Communication and Awareness Strategy in Governance of Enterprise IT (CGEIT): Complete Guide and Exam Tips
Introduction
Within the CGEIT domain Governance of Enterprise IT, the Communication and Awareness Strategy is the mechanism that carries governance intent from the board and executive leadership to every stakeholder who must understand it, accept it and act on it. A governance framework can be well designed, yet if nobody knows about it, understands it or believes in it, it will fail. CGEIT treats communication as a core governance enabler, not an administrative afterthought.
What Is a Communication and Awareness Strategy?
A Communication and Awareness Strategy is a planned, structured and continuous approach to:
• Inform stakeholders about the IT governance framework, its objectives, principles, policies, roles and decision rights.
• Educate them about their responsibilities and the expected behaviors.
• Engage them so they buy in, give feedback and take ownership.
• Reinforce the messages over time so governance becomes part of the culture.
It is broader than issuing memos. It includes stakeholder analysis, message design, channel selection, timing, feedback loops and measuring effectiveness. In COBIT terms, it relates closely to EDM01 (Ensure Governance Framework Setting and Maintenance), EDM05 (Ensure Stakeholder Engagement), APO01 (Managed I&T Management Framework) and the enablers of Culture, Ethics and Behavior and Information. COBIT 2019 also lists communication among the components of a governance system and stresses stakeholder transparency.
Why Is It Important?
1. Drives adoption of governance: Policies, principles and decision rights only work when people know and follow them.
2. Builds stakeholder buy-in: Board members, executives, business unit leaders, IT staff and external parties must see the value of governance, not just the rules.
3. Enables cultural change: IT governance often demands new behaviors, such as business ownership of IT investments, risk awareness and accountability. Communication is the main lever for that change.
4. Supports transparency and accountability: Regular reporting on IT performance, risk and value builds trust with the board and regulators.
5. Reduces resistance: Explaining the why lowers fear and opposition, especially during governance implementations or reorganizations.
6. Aligns business and IT: A shared language and understanding of strategy closes the business and IT gap, which is central to strategic alignment.
7. Supports compliance: Awareness of policies, laws and regulations lowers the chance of breaches and penalties.
8. Sustains governance: Continuous reinforcement keeps governance from fading after the initial launch.
Key Components of the Strategy
1. Clear objectives: What must stakeholders know, feel and do? Objectives must link to governance and business goals.
2. Stakeholder analysis: Identify all stakeholders (board, executive committee, IT steering committee, business owners, IT management, end users, auditors, regulators, vendors, customers). Map them by influence, interest and impact, for example with a power/interest grid or a RACI.
3. Tailored key messages: The board needs value, risk and strategic alignment. Operational staff need practical procedures. Technical staff need standards and architecture direction. Messages must be consistent in substance but adapted in detail and language.
4. Channels and media: Board briefings, executive dashboards, steering committee meetings, intranet portals, newsletters, town halls, workshops, e-learning, onboarding programs, policy acknowledgments, posters and campaigns.
5. Senders and sponsorship: Messages carry more weight when delivered by the right people. Executive sponsorship, the tone at the top, is critical. The CEO or board chair endorsing governance shows it is a business priority, not just an IT initiative.
6. Timing and frequency: A communication calendar aligned with governance milestones, budget cycles, policy updates and project phases.
7. Two-way feedback: Surveys, focus groups, Q&A sessions and suggestion channels so stakeholders can raise concerns and the framework can improve.
8. Measurement: KPIs such as awareness survey scores, training completion rates, policy attestation rates, fewer policy violations, stakeholder satisfaction and audit findings.
9. Continuous improvement: Review and refine the strategy based on feedback, metrics and changes in the business or regulatory environment.
How It Works: The Lifecycle
Step 1: Assess the current state. Find out what stakeholders already understand, where misconceptions exist and how ready the culture is.
Step 2: Define objectives and scope. Link communication goals to governance objectives, such as raising understanding of IT investment decision rights.
Step 3: Analyze stakeholders. Segment audiences and record their information needs, concerns and preferred channels.
Step 4: Develop messages. Write core messages and audience-specific variants. Focus on benefits and the reasons for change.
Step 5: Select channels and plan. Build a communication plan stating who, what, when, how and by whom.
Step 6: Secure sponsorship. Get visible commitment from the board and senior executives.
Step 7: Execute. Deliver communications and awareness programs, including training and onboarding.
Step 8: Gather feedback and measure. Use metrics and feedback to check whether messages were received, understood and acted upon.
Step 9: Reinforce and adapt. Keep communication going, recognize good behaviors and update content when the framework changes.
Relationship to Other Governance Areas
• Governance framework implementation: Communication is a critical success factor in rolling out a framework.
• Organizational change enablement: Communication sits at the heart of change management models (for example Kotter's 'communicate the vision'), and COBIT's implementation lifecycle has a change enablement stream.
• Risk management: Risk awareness programs build a risk-aware culture and help communicate risk appetite.
• Benefits realization: Reporting value delivered to stakeholders sustains support for IT investments.
• Performance measurement: Balanced scorecards and dashboards are communication tools for governance reporting.
• Information security: Security awareness training is a specialized awareness program within the wider strategy.
Common Challenges
• Lack of executive sponsorship, so governance is seen as an IT-only effort.
• One-size-fits-all messaging that fails to resonate.
• Too much jargon, especially technical IT language aimed at business leaders.
• One-time launch communication with no follow-up.
• No feedback mechanism, which leads to false assumptions about understanding.
• Information overload and stakeholder fatigue.
• Inconsistent messages from different leaders.
• No measurement of effectiveness.
Best Practices
• Start with the why: link governance to business value and strategy.
• Get the board and executive team to champion the message.
• Use business language and avoid technical jargon with non-IT audiences.
• Tailor content and channels to each stakeholder group.
• Embed awareness in onboarding, performance management and routine processes.
• Make communication two-way and act visibly on feedback.
• Measure outcomes such as behavior change, not just activities such as emails sent.
• Keep communicating consistently and repeatedly.
Exam Tips: Answering Questions on Communication and Awareness Strategy
1. Think like the board or a senior governance advisor. CGEIT is a governance-level exam. The correct answer usually reflects a strategic, enterprise-wide view rather than a tactical or technical fix.
2. Executive sponsorship often wins. If a question asks for the most important factor or first step in successfully communicating governance, look for options about senior management or board support and the tone at the top.
3. Stakeholder analysis comes before messaging. When asked what to do FIRST in building a communication strategy, the answer is usually to identify and analyze stakeholders and their needs, not to pick channels or send messages.
4. Tailoring beats uniformity. Answers proposing the same message for everyone are usually wrong. Prefer answers that tailor content to each audience's role and needs.
5. Business language for business stakeholders. For the board or executives, the correct answer focuses on value, risk, alignment and performance in business terms, not technical metrics.
6. Two-way beats one-way. Options that include feedback, engagement or dialogue are usually stronger than those that only broadcast.
7. Measure effectiveness by outcomes. If asked how to judge an awareness program, prefer measures of understanding or behavior change (survey results, fewer violations, compliance rates) over activity counts such as the number of newsletters sent.
8. Sustainability matters. Awareness is an ongoing effort, not a one-time event. Answers that show continuous reinforcement are favored.
9. Link to culture and change. When a question describes resistance to governance or poor adoption, the root cause is often weak communication, unclear roles or no buy-in. The fix is usually a structured communication or change enablement approach, not tighter enforcement alone.
10. Watch for the word 'BEST'. Several answers may be valid. Pick the most comprehensive, strategic and governance-oriented one.
11. Root cause over symptom. If a scenario shows policies being ignored, consider whether the problem is awareness (people do not know) rather than compliance (people know but choose not to comply). Awareness gaps call for communication and training.
12. Know COBIT links. Connect stakeholder engagement and transparency to EDM05, framework communication to EDM01 and APO01, and awareness to the Culture, Ethics and Behavior component.
Sample Question Approach
Question: An enterprise has implemented a new IT governance framework, but business units continue to bypass the IT investment approval process. What should the CGEIT professional recommend FIRST?
A. Impose penalties on noncompliant business units
B. Assess stakeholder awareness and understanding of the framework and its benefits
C. Replace the framework with a simpler one
D. Have IT approve all purchases centrally
Best answer: B. Before enforcing or redesigning, find out whether the problem is a lack of awareness or understanding. That finding informs a targeted communication strategy. Penalties (A) treat a symptom, while C and D are premature and may harm business alignment.
Key Takeaways
• Communication and awareness are essential for embedding IT governance in the enterprise.
• The strategy must be planned, stakeholder-driven, tailored, two-way, sponsored by executives, measured and continuous.
• In exams, favor answers that reflect a governance-level perspective, executive sponsorship, stakeholder analysis first, business language, feedback and outcome-based measurement.
