令和7年度 ITパスポート試験問59

This question's explanation and your answers so far.

問59

頻出度★★★

ISMS における内部監査に関する記述のうち, 適切なものはどれか。

出典　令和7年度 ITパスポート試験問59

解説

問 59

ア
正解 The correct answer is ア. An ISMS internal audit is carried out from two perspectives. First, "conformity": whether the ISMS conforms to the audit criteria, which consist of the requirements of JIS Q 27001 plus the information-security requirements (policies, procedures, etc.) defined by the organization itself. Second, "effectiveness": whether the ISMS is actually being effectively implemented and maintained and is benefiting the organization. ア states that both are evaluated, which correctly matches the purpose of an internal audit (JIS Q 27001 clause 9.2).
Incorrectイ
The audit criteria consist of both "the requirements of JIS Q 27001" and "the requirements specified by the organization itself." Excluding the JIS Q 27001 requirements and using only the organization's own requirements as the criteria is wrong, since conformity with the standard could then not be confirmed.
Incorrectウ
When establishing the internal audit program (plan), the standard requires taking into account the importance of the processes concerned and "the results of previous audits." Stating that the previous results are not considered is wrong.
Incorrectエ
The principle is that internal audits are conducted in a planned manner at "predetermined intervals (planned intervals)." Making irregular, surprise audits the rule is wrong; they should be carried out in a planned way based on a program that defines the audit criteria, scope, frequency, and methods.

ここがポイント

The purpose of an ISMS internal audit is to evaluate both "conformity" (whether it conforms to JIS Q 27001 and the requirements defined by the organization itself = the audit criteria) and "effectiveness" (whether the ISMS is effectively implemented and maintained).
Internal audits should be conducted in a planned manner at predetermined intervals, and the audit program should be established taking into account the results of previous audits and the importance of the items concerned (JIS Q 27001 clause 9.2).

用語

解答問59ア