問37
頻出度★★★
X 社の社長である A 氏は, 新たに構築した自社の情報システムの信頼性や安全性などを確認するために, 監査人の M 氏にシステム監査を依頼した。監査終了後, M 氏のシステム監査報告書の提出先として, 適切なものはどれか。
平成24年度 春期 ITパスポート試験 問37
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 37
Incorrectア
The government regulatory agency overseeing Company X is wrong. The systems audit in this question was requested by President A himself for a business purpose, namely to check his own company's information system, and it is not a statutory inspection that must be filed with a government agency. In addition, a system audit report contains highly confidential information such as the weak points of the information system, so disclosing it to anyone other than the requester is done at the requester's own judgment and responsibility; the auditor does not submit it to a regulatory agency on his own initiative.
Incorrectイ
The head of the audited department within Company X is wrong. The audited department is the side being audited; it is not in a position to receive the report and pass judgment on it. If the auditor reported directly to the audited department, the findings could be buried inside that department, or management could be left without the information it needs to decide on corrective action, and both the effectiveness and the independence of the audit would suffer. The correct flow is that the results reach the audited department in the form of improvement instructions from the requester (management). Note that the auditor may check facts with the audited department during the audit to avoid factual errors, but that is a separate matter from where the report is submitted.
- ウ
正解 The correct answer is ウ, Mr. A, the requester of the audit. A systems audit is a series of activities in which a systems auditor, standing independent of the audited department, inspects and evaluates whether the reliability, safety, efficiency, and other qualities of an information system are properly ensured, and then reports the results so that improvements can follow. Because the systems auditor performs the audit based on a contract with the party that requested it (or on instructions from management), the system audit report, which summarizes the audit conclusions together with the points identified and the recommendations for improvement, is in principle submitted first to the requester. In this question, Mr. A, the president of Company X, himself asked Mr. M for the audit in order to confirm the reliability and safety of his own company's information system, so the report goes to Mr. A, the requester. Mr. A (management), having received the report, then instructs the audited department to fix the problems that were pointed out, and the systems auditor afterwards checks the state of those improvements as follow-up. In other words, the auditor reports to the requester and the requester moves the organization; the auditor does not report directly to the audited department or to outside parties. That reporting route is the point of this question.
Incorrectエ
A third party with no interest related to the audited department is wrong. Independence and objectivity, meaning having no interest relating to the audited department, are requirements placed on the systems auditor who performs the audit, not conditions for the party to whom the report is submitted. This choice is designed to make you confuse the auditor's independence with the reporting destination; handing the report to an unrelated third party would not lead to any improvement, and it could also cause a leak of confidential information.
ここがポイント
- The system audit report is submitted to the party that requested the audit (usually management). Remember this flow: the auditor reports to the requester, the requester instructs the audited department to make improvements, and the auditor then confirms the state of those improvements in a follow-up.
- The independence and objectivity required of a systems auditor (having no interest relating to the audited department) are conditions for the auditor himself, and are not the criterion that determines to whom the report is submitted.
用語