IT governance is a formal framework that provides a structure for organizations to ensure that IT investments support business objectives. IT governance helps align IT and business strategies, manage IT risks and benefits, and deliver value to key stakeholders. One of the main objectives of IT governance is to balance the demand for information and the ability to deliver it in an effective and efficient manner. References := CGEIT Review Manual 2023, Chapter 1: Framework for the Governance of Enterprise IT, page 8 CGEIT Review Questions, Answers & Explanations Manual 2023, Question 277, page 65

The best long-term solution to address the concern regarding loss of experienced staff is to implement knowledge management practices, because knowledge management is the process of creating, sharing, using, and managing the knowledge and information of an organization1. Knowledge management practices can help capture, document, and transfer the valuable knowledge and expertise of the experienced staff before they leave the organization, as well as facilitate the learning and development of the new or existing staff. Knowledge management practices can also enhance the organizational performance, innovation, and competitiveness by leveraging the intellectual capital and creating a culture of knowledge sharing2. According to a study by 3, the impact of knowledge management practices on employee retention is significant and positive in both IT and banking industries. Another study by 4 found that knowledge management practices can improve job satisfaction and employee retention by fostering a supportive work environment, providing growth opportunities, and rewarding knowledge contributions. Therefore, implementing knowledge management practices can help mitigate the risk of losing experienced staff and their knowledge in the long run.
The other options are not the best long-term solutions, because they are either short-term or partial solutions.
Establishing a mentoring program for IT staff can help transfer some of the knowledge and skills of the experienced staff to the mentees, but it may not be sufficient or systematic enough to capture and preserve all the relevant knowledge. Determining key risk indicators (KRIs) can help monitor and measure the risk exposure of losing experienced staff, but it does not address the root cause or provide a solution for the problem. Retaining key staff as consultants can help retain some of the expertise and experience of the staff, but it may not be feasible or cost-effective in the long term, and it may also create dependency and vulnerability issues for the organization.

The main goal of the IT strategy committee after establishing stakeholder desired outcomes should be to ensure IT risk alignment with enterprise risk. IT risk alignment means that the IT risk management program is consistent and integrated with the enterprise risk management (ERM) program, and that the IT risks are identified, assessed, and treated in relation to the enterprise's objectives, strategies, and risk appetite. IT risk alignment can help the enterprise achieve the following benefits1:
Enhance the value delivery of IT to the business
Improve the decision making and prioritization of IT investments and initiatives Reduce the likelihood and impact of IT-related incidents and losses Increase the resilience and agility of IT in responding to changes and disruptions Strengthen the governance and accountability of IT performance and compliance To ensure IT risk alignment with enterprise risk, the IT strategy committee should perform the following tasks2:
Define the scope, objectives, and criteria for IT risk management
Establish the roles and responsibilities for IT risk management
Align the IT risk management framework and processes with the ERM framework and processes Communicate and collaborate with the ERM function and other stakeholders on IT risk issues Monitor and review the effectiveness and maturity of IT risk management The other options are not the main goal of the IT strategy committee after establishing stakeholder desired outcomes. Identifying business data that requires protection, performing a risk analysis on key IT processes, and implementing controls to address high risk areas are steps that are part of the IT risk management process, but they are not specific to ensuring IT risk alignment with enterprise risk. These steps should be done by the IT risk management function or team, under the guidance and oversight of the IT strategy committee.

Transparency is primarily achieved through performance measurement, as it involves providing clear, accurate, and timely information about the performance of IT processes, services, and projects to the relevant stakeholders. Performance measurement can help to increase the visibility, accountability, and trustworthiness of IT activities and outcomes, and to enable informed decision-making and feedback. The other options are not as primary, as they are more related to the results or consequences of performance measurement, rather than the purpose or intention of it. References: : CGEIT Review Manual (Digital Version), Chapter 3: Benefits Realization, Section 3.3: Performance Measurement and Reporting, Subsection 3.3.1: Performance Measurement and Reporting Overview, Page 112 : CGEIT Review Manual (Digital Version), Chapter 3:
Benefits Realization, Section 3.3: Performance Measurement and Reporting, Subsection 3.3.2: Performance Measurement and Reporting Process, Page 113 : Performance Measurement Metrics for IT Governance1

According to the CGEIT exam guide, a root cause analysis (RCA) is a systematic process of identifying and analyzing the factors that cause an undesirable event or condition. It helps to determine the underlying causes of problems and issues, and to prevent their recurrence. A root cause analysis is the best way to enable the CIO to build a corrective action plan, as it provides a clear understanding of the reasons why IT service levels consistently fall below those outlined in the SLA, and suggests possible solutions and improvements. The other options are not sufficient to build a corrective action plan, as they do not address the root causes of the SLA failure. References: CGEIT Exam Candidate Guide, page 15. CGEIT Certification, Root Cause Analysis