問51
頻出度★★★
システム監査の実施内容に関する記述のうち, 適切なものはどれか。
平成25年度 春期 ITパスポート試験 問51
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 51
Incorrectア
Building and operating a quality management system based on ISO 9001 is the work performed by the side that manages quality (the audited side) itself; it is not an audit. An audit takes a mechanism that has already been established and put into operation as its target, and checks and evaluates from the outside whether it is appropriate. Therefore, a statement that the quality control manager builds and operates their own quality management system is merely a description of ordinary management work, not of how a systems audit is carried out.
Incorrectイ
Developers testing a system they developed themselves is self-verification such as unit testing carried out within the development process, not a systems audit. Moreover, because the person who evaluates and the person in charge of the work being evaluated are the same, it does not satisfy the independence essential to a systems audit (being independent of the audited subject). Mistakes in your own work are hard to notice by yourself, so it does not amount to an objective evaluation and cannot stand as an audit.
- ウ
正解 The correct answer is ウ. A systems audit is an activity in which a systems auditor in an independent position inspects, evaluates, and verifies whether the controls against risks related to an information system are appropriately established and operated as intended, and then reports the results to management and others, offering advice and recommendations. The deciding factor here is independence: the System Audit Standards require the systems auditor to be independent of the audited subject (independence in appearance) and to be able to judge fairly and objectively (independence in mind). This is because checking work you were in charge of yourself cannot avoid oversights and favoritism, so the objectivity of the evaluation cannot be assured. ウ satisfies both points — what is evaluated is “whether the controls against information system risks are established and operated properly”, and the evaluator is “a third party independent of the audited subject” — so it is an appropriate description of how a systems audit is carried out.
Incorrectエ
A system administrator using dedicated software (such as a vulnerability scanning tool) to verify security holes in the system they manage is self-inspection and vulnerability diagnosis by the operations staff, not a systems audit. Here too, the person doing the checking is the very party responsible for managing the system, so independence is lacking. The technical inspection itself is useful and necessary as a security measure, but because it does not meet the requirement of evaluation by a third party independent of the audited subject, it is inappropriate as a description of how a systems audit is carried out.
ここがポイント
- Definition of a systems audit: an activity in which a systems auditor inspects, evaluates, and verifies whether the controls against risks related to an information system are appropriately established and operated, and reports to management and others with advice and recommendations. An audit is not the act of building or running the mechanism (that is the work of the audited side); it is the act of checking it from the outside.
- Independence of the systems auditor (System Audit Standards): the auditor must be in a position independent of the department and the work being audited (independence in appearance) and must be able to judge fairly and objectively (independence in mind). Forms in which the party involved checks their own work — such as developers testing what they built or administrators inspecting the systems they run — lack independence and therefore cannot be called an audit.
用語