問54
頻出度★★★
事業活動に関わる法令の遵守などを目的の一つとして，統制環境，リスクの評価と対応，統制活動，情報と伝達，モニタリング，ITへの対応から構成される取組はどれか。
令和6年度 ITパスポート試験 問54
マネジメント系システム監査 › 内部統制
This question's explanation and your answers so far.
解説
問 54
Incorrectア
CMMI stands for “Capability Maturity Model Integration,” a model for evaluating and improving the maturity of processes such as software development on a five-level scale. It is not a control framework aimed at legal compliance, and it has no relation to the six components in the question, so it is incorrect.
Incorrectイ
ITIL is a framework that systematizes best practices for IT service management. Its purpose is to improve the operational quality of IT services; it does not define internal-control components such as the control environment or monitoring, so it is incorrect.
- ウ
正解 The correct answer is choice ウ, “Internal Control.” The six components listed in the question — control environment, risk assessment and response, control activities, information and communication, monitoring, and response to IT — are exactly the basic elements defined by Japan’s internal control framework (the Financial Instruments and Exchange Act, J-SOX). Internal control aims at the effectiveness and efficiency of operations, the reliability of financial reporting, compliance with laws and regulations related to business activities, and the safeguarding of assets; it is a mechanism that an organization establishes and operates on its own. The wording in the question, “aiming, among other things, at compliance with laws and regulations related to business activities,” matches exactly the purpose of internal control, so ウ is correct.
Incorrectエ
Risk management is an activity that identifies, assesses, and responds to risks. It corresponds to only one part — “risk assessment and response” — among the six components in the question, and is not an initiative made up of all six components, so it is incorrect.
ここがポイント
- The basic elements of internal control (six components) = control environment, risk assessment and response, control activities, information and communication, monitoring, and response to IT. The last one, “response to IT,” is an element added uniquely in Japan.
- Keep in mind that one purpose of internal control is “compliance with laws and regulations related to business activities,” and that it is a mechanism the organization establishes and operates on its own.
用語