問35
頻出度★★★
システム監査は, 監査対象から独立かつ客観的立場のシステム監査人が情報システムを総合的に点検及び評価する。ある企業の経営者から依頼され実施したシステム監査の結果, 現在の情報システムの有効性に問題があることが発見された。システム監査人が, 助言及び勧告する相手として, 最も適切な者は誰か。
平成27年度 秋期 ITパスポート試験 問35
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 35
Incorrectア
Although shareholders are the owners of the company, they are neither the party that commissioned the systems audit nor in a position to carry out improvements to a specific information system. They are not the party the auditor gives advice and recommendations to directly, so this is incorrect.
Incorrectイ
The supervisory government agency is an external body that performs administrative oversight, not the recipient of recommendations for a systems audit commissioned within the company. It does not make sense for the auditor to make recommendations about the company’s own problems to a government agency, so this is incorrect.
- ウ
正解 The principle is that a systems auditor reports the results to, and gives advice and recommendations to, “the party that commissioned the audit.” In this question, the audit was commissioned by the company’s management, and since a problem was found with the effectiveness of the information system, it is management who can judge on the corrective action and decide on the allocation of business resources. Therefore, the most appropriate party to receive the advice and recommendations is “management,” and the correct answer is ウ.
Incorrectエ
Users of the system are merely those who use the information system that needs improvement, and they do not have the decision-making authority to correct the effectiveness problem. Even if they receive advice and recommendations, they cannot decide on a response, so they are not the most appropriate party, and this is incorrect.
ここがポイント
- The systems auditor submits the audit report to the management that commissioned the audit, pointing out the problems and giving advice and recommendations for improvement.
- The systems auditor holds an independent and objective position; their role is not to carry out improvements themselves but to make recommendations to the management who can decide on the corrective action.
用語