問41
頻出度★★★
システム監査の目的に関して, 次の記述中の a, b に入れる字句の適切な組合せはどれか。 情報システムに関わるリスクに対するコントロールの適切な整備・運用について, [ a ] のシステム監査人が [ b ] することによって, IT ガバナンスの実現に寄与する。
令和2年度 ITパスポート試験 問41
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 41
Incorrectア
Option a, department in charge that is well-versed in the business, is wrong. The department in charge is the party being audited; if it audits its own department, independence is lost and the audit is not objective. Furthermore, b, construction, is also wrong, because an auditor is not in a position to build the controls themselves (building them would amount to self-auditing and would lack independence).
Incorrectイ
Option b, evaluation, is correct, but a, department in charge that is well-versed in the business, is wrong. If the department in charge that is itself the subject of the audit performs that audit, independence cannot be secured, and the premise of a systems audit is not met.
Incorrectウ
Option a, independent and professional position, is correct, but b, construction, is wrong. The auditor's role is to evaluate the state of establishment and operation of controls, not to build the controls themselves. Taking on the building would amount to self-auditing and would impair objectivity.
- エ
正解 The two core requirements for a Systems Auditor are independence and professional expertise. Precisely because the auditor is independent of the audited department (the department in charge) and stands in a professional position, they can objectively judge whether the establishment and operation of controls over information-system risks is appropriate. Moreover, what a Systems Auditor undertakes is not to build the controls themselves, but to evaluate their appropriateness as a third party and to advise and report to management. This independent evaluation contributes to the realization of IT governance. Therefore the combination a = independent and professional position, b = evaluation, namely エ, is correct.
ここがポイント
- The requirements for a Systems Auditor are independence and professional expertise: auditing objectively from a position independent of the audited department (the department in charge).
- A Systems Auditor's role is not to build controls themselves, but to evaluate the appropriateness of their establishment and operation as a third party, thereby contributing to IT governance.
用語