問45
頻出度★★★
システム監査の説明として, 適切なものはどれか。
平成26年度 秋期 ITパスポート試験 問45
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 45
Incorrectア
ISO 9001 is the quality management system standard, and what is carried out based on it is certification auditing and internal auditing of a quality management system. A systems audit targets the risks and controls of an information system, and its basis is the Systems Audit Standards, not a quality standard.
Incorrectイ
ISO 14001 is the environmental management system standard, and it is an environmental audit that confirms conformity with it. Although auditing is the same overall framework, its target domain is the management of environmental impact, which is a different thing from a systems audit that evaluates the controls of an information system.
Incorrectウ
An audit that uses IT as an audit tool is an audit performed with CAATs (computer-assisted audit techniques), and that is a matter of the means of auditing. A systems audit, on the other hand, takes the information system itself as the object of the audit, so this choice mixes up the means with the object. Since a financial audit and others can also use IT as a tool, this statement does not work as the definition of a systems audit.
- エ
正解 A systems audit is an activity in which an independent, professionally qualified auditor verifies and evaluates whether the controls an organization has put in place (internal controls such as access rights management, backups, change management, and segregation of duties) against the risks surrounding an information system (failures, information leakage, fraud, data loss, and so on) are properly established and are actually operated as intended, and then advises or recommends improvements where necessary. Choice エ states exactly this definition — that it verifies or evaluates the establishment and operation status of controls against the risks of an information system — and it also matches the intent of the Ministry of Economy, Trade and Industry Systems Audit Standards, so it is the correct answer. The two key points are that the object of the audit is the risks and controls of an information system, and that the purpose of the audit is assurance and recommendations for improvement.
ここがポイント
- Systems audit = an activity in which an independent auditor verifies and evaluates the establishment and operation status of controls against the risks related to an information system, and gives advice and recommendations (its basis is the Ministry of Economy, Trade and Industry Systems Audit Standards).
- Audits are distinguished by their target domain: quality is covered by a quality audit based on ISO 9001, the environment by an environmental audit based on ISO 14001, and information systems by a systems audit. CAATs, which use IT as a tool, are a means of auditing, not a type of audit.
用語