問42
頻出度★★★
システム監査人の役割として，適切なものだけを全て挙げたものはどれか。 a 監査手続の種類，実施時期，適用範囲などについて，監査計画を立案する。 b 監査の目的に応じた監査報告書を作成し，社内に公開する。 c 監査報告書にある改善提案に基づく改善の実施を監査対象部門に指示する。 d 監査報告書にある改善提案に基づく改善の実施状況をモニタリングする。
令和6年度 ITパスポート試験 問42
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 42
Incorrectア
Item a is appropriate, but b, ‘preparing an audit report and disclosing it within the company,’ is wrong. The auditor’s role is to prepare the report and submit it to the audit client (such as management); disclosing it to the entire company is not the auditor’s role. Because it includes b, it is inappropriate.
- イ
正解 The essential role of a systems auditor is to inspect and evaluate the information system from an independent and professional standpoint, report the results, and prompt improvements. Item a, ‘drawing up an audit plan that defines the types of audit procedures, the timing of execution, the scope of application, and so on,’ is work that a systems auditor must always do in the preparation stage of an audit, so it is appropriate. Item d, ‘monitoring the implementation status of improvements based on the improvement proposals,’ is the activity called follow-up — the role of continuously confirming whether the improvements proposed by the auditor are actually being carried out — so it is appropriate. Therefore only a and d are appropriate, and the correct answer is ‘イ’ (a, d).
Incorrectウ
Neither b nor c is the auditor’s role. As noted above, b’s disclosure within the company is not the auditor’s role; c amounts to instructing that improvements be implemented, which is also wrong. Because it includes none of the appropriate items a and d, it is inappropriate.
Incorrectエ
Item d is appropriate, but c, ‘instructing the audited department to implement improvements,’ is wrong. The auditor only proposes improvements from an independent standpoint and has no authority to instruct or order their implementation (instructing is the role of management and administrators). If the auditor gives instructions personally, independence is impaired. Because it includes c, it is inappropriate.
ここがポイント
- The systems auditor’s role is ‘drawing up the audit plan → conducting the audit → preparing and submitting the audit report → following up on the improvement status,’ and is limited to evaluating and making recommendations from an independent and objective standpoint.
- The auditor is not in a position to ‘instruct or order’ the implementation of improvements or to ‘disclose the report within the company.’ Implementing improvements is the responsibility of the audited department and management, and if the auditor steps into that, independence is impaired.
用語