問34
頻出度★★★
個人情報保護に関するシステム監査が実施された。この監査において, 営業部門では, 情報システムから出力した顧客リストを, 全社で定めたルールどおりに取り扱っていないとの指摘を受けた。指摘事項に基づく改善計画の策定責任者はだれか。
平成23年度 特別試験 ITパスポート試験 問34
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 34
- ア
正解 In a systems audit, the responsibilities of the auditor (the audit department) and of the audited department are clearly separated. The auditor’s role is to inspect operations and systems from an independent, objective standpoint, point out problems, and then advise and recommend improvements — and that is where it ends. Responsibility for deciding how the pointed-out items are actually fixed, that is, for formulating and carrying out the improvement plan, lies with the audited department that performs the work day to day. In this question, the department pointed out for “not handling the customer list output from the information system according to the company-wide rules” is the sales department, and the party that actually handles the customer list is the sales department as well. Therefore the person responsible for formulating the improvement plan based on the pointed-out item is “the person in charge of the sales department,” so the correct answer is ア. Note that the auditor stands in the position of later following up (checking the status of improvement) on whether the improvement plan has been carried out.
Incorrectイ
The person in charge of the audit department is in the position of pointing out issues, advising and recommending improvements, and following up later. If the audit department itself formulated and carried out the improvement plan, it would end up auditing its own results, losing the independence and objectivity that a systems audit requires. It therefore does not become the party responsible for formulating the improvement plan.
Incorrectウ
The corporate planning department is the department that drafts company-wide policies and business plans; it is not the party that carries out the sales department’s customer-list handling work targeted by this finding. It could become involved if the company-wide rules themselves needed to be reviewed, but the party responsible for formulating an improvement plan for an individual pointed-out item is the department that received the finding, not the corporate planning department.
Incorrectエ
What the systems department is responsible for is the development, operation, and management of the information system itself. The finding in this question is that after the customer list was output from the system, the sales department did not handle it according to the company-wide rules — an issue on the operational-use side, outside the systems department’s scope of management. It is therefore not the party responsible for formulating the improvement plan.
ここがポイント
- Division of responsibility in a systems audit: the auditor (the audit department) points out issues and advises and recommends improvements from an independent, objective standpoint, while responsibility for formulating and implementing the improvement plan lies with the audited department that received the finding.
- The auditor stands in the position of later checking how the improvement plan has been implemented (follow-up); carrying out the improvements itself would undermine independence and objectivity, so the auditor must not take on both roles.
用語