問6
頻出度★★★
“経営戦略に沿って効果的な情報システム戦略を立案し, その戦略に基づき, 効果的な情報システム投資のための, またリスクを低減するためのコントロールを適切に整備・運用するための実践規範” はどれか。
平成23年度 特別試験 ITパスポート試験 問6
マネジメント系システム監査 › 内部統制
This question's explanation and your answers so far.
解説
問 6
Incorrectア
The System Audit Standards are a code of conduct for system auditors, aimed at ensuring the quality of system audit work and carrying out audits effectively and efficiently. They lay down matters to be observed by the side that performs the audit — the auditor’s independence and objectivity, drawing up the audit plan, obtaining audit evidence, preparing the audit report — and are not a code for an organization to establish and operate controls. What the question asks for is a code of practice for the audited side, so this option is wrong. Note that the System Audit Standards form a pair with the System Management Standards: the auditor uses the System Management Standards as the yardstick for evaluating how controls are established and operated.
- イ
正解 The correct answer is イ. The System Management Standards are standards established by Japan’s Ministry of Economy, Trade and Industry. They are a code of practice under which an organization proactively formulates an effective information system strategy in line with its management strategy and, based on that strategy, appropriately establishes and operates controls for effective information system investment and for reducing risks, across the whole life cycle of planning, development, operation, and maintenance of information systems. The question text is exactly this definition, and it can be narrowed down from two clues. First, the sentence ends with “a code of practice for appropriately establishing and operating controls.” The party that establishes and operates controls is the organization that plans, develops, and operates the information system — that is, the party being audited — not the auditor who performs the audit. This narrows the answer from “audit standards” to “management standards.” Second, the sentence begins with “formulating an effective information system strategy in line with the management strategy,” so its scope reaches from formulating an information system strategy all the way to information system investment, covering information systems as a whole. Because the subject is not limited to information security, the answer is a standard headed by “System,” not one headed by “Information Security.” Only the System Management Standards satisfy both points. In practice, the audited side establishes and operates controls in accordance with the System Management Standards, while the auditor inspects and evaluates how they are established and operated in accordance with the System Audit Standards; the two are used as a pair.
Incorrectウ
The Information Security Audit Standards are a code of conduct for auditors, set out so that information security audit work maintains its quality and audits are carried out effectively and efficiently. They are wrong for two reasons: first, they are a code for the side that performs the audit, not for the side that establishes and operates controls; second, their subject is limited to information security and lacks the breadth of the question text, which extends to formulating an information system strategy and to information system investment. Seen from either axis, they do not match the definition given in the question.
Incorrectエ
The Information Security Management Standards are a code of practice for an organization to build an effective information security management system and to appropriately establish and operate controls; they are based on JIS Q 27001 / JIS Q 27002 (ISO/IEC 27001 / 27002). Up to the point of being a code of practice aimed at the side that establishes and operates controls, they match the question text, but their coverage is limited to information security, that is, to ensuring confidentiality, integrity, and availability. The question text describes controls over information systems as a whole — going beyond security to formulating an information system strategy in line with the management strategy and to effective information system investment — so their scope is too narrow to fit.
ここがポイント
- Telling apart the pair “management standards” and “audit standards” — management standards are a code of practice for the organization (the audited side) to establish and operate controls, while audit standards are a code of conduct for the auditor (the auditing side) when carrying out an audit. If the question text says “a code of practice for establishing and operating controls,” judge it to be management standards; if it says “a code of conduct for auditors carrying out an audit,” judge it to be audit standards. In practice the two are used as a pair, with the auditor evaluating the audited side against the management standards.
- Telling apart the scope of “System” and “Information Security” — standards headed “System …” cover the entire life cycle of information systems: planning, development, operation, and maintenance, while standards headed “Information Security …” are limited to the information security domain of ensuring confidentiality, integrity, and availability. Crossing these two axes organizes the four standards — System Management Standards, System Audit Standards, Information Security Management Standards, and Information Security Audit Standards — and shows which parts of a definition to look at in order to narrow the answer down.
用語