This question's explanation and your answers so far.
監査を，業務監査，システム監査，情報セキュリティ監査に分類したとき，監査の目的に関する記述a～dと監査の種類の適切な組合せはどれか。 a 財務諸表がその組織体の財産，損益の状況などを適正に表示しているかを評価する。 b 情報セキュリティ確保の観点も含めて，情報システムに関わるリスクに対するコントロールが，リスクアセスメントに基づいて適切に整備・運用されているかを評価する。 c 情報セキュリティに関わるリスクのマネジメントが効果的に実施されるように，リスクアセスメントに基づく適切なコントロールの整備，運用状況を評価する。 d 組織の製造，販売などの会計業務以外の業務全般についてその遂行状況を評価する。
This choice assigns a to the operational audit, but a is the description of a financial audit that evaluates the appropriate presentation of financial statements, not an operational audit. It also assigns b to the information security audit, but b is the description of a systems audit that evaluates the controls over the information system, not an information security audit. The correspondences are misaligned.
It assigns b to the operational audit (b is the description of a systems audit), a to the systems audit (a is the description of a financial audit), and d to the information security audit (d is the description of an operational audit); all three correspondences are wrong.
It assigns c to the operational audit (c is the description of an information security audit), d to the systems audit (d is the description of an operational audit), and a to the information security audit (a is the description of a financial audit); none of them match the correct correspondence.
正解 The correct answer is エ. Match each description to the purpose of the three types of audit. An operational audit “evaluates the execution status of all operations other than accounting operations, such as the organization's manufacturing and sales,” which corresponds to description d. A systems audit “evaluates whether the controls over the risks related to the information system are appropriately established and operated based on risk assessment,” which corresponds to description b. An information security audit “evaluates the establishment and operational status of appropriate controls so that the management of risks related to information security is carried out effectively,” which corresponds to description c. Therefore the combination is operational audit: d, systems audit: b, information security audit: c, so エ is correct. Note that description a “evaluates whether the financial statements appropriately present the organization's assets and profit-and-loss situation,” which is the purpose of a financial audit and is a dummy not included in the three categories (operational, systems, and information security audit) given in the question.