平成28年度 秋期 ITパスポート試験 問54

※ Our check while writing this explanation could not fully confirm the published answer; scoring follows IPA's official key.

• ○ア

  正解 The Systems Audit Standards are the code of conduct that a systems auditor must follow; they define standards covering the general, implementation, and reporting aspects for ensuring the quality of audit work and conducting audits effectively and efficiently. Choice ア states exactly “ensuring the quality of audit work” and “conducting audit work effectively and efficiently”, which matches the purpose of the Systems Audit Standards, so it is the correct answer.

• ×Incorrectイ

  The standards for appropriately establishing and operating controls that reduce risks throughout the lifecycle of an information system—planning, development, operation, and maintenance—describe the “Systems Management Standards”. These are standards for the controls that the audited side (the information system administrator) should have in place, not the Systems Audit Standards that define the auditor's code of conduct.

• ×Incorrectウ

  The standards used as a yardstick (measuring stick) when a systems auditor judges the appropriateness of management at information processing sites also refer to the “Systems Management Standards”. The Systems Management Standards are used as a criterion for audit judgment, so their role differs from that of the Systems Audit Standards, which define the auditor's own code of conduct.

• ×Incorrectエ

  The standards for an organization to build an effective information security management system and to establish and operate appropriate controls describe the “Information Security Management Standards (ISMS-related)”. These are management standards specialized for information security, and both their scope and purpose differ from those of the Systems Audit Standards.