システム監査で用いる判断尺度の選定方法に関する記述として,最も適切なものはどれか。
令和6年度 ITパスポート試験 問48
This question's explanation and your answers so far.
問 48
Incorrectア
This choice is wrong in stating that all items of the System Management Standards must be used exactly as they are. The System Management Standards are criteria from which you select and apply the items needed in light of the audit theme; they are not meant to be applied uniformly and compulsorily in their entirety.
- イ
正解 The criteria used in a systems audit (the yardstick by which an auditor judges appropriateness, i.e. the judgment standards) should, in principle, be selected to fit the theme and purpose of the audit. The System Management Standards are a representative set of criteria, but they are not the one and only absolute standard; depending on the theme, other criteria such as various guidelines, laws and regulations, or industry standards may be chosen and used. Choice イ, which states that criteria other than the System Management Standards may be used depending on the theme of the systems audit, correctly describes the flexible way of selecting criteria, and is therefore the most appropriate.
Incorrectウ
This choice is wrong in stating that, regardless of the theme, criteria other than the System Management Standards should not be used. In reality, depending on the theme, other criteria may be selected and used in combination, so this statement is overly restrictive and contradicts the correct method of selection.
Incorrectエ
This choice is wrong in stating that the System Management Standards should not be used in agile development. There is no basis for uniformly excluding the System Management Standards merely because the development method is agile, and this also contradicts the principle of selecting appropriate criteria according to the theme.
- The criteria (judgment standards) for a systems audit are selected to fit the theme and purpose of the audit.
- The System Management Standards are a representative set of criteria but not the only ones; depending on the theme, other criteria can also be selected and used in combination.