across the enterprise.
* C. Business case reviews by the steering committee: Business case reviews focus on project approval and alignment, not on enforcing technical standards.
References:
ISACA CGEIT Review Manual 8th Edition, Domain 1: Governance of Enterprise IT, Section on Enterprise Architecture and Standards.
ISACA CGEIT Study Guide, Chapter on Governance and EA.

Process owners are responsible for ensuring the regular review of quality management performance against defined quality metrics, as they are accountable for the design, implementation and improvement of the processes they own. Risk management team, internal auditors and executive management have other roles and responsibilities in relation to quality management, such as providing assurance, oversight and direction. References: : CGEIT Review Manual (Digital Version), Chapter 3: Benefits Realization, Section
3.2: IT Investment Management, Subsection 3.2.4: IT Investment Management Process, Page 104 : CGEIT Review Manual (Digital Version), Chapter 3: Benefits Realization, Section 3.4: Quality Management, Subsection 3.4.1: Quality Management Overview, Page 120

IT goals and objectives are the desired outcomes and targets that IT aims to achieve in support of the business strategy and objectives. IT goals and objectives should be defined first before establishing IT key risk indicators (KRIs), because they provide the direction and scope for the IT risk management process. KRIs are metrics that measure and monitor the level and trend of risk exposure, and help to identify and manage potential threats or opportunities that could affect the achievement of IT goals and objectives1. Therefore, by defining IT goals and objectives first, an enterprise can ensure that its KRIs are relevant, aligned, and consistent with its IT strategy and value delivery2. References := Key Risk Indicators (KRIs) - ISACA, Integrating KRIs and KPIs for Effective Technology Risk Management - ISACA.

The risk profile of the enterprise is the most important thing to consider first when conducting a risk assessment in support of a new regulatory requirement, as it reflects the overall exposure and tolerance of the enterprise to various types of risks, such as strategic, operational, financial, or compliance risks. The risk profile of the enterprise can help determine the scope, objectives, and criteria of the risk assessment, as well as the prioritization and allocation of resources and efforts for risk identification, analysis, evaluation, and treatment. The risk profile of the enterprise can also help align the risk assessment with the enterprise's strategy, goals, and values, as well as ensure consistency and integration with other risk management activities or processes.
Disruption to normal business operations, readiness of IT systems to address the risk, and cost burden to achieve compliance are also important things to consider when conducting a risk assessment in support of a new regulatory requirement, but they are not the first thing to consider. Disruption to normal business operations is a potential consequence or impact of the risk on the enterprise's performance, productivity, or continuity. Disruption to normal business operations can be assessed and measured during the risk analysis or evaluation stage of the risk assessment, as well as mitigated or reduced during the risk treatment or response stage. Readiness of IT systems to address the risk is a factor that affects the capability or maturity of the enterprise's IT infrastructure, applications, or services to comply with or support the new regulatory requirement. Readiness of IT systems to address the risk can be assessed and improved during the risk treatment or response stage of the risk assessment, as well as monitored and reported during the risk communication or review stage. Cost burden to achieve compliance is a factor that affects the feasibility or affordability of the enterprise's actions or investments to comply with or support the new regulatory requirement. Cost burden to achieve compliance can be estimated and optimized during the risk treatment or response stage of the risk assessment, as well as balanced with the benefits or value of compliance.

Given that critical security monitoring was being neglected due to other demands, theIT steering committee's first priority should be to re-prioritize IT projects.This ensures that resources are allocated to security monitoring and risk mitigation, which are essential to enterprise protection.
Assessments and staffing changes may follow, butthe immediate governance action is to adjust prioritiesin light of organizational risk.
Reference:
CGEIT Review Manual: Domain 4 - Risk Optimization
COBIT 2019: APO01 (Manage the IT Management Framework), APO12 (Manage Risk).