The IT steering committee's primary function is to ensure the alignment of IT with business strategy and to provide oversight of IT-related risk. Migrating services to an external cloud provider fundamentally alters the enterprise's risk landscape. This strategic shift introduces new risks (e.g., vendor viability, data security in a multi-tenant environment, regulatory compliance, exit strategies) and modifies existing ones. Therefore, the committee's foremost concern is to ensure the business risk profile is comprehensively updated to reflect this new operational model. This allows for proper risk assessment, mitigation, and alignment with the enterprise's risk appetite, which is a core governance responsibility.

A. Revising the business balanced scorecard: Revising performance metrics is a consequence of the strategic shift and updated risk profile, not the primary, initial concern for the governance body.

C. Changing the IT steering committee charter: The committee's fundamental purpose and authority do not change; only the IT delivery model they oversee changes. The charter would not typically require revision for this.

D. Calculating the cost of the current solution: This calculation is part of the due diligence and business case development that precedes the strategic decision. The question states the decision has already been made.

1. ISACA

CGEIT Review Manual

8th Edition. Domain 4: Risk Optimization

Task Statement R1

"Ensure that IT risk management is aligned with the enterprise risk management (ERM) framework." The manual emphasizes that a key governance role is to ensure IT-related risks are continuously identified

assessed

and managed. A move to the cloud is a significant event that necessitates a reassessment of the enterprise's risk profile.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives. Governance Objective EDM03: Ensured Risk Optimization. The purpose of this objective is to "Ensure that IT-related enterprise risk does not exceed risk appetite and risk tolerance." Key practices involve evaluating and directing risk management

which requires an up-to-date and accurate understanding of the business risk profile

especially after a major sourcing change.

3. ISACA

COBIT 2019 Framework: Governance and Management Objectives. Management Objective APO12: Managed Risk. This objective details the processes for managing risk

including APO12.02 "Analyze Risk

" which involves identifying the "potential for business impacts" from changes in the IT environment. The IT steering committee would oversee this process to ensure the overall business risk profile is updated and accurate.