CGEIT · Question #124
An enterprise is evaluating a Software as a Service (SaaS) solution to support a core business process. There is no outsourcing governance or vendor management in place. What should be the CEO's…
The correct answer is A. Ensure the roles and responsibilities to manage service providers are defined. When adopting SaaS without existing governance, the CEO's first step must be to define who is responsible for managing service providers to establish a foundational framework for oversight.
Question
An enterprise is evaluating a Software as a Service (SaaS) solution to support a core business process. There is no outsourcing governance or vendor management in place. What should be the CEO's FIRST course of action?
Options
- AEnsure the roles and responsibilities to manage service providers are defined.
- BEstablish a contract with the SaaS solution provider.
- CInstruct management to use the standard procurement process.
- DEnsure the service level agreements (SLAs) for service providers are defined
How the community answered
(27 responses)- A74% (20)
- B7% (2)
- C15% (4)
- D4% (1)
Why each option
When adopting SaaS without existing governance, the CEO's first step must be to define who is responsible for managing service providers to establish a foundational framework for oversight.
Before engaging with a SaaS provider, establishing clear roles and responsibilities for managing service providers creates the essential organizational structure for effective governance and vendor management. This foundational step ensures accountability and a clear chain of command for managing the relationship, risks, and performance of the outsourced service.
Establishing a contract is a crucial part of the engagement process, but it should be done within an established governance framework, not before defining who will manage that contract.
Instructing management to use a standard procurement process is insufficient if no outsourcing-specific governance or vendor management framework exists, as SaaS procurements often have unique considerations beyond typical purchasing.
Defining SLAs is a critical component of a contract and vendor management, but it logically follows the establishment of roles and responsibilities for who will define, negotiate, and monitor those SLAs.
Concept tested: IT outsourcing governance framework establishment
Source: https://www.isaca.org/resources/cobit/cobit-2019-framework-introduction-and-methodology/chapter-3/enabling-principles-for-governance-and-management
Topics
Community Discussion
No community discussion yet for this question.