問40
頻出度★★★
IT ガバナンスに関する記述として, 適切なものはどれか。
平成30年度 春期 ITパスポート試験 問40
マネジメント系システム監査 › 内部統制
This question's explanation and your answers so far.
解説
問 40
Incorrectア
IT governance is an effort needed by every organization that uses IT; it is not something built only by IT vendors. Since any company or organization that uses IT is subject to it, “not needed in other organizations” is incorrect.
Incorrectイ
Under IT governance, policies should be established under the responsibility of management, so it is not appropriate for a single department that manages IT to define company-wide rules “on its own.” Company-wide principles and rules must be formulated and agreed upon under the leadership of management, and having one department decide them unilaterally and disseminate them is wrong as a form of governance.
- ウ
正解 The correct answer is ウ. IT governance is a mechanism in which management (top management) takes the lead in defining principles and policies for the use of IT, spreads them throughout the entire organization, and directs and controls IT investment and information systems so that they contribute to achieving business goals. Choice ウ, “Management establishes the principles and policies concerning IT, and each department carries out activities in accordance with the policies,” correctly expresses the division of roles in which management shows the direction (governance) and each department executes according to that policy, and it matches the essence of IT governance.
Incorrectエ
It is correct that the responsibility for IT governance lies with management, but “all activities are carried out by management” is incorrect. Management's role is to establish principles and policies and to provide direction and oversight, while the actual activities are carried out by each department in accordance with the policies. Not all activities are performed by management itself.
ここがポイント
- IT governance = a mechanism in which management takes the lead in defining IT principles and policies and directs and controls the entire organization so that IT contributes to achieving business goals.
- The key point is the division of roles: the responsibility lies with management, but execution is handled by each department in accordance with the policies (governance = direction/oversight, operations = each department).
用語