Strategic Planning Process

Strategic Planning Process in CGEIT: Governance of Enterprise IT (Complete Guide)

Introduction
The Strategic Planning Process is a core topic in Domain 1 of the ISACA CGEIT (Certified in the Governance of Enterprise IT) certification, Governance of Enterprise IT. It explains how an enterprise turns its vision and business goals into a coordinated IT strategy. That strategy guides investment, sets priorities and creates value while keeping risk and resources under control. A CGEIT candidate must understand both what the process is and how a governance professional oversees and evaluates it.

Why the Strategic Planning Process Is Important
1. Business-IT alignment: The main purpose of IT strategic planning is to make sure IT supports and enables enterprise objectives. Without a formal process, IT tends to chase technology trends or departmental wish lists instead of enterprise priorities.
2. Value delivery: A structured plan helps the enterprise select and fund the initiatives that deliver the greatest business benefit. This reduces wasted spend and failed projects.
3. Risk optimization: Strategic planning brings IT-related risk into the decision-making process early. The enterprise then avoids strategies that exceed its risk appetite.
4. Resource optimization: People, money, applications, information and infrastructure are limited. Planning allocates them to the highest-value areas.
5. Accountability and transparency: A documented strategy approved by the board or executive management creates clear ownership, measurable targets and a basis for performance monitoring.
6. Stakeholder confidence: Boards, regulators, investors and customers expect technology investments to be deliberate, justified and governed.
7. Agility and resilience: A strategy that is reviewed periodically lets the enterprise respond to market changes, disruptive technologies and regulatory shifts in a controlled way.

What the Strategic Planning Process Is
The strategic planning process is a structured, repeatable, business-driven cycle. It defines where the enterprise wants IT to be (the target state) and how it will get there (the roadmap). It operates at several levels:

Enterprise strategy: the mission, vision, values and long-term business objectives set by the board and executive management.
IT strategy (IT strategic plan): the long-term direction for IT, typically 3 to 5 years, derived from the enterprise strategy.
IT tactical plans: medium-term plans, usually 1 to 2 years, that break the strategy into programs and projects.
Operational plans: short-term plans, typically annual, covering day-to-day delivery, budgets and service levels.

Key governance bodies involved:
Board of directors: sets direction, approves strategy and is ultimately accountable for the governance of enterprise IT.
IT strategy committee: a board-level committee that advises the board on strategic IT issues, alignment and value.
IT steering committee: an executive-level committee that prioritizes investments, oversees programs and resolves resource conflicts.
Executive management (CEO, CIO, CFO and business unit heads): develop, execute and are responsible for the strategy.
Enterprise architecture function: defines the target architecture and keeps it consistent with strategy.
Portfolio management office: manages the investment portfolio in line with strategic priorities.

How the Strategic Planning Process Works
Step 1: Understand the enterprise strategy and drivers
The process begins with the business, not with technology. Planners review:

• the enterprise mission, vision and goals;
• stakeholder needs;
• regulatory requirements;
• competitive pressures;
• internal and external drivers.

COBIT's goals cascade is a well-known tool here. Stakeholder drivers lead to stakeholder needs, which lead to enterprise goals, then alignment goals (IT-related goals), and finally governance and management objectives.

Step 2: Assess the current state
Planners evaluate current IT capabilities, which may include:

• a maturity assessment;
• a capability assessment;
• architecture reviews;
• portfolio analysis;
• performance results;
• risk assessments;
• skills and resources;
• audit findings.

Common analytical tools include SWOT, PESTLE and benchmarking.

Step 3: Define the target (future) state
Based on enterprise goals, planners define the desired IT capabilities, target architecture, service model, sourcing approach and maturity targets.

Step 4: Perform gap analysis
The differences between the current and target states are identified. These gaps become candidate initiatives.

Step 5: Identify, evaluate and prioritize initiatives
Initiatives are assessed using business cases, which cover expected value, cost, risk, strategic fit, dependencies and resource needs. Portfolio management techniques rank them, and the IT steering committee typically recommends priorities. Value management frameworks such as Val IT principles support this step.

Step 6: Develop the strategic roadmap
The roadmap sequences prioritized programs and projects over time. It shows dependencies, milestones, funding and expected benefits.

Step 7: Obtain approval and communicate
The board or executive management approves the strategy. It is then communicated throughout the enterprise so that everyone understands the direction and their role in it.

Step 8: Execute through tactical and operational plans
The strategy is translated into budgets, projects, service plans and policies.

Step 9: Monitor, measure and report
Performance is tracked using KPIs, KGIs and tools such as the IT Balanced Scorecard. The scorecard's perspectives are:

• corporate contribution;
• stakeholder or customer orientation;
• operational excellence;
• future orientation.

Results are reported to the board and committees.

Step 10: Review and update periodically
The strategy is reviewed regularly, at least annually, and whenever major business changes occur. This keeps it relevant. The process is a continuous cycle, not a one-time event.

Key Inputs and Outputs
Inputs:

• enterprise strategy;
• stakeholder requirements;
• risk appetite;
• regulatory obligations;
• current state assessment;
• technology trends;
• financial constraints.

Outputs:

• IT strategic plan;
• target architecture;
• investment portfolio;
• roadmap;
• performance metrics;
• communication plan.

Supporting Frameworks and Concepts
COBIT 2019: EDM01 (Ensured Governance Framework Setting and Maintenance), EDM02 (Ensured Benefits Delivery), APO02 (Managed Strategy), APO03 (Managed Enterprise Architecture) and APO05 (Managed Portfolio).
Goals cascade: links stakeholder needs to IT goals and enablers.
Balanced Scorecard: measures strategic performance.
Enterprise architecture frameworks (for example, TOGAF): translate strategy into architecture.
Business case and benefits realization: justify and track value.

Common Challenges

• IT strategy developed in isolation from the business;
• lack of executive sponsorship;
• strategy too technical or too vague;
• no measurable outcomes;
• failure to update the strategy;
• poor communication;
• unrealistic resource assumptions;
• ignoring risk and culture.

Exam Tips: Answering Questions on Strategic Planning Process
1. Business first, always: When asked what should happen FIRST, the answer is usually to understand the enterprise strategy, business objectives or stakeholder needs. Technology choices come later.
2. Think like a governance professional, not a technician: CGEIT answers favor oversight, alignment, value, risk and accountability over technical implementation details.
3. Know the roles: The board is accountable and approves strategy. Executive management is responsible for developing and executing it. The IT strategy committee advises the board. The IT steering committee prioritizes and oversees investments and projects. Watch for answer choices that confuse these bodies.
4. Alignment is the primary objective: If a question asks for the MOST important outcome or goal of IT strategic planning, strategic alignment with business goals is often correct. Value delivery is a close second.
5. Look for the root cause: If a strategy is failing, the best answer often points to a lack of business involvement, executive sponsorship or alignment. Poor project execution is usually a symptom.
6. Business cases and portfolio management: Investments should be justified with business cases and prioritized at portfolio level according to strategic contribution, not by who requests them or by cost alone.
7. Measurement matters: Choose answers that include measurable objectives, KPIs and the Balanced Scorecard for monitoring. A strategy without metrics cannot be governed.
8. Continuous process: Prefer answers describing periodic review and adjustment over static, one-time plans.
9. Watch qualifier words: FIRST, BEST, MOST important, PRIMARY and GREATEST concern change the answer. Read each option against the qualifier.
10. Eliminate extreme or narrow options: Answers that focus on a single technology, a single department or immediate cost cutting are usually wrong for strategic questions.
11. Risk appetite integration: Strategies should consider enterprise risk appetite. Ignoring risk in strategic decisions is a red flag in scenarios.
12. Communication and buy-in: A strategy that is approved but not communicated is a common scenario weakness. Select answers that ensure stakeholder understanding and commitment.
13. Scenario approach: For scenario questions, (a) identify the governance issue, (b) determine who should act, (c) choose the action that best restores alignment, value or risk balance at the enterprise level.

Sample Question
An organization is developing a new IT strategic plan. Which of the following should be done FIRST?
A. Evaluate emerging technologies
B. Review the enterprise business strategy and objectives
C. Develop project budgets
D. Assess vendor capabilities
Answer: B. The IT strategy must derive from the business strategy. All other activities come later.

Summary
The Strategic Planning Process ensures that IT is directed by and aligned with enterprise goals. It is the foundation for value delivery, risk and resource optimization, and performance measurement. It is a continuous cycle that runs from understanding business drivers through gap analysis, prioritization, roadmap development, approval, execution, monitoring and review. In the exam, consistently choose answers that put the business first, ensure board-level accountability, use structured prioritization and measurement, and keep the strategy current.