問37
頻出度★★★
システム開発部門のシステム監査における実施事項はどれか。
平成28年度 春期 ITパスポート試験 問37
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 37
Incorrectア
Drafting the outsourcing contract concluded with the development contractor is work performed by the side that drives development and procurement (the development department or managers), not an activity carried out by the auditor. The auditor is in a position to evaluate and point out whether the contract terms are appropriate, not to draw up the contract itself.
Incorrectイ
Fixing defects found during the review of the external design document is development work performed by developers. If the auditor were to fix the deliverables themselves, their independence would be undermined, so this is not an audit activity.
- ウ
正解 A systems audit is an activity in which a systems auditor, holding a position independent of the audited department, objectively evaluates the target work, “points out” problems, and makes improvement proposals. Choice ウ, “pointing out deficiencies in the system development procedure”, is exactly the kind of audit activity in which the auditor inspects the development process, uncovers flaws in the procedure, and points them out. Therefore ウ is correct.
Incorrectエ
Providing programming training to programmers is a personnel-development activity within the development department, not the auditor's duty. While the auditor may evaluate whether the training system is appropriate, they do not carry out the training itself.
ここがポイント
- A systems auditor, from an independent third-party position relative to the audited department, objectively evaluates the work, points out deficiencies, and makes improvement proposals (they do not perform the actual work of contract drafting, fixing, or training).
- The key point is to distinguish whether a choice is an “audit” activity (evaluating and pointing out) or “the audited department's actual work” (drafting, fixing, or training).
用語