問39
頻出度★★★
構築された内部統制の整備状況を評価するために，リスクコントロールマトリクスを利用する。リスクコントロールマトリクスの利用に関する次の記述中の，a，b に入れる字句の適切な組合せはどれか。 リスクと [ a ] を記述して，[ b ] を評価する。
平成26年度 春期 ITパスポート試験 問39
マネジメント系システム監査 › 内部統制
This question's explanation and your answers so far.
解説
問 39
Incorrectア
Both a and b are wrong. The “candidate control items” in a refers to measures still being considered for introduction, which does not match the purpose stated in the question — assessing the state of the internal controls that have been established, that is, assessing existing controls. The “economic efficiency of the control items” in b is about cost-effectiveness, a viewpoint used when deciding whether to introduce a control; it is not what an RCM reads off from the correspondence between risks and controls.
Incorrectイ
The “degree of risk reduction” in b is correct, but the “candidate control items” in a is wrong. What is assessed are controls that have already been established and put into practice; listing candidates that have not yet been introduced cannot assess the current state of readiness.
Incorrectウ
The “control items being implemented” in a is correct, but the “economic efficiency of the control items” in b is wrong. What an RCM shows is the correspondence between risks and controls, and what can be assessed from it is how far the controls have reduced the risks (the degree of reduction). Whether the cost is justified is handled by other methods such as cost-benefit analysis.
- エ
正解 A risk control matrix (RCM) is a table that maps the identified “risks” to the “control items being implemented” against them, in the form of a matrix. The question states that it is used to assess the state of the internal controls that have been established, so what is assessed is not a plan still under consideration but controls that are already built in and operating. Therefore, in an RCM you write [ a ] = control items being implemented, and you assess how far those controls hold each risk down, that is, [ b ] = the degree of risk reduction. By matching risks against controls, you can make visible both the risks that no control covers (gaps or omissions in control) and the places where control is weak and risk has not been reduced enough — that is the purpose of an RCM. Hence エ, the combination a = control items being implemented and b = the degree of risk reduction, is the correct answer.
ここがポイント
- Risk control matrix (RCM) = a table that maps identified risks to the control items implemented against them. It is an internal control assessment tool that makes gaps, omissions, and weaknesses in control visible.
- What an RCM assesses is the “degree of risk reduction” (how far the controls have brought the risks down), not the economic efficiency (cost-effectiveness) of the controls. The key to answering is reading the question’s “state of the internal controls that have been established” as meaning that the target of assessment is the existing controls already in operation.
用語