問42
頻出度★★★
システム監査の実施に関する記述として, 適切なものはどれか。
平成23年度 特別試験 ITパスポート試験 問42
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 42
Incorrectア
Conducting an audit without drawing up an audit plan is inappropriate. In a systems audit, the audit is required to be carried out only after the following have been formulated: a medium- to long-term plan that sets out the audit policy for the organization as a whole, an annual plan that decides what will be audited in that fiscal year, and an individual audit plan that sets the audit objectives, scope, audit procedures, schedule, and staffing for each audit. Without a plan, problems arise: the purpose and scope of the audit become vague so that important risks are overlooked; the necessary staff and time cannot be secured; the schedule cannot be coordinated with the audited department, disrupting its work; and the quality of the audit results cannot be verified afterwards. Formulating the plan is the starting point of the audit procedure and is not a step that can be omitted.
Incorrectイ
The statement that improvement guidance is never provided on the basis of the audit results is wrong. The purpose of a systems audit is not to finish once problems have been pointed out, but to have the problems that were pointed out actually corrected, so that the information system comes closer to being operated effectively and safely. For that reason the auditor presents improvement proposals (improvement recommendations) in the system audit report, and after reporting, carries out a follow-up to check how the improvement plan drawn up by the audited department is being implemented. This follow-up is part of one continuous set of audit activities, and if the audit is run in a way that makes no effort to lead to improvement, it loses its meaning.
Incorrectウ
The statement that fact-checking is never performed prior to preparing the audit report is wrong. The findings and improvement proposals written in a system audit report must be based on objective facts backed by audit evidence. Therefore, before compiling the report, the auditor checks the events, figures, and actual operating conditions that have been observed against the audited department, and confirms that there is no difference of understanding, no misunderstanding, and no factual error on the auditor's own part. If this fact-checking is omitted, findings are raised on mistaken premises, the report loses its credibility, and the audited department will not accept it, so it will not lead to improvement either. Fact-checking is a step that must always be gone through before the report is prepared.
- エ
正解 The correct answer is エ. A systems audit is not a matter of looking into things on a whim; it proceeds according to a procedure decided in advance. The overall flow is: formulating the audit plan → preliminary survey → main survey → evaluation and conclusion → preparing and submitting the system audit report → follow-up (checking the status of improvements). Among these, the preliminary survey is the step in which, before entering the main survey, the auditor gains a rough grasp of the business operations covered by the audit, the outline of the system, the related regulations, and the internal control mechanisms, by reading documents, interviewing the people concerned, and using questionnaires. It has two main purposes. First, since it is impossible to judge where the risks lie if the main survey is entered without knowing the actual state of the audit target, it serves to narrow down the areas that should be examined intensively. Second, on the basis of that narrowing down, it serves to settle the concrete audit procedures — when, from whom, what evidence, and by what method (inspection of documents, matching, physical inspection, attendance and observation, reperformance, and so on) it will be verified — and to work out the individual audit plan in detail. Because the preliminary survey gives the auditor a good idea of where to look, the main survey that follows can concentrate on actually obtaining audit evidence and compiling it into audit working papers, so an effective and efficient audit can be carried out with limited time and staff. Therefore エ, which states that a preliminary survey is conducted prior to the main survey, is the appropriate description regarding the conduct of a systems audit.
ここがポイント
- The procedure for conducting a systems audit — remember the flow: formulating the audit plan (medium- to long-term, annual, individual) → preliminary survey → main survey → evaluation and conclusion → preparing and submitting the system audit report → follow-up. The preliminary survey is the step of grasping the actual state of the audit target before the main survey and narrowing down the scope of investigation and the audit procedures; the main survey is the step of actually obtaining audit evidence and preparing the audit working papers.
- Audit reporting and follow-up — before the report is prepared, fact-checking is carried out with the audited department, and the findings and improvement proposals are compiled on the basis of objective facts and audit evidence. After reporting, a follow-up is carried out to check how the improvement plan is being implemented; not ending the audit at merely pointing out problems is the basic stance of a systems audit.
用語