問40
頻出度★★★
情報システムのリスクに対するコントロールが適切に整備運用されていることを検証するための手段として, 最も適切なものはどれか。
平成27年度 春期 ITパスポート試験 問40
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 40
Incorrectア
BCP (Business Continuity Plan) is a plan drawn up in advance that defines the actions to take when an emergency such as a disaster, large-scale failure, or accident occurs, so that core business operations are interrupted as little as possible and, if they are interrupted, are restored within a target time. It is a document that sets out preparations for emergencies, not a means of verifying from an independent standpoint whether day-to-day controls are properly established and operated.
Incorrectイ
ITIL (Information Technology Infrastructure Library) is a set of guidelines that systematically compiles successful cases (best practices) in IT service management, and it is referred to as a handbook when putting service operation and improvement into practice. It is ultimately a reference work showing how to deliver services, not the act of verifying and evaluating the state of controls.
Incorrectウ
IT governance refers to the responsibility of management, and the mechanisms they put in place, for properly directing and controlling the use of IT so that the company establishes competitive advantage and achieves its business objectives, and for monitoring how that use is going. This is the framework of control that gets verified, not the “means” of confirming from an independent position whether that framework is functioning effectively. What is positioned as the means of verification is the systems audit.
- エ
正解 The correct answer is エ. A systems audit is an activity in which a systems auditor — a specialist independent of the department being audited — inspects, evaluates, and verifies whether controls over risks related to an information system are properly established and are operating as intended, reports the results to management in an audit report, and, where necessary, advises and recommends improvements. The wording in the question, “a means of verifying that controls are properly established and operated,” is simply a restatement of the very purpose of a systems audit. For the IT Passport exam, also remember that a systems audit is carried out in line with METI’s Systems Audit Standards and Systems Management Standards, that auditors are required to be independent and objective, and that a risk-based approach is used, focusing verification on areas where the risks are largest.
ここがポイント
- Systems audit = an activity in which a systems auditor, independent of the audited department, inspects, evaluates, and verifies how controls over information system risks are established and operated, reports to management in an audit report, and advises and recommends improvements. The key points are independence and objectivity, plus the risk-based approach of focusing verification on areas with larger risks.
- Telling confusing terms apart: a means of verifying the state of controls → systems audit; the mechanism by which management directs and controls the use of IT → IT governance; a compilation of best practices for IT service operation → ITIL; a plan for continuing and restoring business in an emergency → BCP.
用語