The Open Group OGEA-101 - TOGAF Enterprise Architecture Part 1 Exam (English)

The correct answer is Risk Management because risk assessment and risk analysis are core parts of the risk management process. In TOGAF, risk management is used to support architectural and implementation decision-making by identifying risks, evaluating their likelihood and impact, and determining appropriate responses. This allows stakeholders and architects to make informed choices about architecture options, transition paths, implementation timing, and governance actions.

Risk assessment focuses on understanding the nature of identified risks and estimating their significance. Risk analysis examines those risks in more detail to determine consequences, priorities, and possible treatments. These activities are not stand-alone disciplines in TOGAF; they are applied as part of Risk Management, which provides the structured method for using risk information in decisions.

The other options are related but not as precise. Information Security Management focuses on managing security controls and policies. Security Governance is concerned with oversight and accountability. Security Architecture defines structural security capabilities and controls. While all may use risk-related information, the direct application of risk assessment and risk analysis in decision-making belongs to Risk Management. Therefore, according to TOGAF terminology and governance practice, the best answer is C.

===========

The TOGAF standard divides Enterprise Architecture into four primary architecture domains: business, data, application, and technology. These domains represent different aspects of an enterprise and how they relate to each other. The business domain defines the business strategy, governance, organization, and key business processes. The data domain describes the structure of the logical and physical data assets and data management resources. The application domain provides a blueprint for the individual applications to be deployed, their interactions, and their relationships to the core business processes. The technology domain describes the logical software and hardware capabilities that are required to support the deployment of business, data, and application services. Other domains, such as motivation, security, or governance, may span across these four primary domains. References:

The TOGAF Standard, Version 9.2 - Core Concepts

Domains - The Open Group

TOGAF® Standard — Introduction - Definitions - The Open Group

The TOGAF Standard, Version 9.2 - Definitions - The Open Group

TOGAF and the history of enterprise architecture | Enable Architect

This statement best supports the need to govern Enterprise Architecture. Best practice governance enables the organization to control value realization by ensuring that architectures are aligned with the enterprise’s strategy and objectives, meet the quality and performance requirements, and deliver the expected benefits and outcomes. The Architecture Project does not mandate the governance of the target architecture, but rather follows the governance framework established by the enterprise. The TOGAF standard can be used without executive governance, but it is recommended that executive sponsorship and support are obtained for successful architecture development and transition. The Stakeholders preferences may go beyond the architecture project scope and need control, but this is not the primary reason for governing Enterprise Architecture. Reference: The TOGAF® Standard | The Open Group Website, Section 3.3.6 Architecture Governance.

When considering agile development, Architecture to Support Portfolio will identify the necessary products for the enterprise, define their boundaries, and outline the constraints for a product owner. This process directly relates to defining the enterprise ' s backlog, which in agile methodologies, is a prioritized list of work for the development team that is derived from the roadmap and its requirements.

Within the TOGAF framework, assessments are used to ensure that architecture work is conformant with governance parameters. A compliance assessment (sometimes called architecture compliance or compliance review) is the evaluation of a project’s architectural artifacts—its design, architecture decisions, progress status—against the established architecture standards, principles, and constraints. The content of a compliance assessment typically includes reviewing the project status, the architectural design alignment, and identifying noncompliance issues or deviations. Because it focuses on how well the project matches the architecture, rather than on capabilities, organizational structure, or risk per se, the described contents correspond to a compliance assessment. The compliance assessment helps governance bodies enforce architectural consistency and correct deviations during implementation.

In TOGAF, Architecture Governance is concerned with establishing and operating the structures, processes, and controls that ensure architecture is properly managed and complied with across the enterprise. A central part of this practice is the implementation of controls over the creation and evolution of architectural components. This means governance is not only about defining architecture, but also about ensuring that architecture work products, building blocks, standards, and implementation activities are developed in a controlled and consistent way.

Option B is therefore the best answer because it reflects the core governance function of directing and controlling architecture-related work. Governance in TOGAF includes oversight, compliance assessment, decision rights, dispensations, and monitoring conformance to approved architectures and standards.

Option A may occur in leadership engagement, but it is not the clearest definition of architecture governance practice itself. Option C is incorrect because the Statement of Architecture Work is produced and maintained as part of ADM execution, especially early-phase planning, not as a defining governance practice throughout the full cycle. Option D relates more to stakeholder management and requirements management, which are important architecture activities, but they are not the best direct description of architecture governance.

Therefore, the correct answer is B.