Section: Volume B

Portfolio management is the most useful technique for prioritizing IT improvement initiatives to achieve desired business outcomes. Portfolio management is the process of selecting, prioritizing, balancing, and monitoring the IT investments and initiatives that support the enterprise's strategic objectives and deliver value to the stakeholders1. Portfolio management helps to align IT with business goals, optimize resource allocation, manage risks and dependencies, and measure performance and benefits1. By applying portfolio management, an enterprise can ensure that the IT improvement initiatives are consistent with its vision, mission, values, and priorities, and that they contribute to the desired business outcomes1. References: CGEIT Review Manual (Digital Version) or CGEIT Review Manual (Print Version), Chapter 3: Benefits Realization, Section 3.1: IT Portfolio Management, Page 83-84. What is IT portfolio management? A framework for aligning technology and business.

The PRIMARY purpose of an effective set of key risk indicators (KRIs) is to identify possible future adverse impacts on the enterprise. KRIs are metrics or indicators used by organizations to identify, assess, and monitor potential risks. KRIs show how risky a decision, activity, strategy, or plan may be for a business or company.
KRIs can be used to monitor operational, technological, financial and staff processes, such as security breaches, economic downturn and staff turnover rate. KRIs are like alarms that alert businesses of changes in the level of risk exposure1. By identifying possible future adverse impacts on the enterprise, KRIs can help to:
Prevent or mitigate the negative consequences of risks, such as financial loss, operational disruption, reputational damage, legal liability, etc.
Enhance the decision-making and planning processes by providing relevant and timely information on risks Align the risk management activities with the business objectives and expectations Communicate and report the risk status and performance to stakeholders and regulators Therefore, identifying possible future adverse impacts on the enterprise is the primary purpose of an effective set of KRIs.
1: Key Risk Indicators: Examples & Definitions - SolveXia