問36
頻出度★★★
システム監査の流れの中で, 被監査側が実施するものはどれか。
平成22年度 秋期 ITパスポート試験 問36
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 36
Incorrectア
Confirming the improvements is the step called follow-up, in which the systems auditor checks whether the audited side has carried out the business improvements as proposed. The party that does the confirming is the auditor, not the audited side. The audited side is the one being checked.
Incorrectイ
Preparing the audit plan is the starting point of an audit; it is the work in which the systems auditor decides the purpose, scope, timing, and procedures of the audit. If the audited side prepared the plan for the audit of itself, the independence of the audit would be undermined, so this is always done by the auditor.
Incorrectウ
Preparing the audit report is the work in which the auditor, based on the audit evidence obtained through the investigation, puts together an opinion and improvement proposals and submits them to the client (such as top management). The report is a document that evaluates the audited side, so it is not something the audited side writes. The audited side is the party that receives the report.
- エ
正解 In a systems audit, the roles of the auditing side (the systems auditor) and the audited side (the auditee department) are clearly separated. The auditor prepares the plan, carries out the investigation, presents improvement proposals in the audit report, and later checks whether those improvements have actually been carried out (follow-up). On the other hand, taking up the problems pointed out in the report and actually fixing the way work is done and the control measures is the job of the audited side. Among the choices, the only one performed by the audited side is エ, business improvement, so エ is the correct answer.
ここがポイント
- The steps in the systems audit flow — preparing the audit plan, the preliminary and main investigations, preparing the audit report, and follow-up (confirming the improvements) — are all handled by the systems auditor (the auditing side).
- The role of the audited side is to actually carry out the business improvements in response to the improvement proposals in the audit report. To maintain an independent position, the auditor must not perform the improvements on the auditee's behalf, and only confirms the state of implementation through follow-up.
用語