nerdexam
Isaca

CGEIT · Question #124

An enterprise is evaluating a Software as a Service (SaaS) solution to support a core business process. There is no outsourcing governance or vendor management in place. What should be the CEO's…

The correct answer is A. Ensure the roles and responsibilities to manage service providers are defined. When adopting SaaS without existing governance, the CEO's first step must be to define who is responsible for managing service providers to establish a foundational framework for oversight.

Submitted by manish99· Apr 18, 2026Governance of Enterprise IT

Question

An enterprise is evaluating a Software as a Service (SaaS) solution to support a core business process. There is no outsourcing governance or vendor management in place. What should be the CEO's FIRST course of action?

Options

  • AEnsure the roles and responsibilities to manage service providers are defined.
  • BEstablish a contract with the SaaS solution provider.
  • CInstruct management to use the standard procurement process.
  • DEnsure the service level agreements (SLAs) for service providers are defined

How the community answered

(27 responses)
  • A
    74% (20)
  • B
    7% (2)
  • C
    15% (4)
  • D
    4% (1)

Why each option

When adopting SaaS without existing governance, the CEO's first step must be to define who is responsible for managing service providers to establish a foundational framework for oversight.

AEnsure the roles and responsibilities to manage service providers are defined.Correct

Before engaging with a SaaS provider, establishing clear roles and responsibilities for managing service providers creates the essential organizational structure for effective governance and vendor management. This foundational step ensures accountability and a clear chain of command for managing the relationship, risks, and performance of the outsourced service.

BEstablish a contract with the SaaS solution provider.

Establishing a contract is a crucial part of the engagement process, but it should be done within an established governance framework, not before defining who will manage that contract.

CInstruct management to use the standard procurement process.

Instructing management to use a standard procurement process is insufficient if no outsourcing-specific governance or vendor management framework exists, as SaaS procurements often have unique considerations beyond typical purchasing.

DEnsure the service level agreements (SLAs) for service providers are defined

Defining SLAs is a critical component of a contract and vendor management, but it logically follows the establishment of roles and responsibilities for who will define, negotiate, and monitor those SLAs.

Concept tested: IT outsourcing governance framework establishment

Source: https://www.isaca.org/resources/cobit/cobit-2019-framework-introduction-and-methodology/chapter-3/enabling-principles-for-governance-and-management

Topics

#Outsourcing governance#Vendor management#Roles and responsibilities#IT governance framework

Community Discussion

No community discussion yet for this question.

Full CGEIT Practice