問47
頻出度★★★
会社の情報システムの安全性, 信頼性などを第三者が点検, 評価し, 必要があれば当該第三者が点検, 評価の対象者に助言, 勧告をするものはどれか。
平成24年度 春期 ITパスポート試験 問47
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 47
- ア
正解 The correct answer is “ア”, systems audit. A systems audit is a series of activities in which a third party independent of the department being audited (a systems auditor) objectively inspects and evaluates whether a company's information system ensures reliability, safety, and efficiency, compiles the results into an audit report, and, when necessary, gives the audited department or management advice and recommendations for improvement (improvement proposals). Breaking down the wording of the question, it lists three features: (1) the work is done by a “third party”, that is, by someone independent of the object being examined; (2) what is inspected and evaluated is “the safety, reliability, and other aspects of the information system”; and (3) if necessary, that same third party gives “advice and recommendations” to the party being examined. The only choice that has all three of these features is systems audit. Feature (1), independence, is especially important: if the people who built the system or who operate it inspect it themselves, the evaluation can easily become lenient, so having a third party with no vested interest do the evaluation is what secures objectivity. Also, as in (3), the work does not stop at pointing out problems — it goes on to give advice and recommendations aimed at improvement, and afterwards checks how the improvements are progressing (follow-up). This too is a major characteristic of a systems audit.
Incorrectイ
System management is the operation and maintenance work done to keep an information system that is already in service running correctly day after day (handling failures, monitoring performance, taking backups, managing users and access rights, and so on). It is carried out by the people directly responsible for operations, such as the information systems department, not by an independent third party. On the contrary, system management is the work of the side that gets audited (the audited department); it is in the position of receiving the inspection and evaluation and of receiving the advice and recommendations. It does not satisfy the third-party independence the question requires, so it is wrong.
Incorrectウ
System design is the step of the development process in which, in order to realize the requirements decided during requirements definition, the concrete specifications are worked out — screens, reports, data structures, processing methods, and so on. This is development work for building a new system, not an activity in which a third party inspects and evaluates the safety and reliability of an existing system and gives advice and recommendations. The people who do it are also parties to the development, so the role is completely different from the one described in the question.
Incorrectエ
A system test is the work done at the final stage of the development process, in which the developer side (or a testing engineer) verifies that the completed system as a whole behaves as required. In the sense of confirming functions and performance it does amount to a quality check, but what it examines is whether the system under development meets its specification, and it is carried out by members of the development project. It does not fit the framework the question sets out, in which an independent third party evaluates an information system in service and gives advice and recommendations to the party being evaluated.
ここがポイント
- A systems audit is an activity in which a third party independent of the audited department (a systems auditor) inspects and evaluates the reliability, safety, and efficiency of an information system, gives advice and recommendations for improvement by means of an audit report, and afterwards follows up on how the improvements are progressing. The two keywords are “independent third party” and “advice and recommendations (improvement proposals)”; when these two appear, suspect a systems audit.
- Tell the confusing choices apart by asking “who performs it”. Design and testing are development steps carried out by the people doing the development, and system management is operational work carried out by the people running the system; both belong to the side that gets audited. Only the audit is performed from an independent, outside position, and that is the decisive difference.
用語