問35
頻出度★★★
内部統制が有効に機能していることを継続的に評価するプロセスはどれか。
平成22年度 秋期 ITパスポート試験 問35
マネジメント系システム監査 › 内部統制
This question's explanation and your answers so far.
解説
問 35
Incorrectア
Encryption measures are a technical information security control (one of the control activities) that converts data so that third parties cannot read it, thereby protecting confidentiality; they are a concrete measure taken to reduce risk. They are not a process that continuously evaluates whether internal control itself is functioning effectively, so this choice is wrong.
Incorrectイ
Disaster recovery measures are preparations for restoring and continuing operations when an information system is damaged by an earthquake, a fire, or a similar disaster (part of a BCP, that is, of business continuity). This too is a concrete countermeasure prepared for the occurrence of a failure, not an activity that continuously evaluates the effectiveness of internal control, so this choice is wrong.
Incorrectウ
Benchmarking is a management technique that compares a company’s own products, services, and business processes with those of the best companies in the industry (best practices), analyzes the gap, and uses it to drive improvement. What it compares against is an outstanding example outside the company, and it is not a mechanism for continuously monitoring whether the company’s own internal control is working, so this choice is wrong.
- エ
正解 The correct answer is エ, Monitoring (monitoring activities). Monitoring is the process of continuously evaluating whether internal control is working effectively as intended and correcting it when necessary, and it is positioned as one of the basic elements of internal control. Monitoring includes “ongoing monitoring”, which is built into operations and performed day to day (approval and checking by supervisors, variance analysis between actual results and the budget, and so on), and “separate evaluation”, which is performed periodically from a position independent of the operations (audits by the internal audit department, evaluation by management, and so on). Combining the two makes it possible to find deficiencies in internal control and lead them to improvement. The wording in the question, continuously evaluates whether it is functioning effectively, is exactly the definition of monitoring.
ここがポイント
- There are six basic elements of internal control: control environment, risk assessment and response, control activities, information and communication, monitoring (monitoring activities), and response to IT. Among them, the element responsible for continuously evaluating and correcting the effectiveness of internal control itself is monitoring.
- Monitoring is divided into “ongoing monitoring”, which is built into operations, and “separate evaluation”, which is carried out by parties independent of the operations, such as internal audit. Remember to distinguish individual risk countermeasures such as encryption and disaster recovery (control activities) from monitoring, which evaluates that framework.
用語