Business Case Evaluation and Approval (CGEIT – Benefits Realization)
Introduction
Business Case Evaluation and Approval is a core topic within the Benefits Realization domain of the ISACA Certified in the Governance of Enterprise IT (CGEIT) certification. It covers how an enterprise decides whether an IT-enabled investment should go ahead, continue, be changed or be stopped. The business case is the main tool for that decision. Evaluation and approval are the governance steps that make sure only investments that create value and fit the strategy get funded.
Why It Is Important
IT-enabled investments use a large share of an organization's capital and operating budget. Without a disciplined approach to evaluating and approving business cases, organizations face several problems:
• Wasted resources: projects get funded even though they do not support strategic objectives.
• Benefits that never arrive: expected value is never delivered because no one owns or measures it.
• Poor risk management: risks are not identified, quantified or weighed against the expected return.
• Weak accountability: no business sponsor is answerable for outcomes.
• Portfolio imbalance: money goes to the projects of the loudest stakeholders rather than to the best overall mix.
From a governance view, business case evaluation is how the board and executive management carry out their duty to evaluate, direct and monitor (the EDM model in COBIT). It links enterprise strategy to execution and makes sure IT investments optimize value at an acceptable cost and risk.
ISACA's Val IT framework, now integrated into COBIT, puts the business case at the heart of value governance. It frames the key questions as the Four Ares:
• Are we doing the right things? (strategic question)
• Are we doing them the right way? (architecture question)
• Are we getting them done well? (delivery question)
• Are we getting the benefits? (value question)
What It Is
A business case is a documented, structured justification for an investment. It typically includes:
• Strategic alignment: how the investment supports enterprise goals and objectives.
• Description of the opportunity or problem: why the investment is needed now.
• Options analysis: the alternatives considered, including the do-nothing option.
• Expected benefits: both financial and non-financial, with metrics, owners and timing.
• Full life-cycle costs: capital and operating, including organizational change, training and retirement costs.
• Risks: delivery risk, benefit risk and operational risk, plus how each will be mitigated.
• Assumptions and constraints: the key assumptions the case depends on.
• Financial analysis: NPV, IRR, ROI, payback period and total cost of ownership (TCO).
• Accountabilities: the business sponsor, benefit owners and program manager.
• Benefits realization plan: how and when benefits will be tracked and reported.
Evaluation is the critical, objective review of the business case to judge four things:
• its completeness and accuracy;
• the reasonableness of its assumptions;
• its alignment with strategy;
• its relative value compared with other proposals in the portfolio.
Approval is the formal decision by an authorized governance body to commit resources. It is usually staged, meaning approval is given for one phase at a time.
How It Works
1. Idea or demand intake: Business units submit investment proposals, often as a high-level concept paper first. Ideas are screened at this stage against basic criteria.
2. Business case development: The business sponsor develops the business case, supported by IT, finance and other experts. The sponsor owns the case, not IT. The level of detail should match the size and risk of the investment.
3. Independent review and validation: A neutral party checks that the case is complete, consistent and realistic. This may be a PMO, investment office, finance or internal audit. Benefit claims are challenged, costs are verified and risks are assessed.
4. Evaluation against criteria: The case is scored against predefined, agreed criteria such as:
• strategic fit;
• financial return;
• risk;
• resource availability;
• architectural fit;
• compliance requirements;
• dependencies.
A consistent scoring model allows fair comparison across proposals.
5. Portfolio-level prioritization: The investment is considered within the context of the whole portfolio, not in isolation. A proposal with a positive NPV may still be rejected if better options exist, or if it would push the portfolio's risk past the enterprise's risk appetite.
6. Approval decision: An authorized body makes the decision. This may be an IT strategy committee, an investment review board, an executive committee or the board itself. Delegated authority levels determine who can approve what. The decision may be to approve, reject, defer or request changes.
7. Staged funding (stage gates): Approval is often given for the next phase only. The case is re-evaluated at each gate as new information emerges.
8. Ongoing maintenance of the business case: The business case is a living document. It is updated throughout the investment life cycle and reviewed when significant changes occur in:
• scope;
• cost;
• risk;
• benefits;
• the business environment.
If it is no longer viable, the investment should be changed or terminated.
9. Post-implementation review: After delivery, actual benefits are compared against those in the business case. This confirms that value was realized and provides lessons learned for future cases.
Key Roles
• Board / IT strategy committee: sets direction, risk appetite and investment policy.
• Investment review board / executive committee: evaluates and approves major investments.
• Business sponsor: owns the business case and is accountable for benefits realization.
• Benefit owners: accountable for specific benefits.
• CIO / IT: provides technical, cost and architectural input. IT does not own the business benefits.
• CFO / Finance: validates financial assumptions and analysis.
• PMO / value management office: provides standards, templates and independent review.
Common Pitfalls
• Overstated benefits and understated costs (optimism bias).
• Treating the business case as a one-time hurdle rather than a living document.
• IT owning the business case instead of the business.
• Ignoring non-financial benefits, or the opposite, relying only on intangible claims.
• Failing to include organizational change costs.
• Evaluating projects in isolation rather than as part of a portfolio.
• No clear benefit owners or measurable metrics.
Exam Tips: Answering Questions on Business Case Evaluation and Approval
1. Think like a governance professional, not a project manager.
CGEIT questions favor answers about strategic alignment, value, accountability and oversight. Choose answers that reflect board-level and executive-level responsibilities over technical or operational detail.
2. Strategic alignment usually comes first.
When asked what is MOST important when evaluating a business case, alignment with enterprise strategy is frequently the best answer. Financial metrics alone are not enough.
3. The business owns the business case.
If a question asks who should be accountable for the business case or for benefits realization, choose the business sponsor or business owner. The CIO and IT department are not the answer.
4. Remember the business case is a living document.
Answers that say the business case should be reviewed and updated throughout the life cycle are generally correct. These include stage gates and re-evaluation when circumstances change. Be wary of answers that treat approval as a one-off event.
5. Portfolio view beats individual project view.
Investments should be evaluated relative to other investments and to the enterprise's overall capacity and risk appetite. If an option mentions portfolio management or prioritization against other investments, it is often the stronger choice.
6. Look for independence and objectivity.
Validation by an independent party improves the reliability of the business case. Self-assessment by the requesting party alone is weaker.
7. Include full life-cycle costs and all risks.
Good answers reference total cost of ownership, including operating, change management and retirement costs. They also consider both delivery risk and benefit risk.
8. Benefits must be measurable and owned.
If a question describes benefits not being realized, the root cause is often one of these:
• no clear benefit owner;
• no baseline;
• no measurable KPIs;
• no benefits realization plan.
9. Know when to stop an investment.
If the business case is no longer valid, governance should recommend re-scoping or terminating the investment. Continuing because of sunk costs is not the answer. Sunk costs should not drive decisions.
10. Watch for keywords.
• MOST important / PRIMARY: pick the strategic or value-oriented answer.
• FIRST: often means ensuring alignment or establishing criteria before proceeding.
• BEST: the answer that addresses root cause and governance, not symptoms.
11. Eliminate answers that skip governance.
Options like 'proceed because IT has the budget' or 'approve because the vendor guarantees ROI' bypass proper evaluation. They are usually wrong.
12. Connect to frameworks.
Be familiar with how COBIT (EDM02 Ensure Benefits Delivery, APO05 Managed Portfolio, APO06 Managed Budget and Costs) and Val IT concepts relate to business case management. Questions may use their terminology.
Sample Question Approach
Question: An enterprise has approved several IT investments, but many fail to deliver expected benefits. What should the IT steering committee do FIRST?
Reasoning: Look for the root cause in governance. The best answer is likely to establish a process that requires business cases with clearly defined, measurable benefits and assigned business owners, reviewed at defined stages. Hiring more project managers or buying new tools would not address the root cause.
Summary
Business Case Evaluation and Approval ensures that IT-enabled investments are justified, aligned with strategy, comparable within a portfolio, owned by the business and continuously validated. For the CGEIT exam, consistently favor answers that emphasize:
• strategic alignment;
• business accountability;
• portfolio-level decision making;
• objective evaluation criteria;
• full life-cycle cost and risk consideration;
• treating the business case as a living document that drives benefits realization.
