問31
頻出度★★★
IT統制は, ITに係る全般統制や業務処理統制などに分類される。全般統制はそれぞれの業務処理統制が有効に機能する環境を保証する統制活動のことをいい, 業務処理統制は業務を管理するシステムにおいて承認された業務が全て正確に処理, 記録されることを確保するための統制活動のことをいう。統制活動に関する記述のうち, 全般統制に当たるものはどれか。
平成25年度 春期 ITパスポート試験 問31
マネジメント系システム監査 › 内部統制
This question's explanation and your answers so far.
解説
問 31
- ア
正解 The correct answer is ア, “A system development standard used in common across the entire company.” A system development standard does not define the processing content of a particular business operation itself; it is a foundational rule that sets out the procedures and criteria to be followed whenever any business system is built (requirements definition, design, testing, approval, migration, documentation, and so on). When this standard is observed, the application controls built into each business system, such as input checks and approval procedures, are designed, implemented, and tested through the correct procedures, and are maintained after the system goes into operation. In other words, ア corresponds to what the question defines as “a control activity that ensures an environment in which each application control functions effectively,” that is, an IT general control. Typical examples of IT general controls include management of system development and maintenance, system operation and management, securing the safety of the whole system through such means as internal and external access management, and management of contracts for outsourcing; ア falls under the management of development and maintenance.
Incorrectイ
Deciding who is allowed to perform which range of operations inside the HR system, one specific business system, that is, limiting the scope of use, is a mechanism that ensures only approved operations are accurately processed and recorded in that system, so it is an application control. Note that “access management” also appears on the general control side, but there it refers to a mechanism that protects the IT platform and the company-wide infrastructure as a whole against internal and external access (measures against unauthorized intrusion and the like, securing the safety of the whole system). Limiting the scope of use and the privileges that decide who may perform which business operations inside an individual business system belongs to the application control side; the word “access” is the same, but the layer differs, and this is the point to watch.
Incorrectウ
Maintaining and managing the master data of the accounting system is an activity for keeping the accuracy and completeness of the data that the system handles, and it is a typical example of an application control itself. Even for a system used in common across the entire company, what is controlled is the correctness of data processing inside a specific business system, so it is not a general control that ensures the environment.
Incorrectエ
The procedure for correcting input errors in the purchasing system corresponds to the correction and reprocessing of exceptions (errors) spoken of in application controls. It is a control at the level of an individual business operation that makes the entered transaction data be accurately processed and recorded, so it does not fall under general controls, which prepare the environment in which application controls work.
ここがポイント
- An IT general control is a control that ensures an environment in which each application control functions effectively. Typical examples are management of system development and maintenance (development standards, change management, and so on), system operation and management, securing the safety of the whole system through such means as internal and external access management, and management of contracts for outsourcing.
- An IT application control is a control that ensures all approved operations are accurately processed and recorded inside a specific business system. Typical examples are checks on the accuracy, completeness, and validity of input data, correction and reprocessing of errors, maintenance and management of master data, and authentication for system use and limitation of the scope of operations. In this question every choice carries the phrase “used in common across the entire company,” so you cannot tell them apart by whether they are common. Distinguish them by whether the control concerns the foundation on which systems are built and run, or the processing inside a specific business system.
用語