問38
頻出度★★★
内部監査として社内で実施したシステム監査の結果を踏まえて行われる改善活動のうち, システム監査人が実施するものはどれか。
平成25年度 秋期 ITパスポート試験 問38
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 38
Incorrectア
Carrying out the individual improvements based on the improvement implementation plan is the role of the audited department that received the findings (the frontline department responsible for operating and developing the system). If the auditor did the improvement work personally, the auditor would later be auditing the results of their own work, and independence and objectivity would be lost.
Incorrectイ
Approving the improvement implementation plan is the role of the management who requested the audit (the audit client) or of a responsible manager. Approval is an organizational decision that carries responsibility, and the auditor, whose position is to advise and evaluate, has no such authority.
Incorrectウ
Deciding which improvements to make and when and how to make them, and then formulating the improvement implementation plan in response to the findings in the audit report, is the job of the audited department. The auditor can go only as far as improvement proposals (advice on what should be done); taking the position of deciding what will actually be done would damage independence.
- エ
正解 The correct answer is エ, “Ascertain the status of improvement implementation and evaluate its results.” A systems auditor’s job does not end when improvement proposals (findings) are presented in the audit report; it also includes the follow-up that comes afterwards. Follow-up means checking whether the audited department is carrying out the improvements as set out in the improvement implementation plan, evaluating whether the results of those improvements were effective, and giving advice when necessary. What matters here is the auditor’s independence: the auditor must keep a position that is independent from the audited department. If auditors implemented improvements or drew up the plan themselves, they would later be auditing their own work and could no longer evaluate it objectively. So the auditor does not stand on the side that implements, but strictly on the side that checks and evaluates. Only エ matches this position.
ここがポイント
- The flow of a systems audit is: audit planning → preliminary survey and main survey → evaluation and conclusion → audit report (improvement proposals) → follow-up. What the auditor does after the report is the follow-up: ascertaining the status of improvement implementation and evaluating the results of the improvements.
- A systems auditor is required to be independent and objective. Implementing improvements, formulating the plan, and approving it are all roles of the audited department or of management; if the auditor took on any of these, it would become a self-audit and independence would be lost.
用語