問39
頻出度★★★
システム監査人の役割に関する記述として, 適切なものはどれか。
平成28年度 春期 ITパスポート試験 問39
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 39
Incorrectア
Preparing business flowcharts, business descriptions, and a risk control matrix, assessing risks, and “introducing” appropriate controls is the role of the side that establishes and operates the controls (the department in charge of internal control). The auditor is not the one who introduces controls, but the one who verifies from the outside whether they are effective, so this is incorrect.
Incorrectイ
Introducing monitoring and self-inspection mechanisms at each phase of planning, development, operation, and maintenance, and taking measures to keep the information system running stably, is the role of the audited department that manages and operates the system. The auditor does not take such measures, so this is incorrect.
- ウ
正解 The essential role of a systems auditor is to verify, from an objective position independent of the audited department, whether the risks of an information system are appropriately and effectively controlled, and to report the results to the client (such as management). Choice ウ correctly states these two points, “verification from an independent position” and “reporting to the client,” which matches the role of a systems auditor itself. The key point is that the auditor does not take part in designing or operating the controls, but only evaluates and reports as a third party.
Incorrectエ
Establishing policies and objectives and putting in place a structure so that risks are appropriately controlled is the role of management (the side responsible for governance). The auditor is not the one who sets policies and structures, but the one who verifies whether they are functioning, so this is incorrect.
ここがポイント
- The role of a systems auditor is to verify the effectiveness of risk control from “the standpoint of an independent, objective third party” and report to the client; the auditor does not establish or operate controls, nor make policy decisions.
- An easily confused division of roles: the control department introduces controls, the audited department takes operational measures, management sets policies and structures, and the auditor verifies and reports on all of these.
用語