問51
頻出度★★★
システム監査人には独立かつ専門的な立場が求められる。自社内のシステム監査を実施するとき, システム監査人の独立性に反する事例はどれか。
平成24年度 秋期 ITパスポート試験 問51
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 51
Incorrectア
An external certified public accountant does not belong to the company's own organization and is a third party, so there is no organizational or positional conflict of interest with the financial accounting system that is being audited. As an accounting expert, the auditor also meets the requirement of professional expertise, so there is no problem in either independence or expertise; this is a typical form of external audit. It is therefore not a case that violates independence.
Incorrectイ
A systems auditor from a consulting firm is likewise an outside third party, and has neither a chain-of-command relationship nor a personnel relationship with the company's own information systems department, which is the audit target. Because the audit is entrusted to an outside party, independence in appearance is secured, so this is not a case that violates independence.
- ウ
正解 The correct answer is ウ. A systems auditor must have both a position independent of the audit target (independence in appearance) and an attitude of judging fairly and impartially (independence of mind). In ウ, the systems auditor who carries out the audit belongs to the very information systems department that is being audited. This is a self-audit, in which someone audits the department they belong to, and it is the form that must be avoided most in a systems audit. As a member of the audited department, the auditor works under the direction of the department head and is evaluated for personnel purposes by that same department, so even when problems unfavorable to the department are found they are hard to point out, and the report may end up being too lenient. Even if the auditor believes the audit was done fairly, from the outside it looks like insiders evaluating insiders, and the credibility of the audit result itself is shaken. Therefore ウ is the case that violates independence.
Incorrectエ
The internal audit department is an organization inside the company, but it is a separate organization from the information systems department that is being audited, and it is generally placed directly under top management, in a position independent of the audited department. The internal systems audit referred to in the question is exactly this standard form carried out by the internal audit department, and simply being a department inside the company does not by itself violate independence. Whether the auditor belongs to the audited department is what decides the judgment.
ここがポイント
- A systems auditor's independence comes in two kinds. Independence in appearance means having no organizational or positional conflict of interest with the audited department (for example an internal audit department placed directly under top management, or an external auditor). Independence of mind means conducting the audit with a fair and impartial attitude. A self-audit, in which someone audits the department they belong to, is the representative example of lacking independence in appearance.
- Sorting the choices by where the auditor belongs is the fastest route. Outside the company (a certified public accountant, a consulting firm) means independence is fine; inside the company but in a separate organization such as the internal audit department also means independence is fine; belonging to the audited department itself means independence fails. The criterion is not inside versus outside the company, but whether the auditor is separated from the audited department.
用語