問28
頻出度★★★
IT統制は, ITに係る全般統制や業務処理統制などに分類される。全般統制はそれぞれの業務処理統制が有効に機能する環境を保証する統制活動のことをいい, 業務処理統制は業務を管理するシステムにおいて承認された業務が全て正確に処理, 記録されることを確保するための統制活動のことをいう。統制活動に関する記述のうち, 業務処理統制に当たるものはどれか。
平成25年度 秋期 ITパスポート試験 問28
マネジメント系システム監査 › 内部統制
This question's explanation and your answers so far.
解説
問 28
Incorrectア
Monitoring of outsourcing contractors by the department that oversees outsourcing is a management activity that applies in common to the several information systems the contractor is involved with; it does not directly confirm whether individual business data is processed and recorded accurately. Because it is organizational preparation of the environment in the form of outsourcing management, it is classified as a general control.
Incorrectイ
System operations management for the backbone network is a control on the infrastructure side, meant to keep all the business systems running on top of it operating stably. It does not act on the processing content of a specific business operation or on the accuracy of its records; it is an activity that guarantees the prerequisite environment in which application controls can work effectively, so it is a general control.
- ウ
正解 The correct answer is ウ. As the question itself defines, an application (business processing) control is “a control activity that ensures all approved transactions are accurately processed and recorded in the system that manages the operations.” Choice ウ, “an access management mechanism that limits users for each function of the HR system,” works inside the HR system — one individual business system — and narrows down which users may operate each function, such as payroll calculation or registration of personnel transfers. This shuts out entry and updating by unauthorized people, so the accuracy and legitimacy of the data processed and recorded in that system is guaranteed at the level of the business operation itself. The fact that its scope is confined to the processing of one specific business application is the decisive difference from a general control, which prepares the overall environment; therefore ウ is an application control (business processing control).
Incorrectエ
Company-wide system development and maintenance regulations are rules that standardize and control the development and change processes across the whole organization; their object is not the processing of an individual business operation but the entire management process of development and maintenance. This too is a control that builds the foundation on which application controls can work effectively, so it is a general control.
ここがポイント
- IT controls are broadly divided into general controls (controls that assure the environment and infrastructure shared by multiple systems — development and maintenance regulations, operations management, outsourcing management, physical and logical company-wide security, and so on) and application controls (controls that, inside an individual business system, ensure the accuracy and completeness of input, processing, output, and recording).
- To sort out the choices, judge by “what scope does this control act on.” Anything that acts on the whole company, the infrastructure, or an entire process is a general control; anything that acts directly on the functions or transaction data of a specific business system (input checks, access rights assigned per function, output reconciliation, and the like) can be treated as an application control.
用語