問50
頻出度★★★
システム監査に必要なプロセスのうち, システム監査人が実施するものはどれか。
平成26年度 春期 ITパスポート試験 問50
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 50
Incorrectア
Establishing operational rules (business regulations, manuals, and so on) is the responsibility of the audited department that actually carries out the work being audited, and of the management that puts that structure in place. If the auditor created the rules, the auditor would end up evaluating controls that the auditor made, and the independence and objectivity required of a systems audit would be lost. The auditor is the side that inspects and evaluates whether the rules are established and operating, not the side that establishes them.
- イ
正解 The correct answer is イ, “Conducting a preliminary survey of the audit target.” A systems audit is a mechanism in which a systems auditor — an independent third party separate from the audit target — inspects and evaluates an information system and advises on improvements. It generally proceeds as: draw up the audit plan → preliminary survey → main survey → evaluation and conclusion → prepare and submit the systems audit report → follow-up. The preliminary survey is the preparatory step before entering the main survey: the auditor collects materials such as the business operations of the audit target, the system configuration, related rules and regulations, and the results of past audits, grasps the overall picture, judges where risks are likely to lie, and thereby narrows down the scope, priority items, and procedures of the main survey. This is exactly the work of the side that performs the audit, so the auditor does it. The key is to sort the choices by asking “who is the actor”: establishing rules and fixing weaknesses are the job of the audited side (the audited department), while receiving the report and directing improvements is the job of the management that requested the audit; the auditor stays strictly in the position of investigating, evaluating, and reporting (ensuring independence and objectivity).
Incorrectウ
The party that actually fixes the vulnerabilities and problems pointed out in an audit is the audited department, not the auditor. The auditor's role is to point out the points that need improvement and give advice, and then to confirm through follow-up whether the improvements have been carried out. If the auditor performed the improvement work personally, that too would mean evaluating the auditor's own work, which violates independence.
Incorrectエ
The systems audit report is prepared and submitted by the auditor, while the party that receives it is the management that requested the audit (the audit client). The management that receives the report then directs the audited department to make improvements based on its contents. Therefore “receiving” is an act on the client's side, not the auditor's, and the actor is reversed.
ここがポイント
- The basic flow of a systems audit is: draw up the audit plan → preliminary survey → main survey → evaluation and conclusion → prepare and submit the systems audit report → follow-up. The preliminary survey is the step, carried out before the main survey, in which the auditor grasps the outline of the audit target and its risks by collecting materials and the like, and decides the scope, priorities, and procedures of the main survey.
- Remember it by role: the systems auditor is the independent third party that investigates, evaluates, reports, and follows up; the audited department establishes and operates the rules and carries out the improvements for the points raised; the audit client (management) requests the audit, receives the report, and directs the improvements. If the auditor personally establishes rules or makes the improvements, independence and objectivity are lost.
用語