問39
頻出度★★★
情報システムの運用状況を監査する場合, 監査人として適切な立場の者はだれか。
平成22年度 秋期 ITパスポート試験 問39
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 39
- ア
正解 The correct answer is ア, “A person not involved with the system being audited.” What matters most in a systems audit is the auditor's independence and objectivity: the auditor must be independent of the work and the system that is being audited. If people evaluate work they themselves took part in, it becomes hard to point out problems and the evaluation tends to be too lenient. That is self-auditing, and it destroys the credibility of the audit results. Therefore, to audit the operational status, the auditor should be someone not involved in that operation, such as an independent internal audit department inside the company or an external auditor who is a third party outside it. Note that independence has two sides: independence in appearance (having no conflicting interests) and independence in mind (making unbiased judgments).
Incorrectイ
The operations manager of the system being audited is the very person responsible for the operational setup that the audit evaluates, that is, a party on the audited side. Auditing operations that they themselves manage would be self-auditing, so independence and objectivity cannot be secured. The operations manager is on the side that receives the audit (the audited department) and cannot become the auditor.
Incorrectウ
The operations staff of the system being audited are the parties who actually perform the daily operational work, the very people who carry out the tasks the audit inspects. They would be auditing their own procedures and records, so they might overlook deficiencies or avoid pointing them out, which makes them unsuitable as auditors.
Incorrectエ
The consultant who provides guidance on operating the system being audited is a person from outside the company, yet is in the position of having advised on and built the way that operation is run. Evaluating the very content they themselves taught means that even an outsider comes to have an interest in the audit target and lacks independence in appearance. Note that the requirement is not “an outsider equals independent,” but being uninvolved with the audit target.
ここがポイント
- Independence of the systems auditor: the auditor must stand independent of the work and the system being audited, and self-auditing, that is, auditing a target one was involved in, is prohibited. Both independence in appearance (having no conflicting interests) and independence in mind (fair and unbiased judgment) are required.
- Distinguishing the audited side from the auditing side: the operations manager, the operations staff, and the consultant who guided the operation are all parties involved with the audit target (the audited side). Whether the person is inside or outside the company, eligibility as an auditor is judged by whether they are uninvolved with the target.
用語