thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

Business Case

Documented justification for an investment, describing benefits, costs, risks, and alignment with objectives.

Definition

A business case explains why a project or control should be funded, quantifying expected benefits and costs, alternatives considered, risks, and how success will be measured. In governance it is the basis for portfolio decisions and should be revisited at key milestones. Security business cases often use risk reduction (for example reduced ALE) as the benefit.

Example

A proposal shows that a $200,000 EDR investment reduces ALE by $600,000 per year.

Exam tip

CGEIT and CISA expect the business case to be updated throughout the project life cycle, not only at approval.

Related terms