問37
頻出度★★★
図に示す情報システムライフサイクルのうち，システム監査の監査対象として適切な工程はどれか。ここで，各矢印は監査対象の範囲を示す。
| 企画工程 | 開発工程 | 運用工程 |
|---|
平成25年度 秋期 ITパスポート試験 問37
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 37
Incorrectア
The arrow of ア covers only the planning phase at the left end of the band, and so it limits the audit target to the planning phase. Auditing the planning phase (checking whether the requirements definition, the investment decision, and the development plan are appropriate) is of course important, but even if the plan is judged appropriate there, that is no guarantee that the quality of the system actually built, or the access management and failure response after it goes into operation, will be appropriate. The risks of the development phase and the operation phase fall completely outside the net of the audit, so this scope is insufficient.
Incorrectイ
The arrow of イ covers only the development phase in the middle. This choice mistakes a systems audit for nothing more than checking quality management and testing during development. In reality, most of a system's life is the operation period after it goes live, and serious risks such as unauthorized access, loss of data, and operating procedures becoming a mere formality materialize in the operation phase. Also, if the requirements are wrong in the upstream planning phase, then even if development proceeds exactly according to procedure, the system that results will be of no use. The development phase alone is too narrow as an audit target.
Incorrectウ
The arrow of ウ covers from the start of the development phase to the end of the operation phase, but the planning phase at the left end is left out of the scope. The planning phase is where the most upstream decisions are made — the purpose of building the system, the business operations it targets, the cost-effectiveness, and the implementation method — and a mistake here is the risk source with the largest impact, one that can make all the work of the later phases go to waste. Auditing is therefore all the more worthwhile in the planning phase, and ウ, which leaves it out, is incomplete as a scope. Its only difference from エ is the single point of whether the planning phase is included, so do not overlook that.
- エ
正解 The correct answer is エ, “Planning phase, development phase, and operation phase”. In the figure, the band at the top is divided into three parts — the planning phase, the development phase, and the operation phase — and each arrow below it shows the scope of the audit target. Only the arrow of エ runs all the way from the left end of the band (the start of the planning phase) to its right end (the end of the operation phase), showing that the whole life cycle is covered. A systems audit is an activity in which a systems auditor, standing in an independent and professional position, checks and evaluates whether the risks surrounding an information system are being handled appropriately, and gives advice and recommendations to the people concerned. The risks dealt with here do not exist only during development. In the planning phase, there is a danger that the requirements definition will not match the management strategy, or that the plan will move ahead without enough study of the return on investment. In the development phase, there is the question of whether quality management of design, programming, and testing, as well as progress management and change management, are appropriate. In the operation phase, what is examined is whether the management of access rights, the backup and recovery procedures, the response to failures, and the preservation of operation records are appropriate. In this way each phase has its own risks, and because a mistaken judgment in an upstream phase spreads to the downstream phases, limiting the audit to only some phases cannot guarantee overall reliability, safety, and efficiency. In fact, the Systems Audit Standards also state that the audit target extends over the entire life cycle of an information system (planning, development, operation, and maintenance). Therefore エ, which includes all the phases, is appropriate.
ここがポイント
- Scope of a systems audit: A systems audit covers the entire life cycle of an information system (planning, development, operation, and maintenance) and is not limited to a particular phase. The planning phase raises the question of whether the requirements definition and the investment decision are appropriate, the development phase whether quality management, testing, and change management are appropriate, and the operation phase whether access management, backup, and failure response are appropriate. Since each phase has its own risks, looking at only some of the phases cannot guarantee reliability, safety, and efficiency.
- The position of a systems audit: A systems auditor, from a professional position independent of the department being audited, checks and evaluates how well the risks of the information system are being handled, and when problems are found, gives advice and recommendations aimed at improvement. What matters is that the auditor does not carry out the design or the operation in place of others but evaluates strictly as a third party, and that the role also includes the follow-up after the advice and recommendations have been given.
用語