問42
頻出度★★★
企業の内部監査の一環で実施されるシステム監査の内容として, 適切なものはどれか。
平成22年度 春期 ITパスポート試験 問42
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 42
Incorrectア
A system operator verifies their own department’s operations by themselves, so the auditing side and the audited side are one and the same. This is called self-inspection (self-checking). It is effective as a routine internal control activity, but it does not satisfy independence, which is the premise of an audit, so it cannot be called a systems audit. The problem is that it cannot rule out the possibility that facts inconvenient to one’s own department are overlooked or underestimated.
Incorrectイ
Verifying the requirements for the next-generation system through a questionnaire survey of users is a survey activity performed in the requirements definition process of system development; it is not, to begin with, an audit that inspects and evaluates whether existing operations are carried out according to the rules. The person carrying it out is also the system developer themselves, so the requirement of inspection from an independent position is not satisfied either.
- ウ
正解 The correct answer is ウ. A systems audit is an activity in which an auditor, from an independent position, inspects and evaluates whether the planning, development, operation, and maintenance of an information system are being carried out appropriately, and advises or recommends improvements when problems are found. The most important condition here is the auditor’s independence and objectivity: the person who audits must have no vested interest in the department being audited. The same applies when the audit is conducted as part of a company’s internal audit — the auditor need not be an outside third party, but must at least be someone independent of the systems department, which is the audited department (for example, a member of an internal audit department). In ウ, “a person from outside the systems department” verifies whether “the systems department’s operations” are carried out according to the rules, using a checklist as an objective standard, so the auditing side and the audited side are separated. It is therefore appropriate as the content of a systems audit.
Incorrectエ
A physical inventory count, which matches the actual items against the ledger to confirm that the information equipment is installed as recorded, is a routine asset management (configuration management) task that the systems department performs by itself, and is not an audit as such. Moreover, because the person carrying it out belongs to that same department, it is a self-inspection lacking independence, just as in ア. Confirming that the ledger and the actual items agree can itself become a subject verified in an audit, but simply doing it within one’s own department does not amount to a systems audit.
ここがポイント
- A systems audit is an activity that inspects and evaluates whether the planning, development, operation, and maintenance of an information system are appropriate, and that advises or recommends improvements. Its greatest requirement is the auditor’s independence and objectivity: it must be carried out by someone independent of the audited department. The same holds when it is part of an internal audit — it must be handled by someone separated from the systems department, such as the company’s internal audit department.
- Self-inspection, in which a department checks its own department, is not an audit even though it is effective as a means of internal control. When looking at the choices, first check whether “who (the person carrying it out)” and “what (the target)” are separated, and rule out any choice that stays within the same department as an audit candidate — judging in this order is fast.
用語