問31
頻出度★★★
システム監査の対象に関する記述として, 適切なものはどれか。
平成26年度 春期 ITパスポート試験 問31
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 31
Incorrectア
Incorrect. The scope of a systems audit is not limited to government offices, incorporated administrative agencies, and the like; the information systems of ordinary private-sector companies are naturally included as well. The Systems Audit Standards and Systems Management Standards published by Japan's Ministry of Economy, Trade and Industry are likewise built on the idea that they apply broadly to the information systems of any organization, regardless of industry or organizational form. Saying that something is excluded from the scope because of the category of the organization also conflicts with the purpose of a systems audit, which is to control the risks of information systems and ensure reliability, safety, and efficiency.
Incorrectイ
Incorrect. Even an information system that is not connected to the Internet still requires availability, confidentiality, and integrity, so it remains subject to a systems audit. In fact, even a system closed inside the company carries risks such as insider fraud, inadequate management of access rights, insufficient backup and disaster countermeasures, and poor development and operation procedures. Whether a system is connected to the Internet changes the kinds of threats to be assumed, but it is not the criterion that decides whether the system is subject to the audit.
Incorrectウ
Incorrect. Business operations other than accounting are also subject to a systems audit as long as those operations use information systems. Sales, production, inventory, human resources, customer management and so on — whatever the content of the work, it is within scope if an information system is used. Checking only the appropriateness of accounting processes and financial statements is the role of a financial audit, and this option mistakenly applies that scope of responsibility to a systems audit.
- エ
正解 The correct answer is エ, “Business operations that do not use information systems are not subject to the audit.” A systems audit is an audit in which a systems auditor, holding a professional position independent of the department being audited, inspects, evaluates, and verifies an organization's information systems across their entire life cycle of planning, development, operation, and maintenance, and gives advice and recommendations on whether availability, confidentiality, integrity, and similar qualities are ensured. As the name suggests, the audit looks at things through the lens of the “information system,” so whether a task falls within scope is decided solely by whether that task involves an information system. Therefore, business operations that use no information system at all do not fall within the scope of a systems audit. Note that being outside the scope does not mean the work is exempt from auditing altogether. Work that does not use information systems belongs to the area covered by an operational audit, which evaluates the appropriateness and effectiveness of the work itself; only the type of audit differs. If you memorize the three areas of responsibility as a set — systems audit (targets information systems), operational audit (targets business operations in general), and financial audit (targets accounting processes and financial statements) — questions of this kind can be answered without hesitation.
ここがポイント
- A systems audit is an audit in which systems auditors, working from an independent position, inspect, evaluate, and verify an organization's information systems across the entire life cycle of planning, development, operation, and maintenance, and give advice and recommendations on whether availability, confidentiality, integrity, and similar qualities are ensured. Whether something falls within scope is decided not by industry, by public versus private sector, by Internet connectivity, or by business field, but solely by whether an information system is involved.
- Audits are distinguished by their scope of responsibility. A systems audit targets information systems, an operational audit targets the appropriateness and effectiveness of business operations in general, and a financial audit targets the appropriateness of accounting processes and financial statements. Therefore, work that does not use information systems is outside the scope of a systems audit, but it is handled as a target of an operational audit.
用語