問44
頻出度★★★
システム監査人の役割はどれか。
平成21年度 春期 ITパスポート試験 問44
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 44
Incorrectア
Undertaking the operation, monitoring, and maintenance of information systems is the role of system operations staff or an outsourcing provider (an operation service provider). A party that performs the operation itself stands on the audited side (the audited department), and auditing a system that you yourself operate would destroy independence, so this is not the role of a systems auditor.
Incorrectイ
Formulating and executing an IT strategy in line with the management philosophy is the role of the CIO (Chief Information Officer) or the person in charge of information systems strategy. That is the standpoint of a party that moves the organization together with management, which is the exact opposite of the systems auditor, who evaluates from the outside whether such a strategy and its mechanisms are appropriate.
Incorrectウ
Undertaking the construction and introduction of information systems as a whole is the role of a systems integrator (SI vendor) or a vendor contracted to develop the system. The party that actually carries out the development and introduction is likewise on the audited side, not the systems auditor who performs verification and evaluation.
- エ
正解 A systems auditor is a person who, in accordance with the systems audit standards, inspects, evaluates, and verifies an organization's information systems from an objective and professional standpoint that is independent of the audited department, reports the results to management in an audit report, and offers advice and recommendations as needed. Choice エ, “Verifies or evaluates an organization's information systems from an independent, professional standpoint”, states exactly both this independence (you do not audit a system that you yourself built or operate) and verification/evaluation, the essential act of an audit; it is the very definition of the systems auditor's role.
ここがポイント
- The role of a systems auditor is to “inspect, evaluate, and verify information systems from an independent, professional standpoint, and give advice and recommendations”. There are two keywords: independence and objectivity, and the act of verification/evaluation.
- Operations staff (ア), the CIO or IT strategy officer (イ), and systems integrators (ウ) are all parties that build or run information systems, that is, the side being audited. Not confusing the auditing side with the audited side is the key point of this question.
用語