問40
頻出度★★★
A社の内部監査人が同社の事業継続計画 (BCP) についてシステム監査を行った。 システム監査の指摘事項として, コンピュータ電源のバックアップ対策において, システム運用部門が管理する無停電電源装置のバッテリーに一部劣化が生じていることが挙げられた。この指摘事項に対して改善を行う責任者は誰か。
平成26年度 秋期 ITパスポート試験 問40
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 40
- ア
正解 The correct answer is “ア The head of the systems operations department”. A systems audit is an activity in which an auditor in an independent and objective position inspects and evaluates the target operations, points out problems, and prompts improvement. However, what the auditor does goes only as far as pointing out issues, giving advice, and following up; the one who actually takes corrective action is the responsible person on the side that received the finding (the audited department). The finding in this question is that the batteries of the uninterruptible power supply (UPS) managed by the systems operations department have partially deteriorated, so the department that actually manages and operates that asset, namely the head of the systems operations department, bears the responsibility for carrying out the improvement (replacing the batteries, reviewing the inspection interval, and so on). Once you read from the stem which department manages the equipment, the person responsible for improvement is uniquely determined.
Incorrectイ
The person responsible for systems development is responsible for the processes of building a system (requirements definition, design, coding, and testing). The finding in this question is an operational deficiency in the maintenance of equipment already in service (the batteries of the uninterruptible power supply), not a problem with a deliverable of the development process, so the development manager does not become the person responsible for improvement.
Incorrectウ
The internal auditor is in a position that must maintain independence and objectivity; if the auditor personally carried out the improvement, it would amount to auditing the countermeasures that the auditor had implemented, which would impair that independence. The auditor's role extends only to reporting the findings, proposing improvements, and later following up on the improvement status; the auditor is not the person responsible for carrying out the improvement.
Incorrectエ
The head of the purchasing department is responsible for procurement procedures (placing orders, contracting, and payment), but is not in charge of operational management such as routine inspection of the equipment after delivery or monitoring battery deterioration. The stem also states explicitly that the department managing the device is the systems operations department, so the person responsible for improvement is the head of the department that manages it, not the head of the department that purchased it.
ここがポイント
- The role of a systems auditor extends only to pointing out issues, proposing improvements, and following up; the responsibility for implementing the countermeasures rests with the manager of the audited department that received the finding (if the auditor implemented the improvement, independence and objectivity would be impaired).
- When asked who is responsible for improvement, identify from the stem who actually manages and operates the object in question. The answer is neither the department that purchased it nor the department that developed it, but the head of the department that holds the management responsibility.
用語