情報システムに関わる業務 a~c のうち, システム監査の対象となり得る業務だけを全て挙げたものはどれか。 a 情報システム戦略の立案 b 情報システムの企画・開発 c 情報システムの運用・保守
平成31年度 春期 ITパスポート試験 問44
This question's explanation and your answers so far.
問 44
Incorrectア
This limits the scope to only a (strategy formulation), which is too narrow. Planning and development (b) and operation and maintenance (c) are also subject to a systems audit, and excluding them makes this option wrong.
- イ
正解 A systems audit is an activity in which an independent third party inspects and evaluates the entire lifecycle of an information system. Its scope covers not only the system currently in operation but also everything upstream — from strategy formulation, through planning and development, to operation and maintenance — that is, all operations and processes related to the information system. Therefore a (formulating the information systems strategy), b (planning and development) and c (operation and maintenance) can all be subject to a systems audit, so option イ (a, b, c), which lists all of them, is correct.
Incorrectウ
Although b (planning and development) and c (operation and maintenance) are subject to audit, a (strategy formulation), which is the upstream process, can also be an audit target. Because it omits a, it fails to include ALL of them and is therefore wrong.
Incorrectエ
This limits the scope to only c (operation and maintenance). The audit scope is not limited to the system in operation but also includes strategy formulation (a) and planning and development (b), so the scope is too narrow and this is wrong.
- The scope of a systems audit = the entire lifecycle of an information system. Not only the system in operation, but all phases — strategy formulation, planning and development, and operation and maintenance — can be subject to audit.
- A systems audit is an activity in which an independent and professional third party inspects and evaluates an information system, and offers advice and promotes improvements to enhance its reliability, safety and efficiency.