問53
頻出度★★★
情報システム部がシステム開発を行い, 品質保証部が成果物の品質を評価する企業がある。システム開発の進捗は管理部が把握し, コストの実績は情報システム部から経理部へ報告する。現在, 親会社向けの業務システムの開発を行っているが, 親会社からの指示でシステム開発業務に対するシステム監査を実施することになり, 社内からシステム監査人を選任することになった。システム監査人として, 最も適切な者は誰か。
平成30年度 秋期 ITパスポート試験 問53
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 53
Incorrectア
A member of the development project team is precisely a party carrying out the system development work that is the audit target. This would amount to a self-audit in which one audits the very work one performed, so independence and objectivity cannot be ensured. Even with audit experience, they belong to the audited side and are therefore inappropriate.
- イ
正解 A systems auditor is first and foremost required to be organizationally independent of the department under audit (independence and objectivity). Here the audit target is the “system development work,” whose executing body is the information systems department. The accounting department merely receives reports of actual costs from the information systems department; it participates in neither the execution nor the progress management of the system development, so it is independent of the audited department. In addition, this staff member has audit experience, making them the most appropriate person to appoint as a systems auditor selected from within the company, so “イ” is the correct answer.
Incorrectウ
The quality assurance department is in the position of evaluating the quality of the business system under development, and is directly involved in the development process itself. Because it is a department that handles part of the work being audited, it lacks independence and is inappropriate as an auditor.
Incorrectエ
The head of the information systems department is the very leader of the department that performs the system development being audited. As the top of the audited department, they have the least independence, so appointing them as the systems auditor is inappropriate.
ここがポイント
- The key requirement for a systems auditor is independence: choose someone who is organizationally independent of the audited department and who can rule out self-auditing.
- The principle is to appoint someone with auditing ability from a department that is not involved in performing or evaluating the audit target (here, the system development work = the information systems department).
用語