A financial audit会計監査 independently checks whether a company's financial statements財務諸表 correctly present its financial position and operating results.
Shareholders, lenders, and business partners rely on the figures in financial statements when deciding whether to invest, lend, or trade. A financial audit is how outside experts vouch that those figures can be trusted, and it is mainly carried out by certified public accountants or audit firms.
AnalogyIt is like having a third party match a household ledger's totals against each receipt and the bankbook to see whether anything was left out or inflated.
Exam points
ExamJapan's Companies Act 会社法 requires companies above a certain size, among others, to appoint an accounting auditor会計監査人. The accounting auditor is the statutory role that audits the financial statements 財務諸表.
ExamThe purpose of a financial audit is to confirm that the processing, from recording day-to-day transactions to preparing the closing documents 決算書類, was done without errors or fraud.
An operational audit業務監査 evaluates whether an organization's business activities業務活動, such as purchasing, HR, and logistics, are carried out properly and without waste, in line with its policies and internal rules.
An operational audit looks for problems in how work is done and managed, and leads to improvements. In a company, besides the internal audit department, the corporate auditors監査役 defined in the Companies Act also perform operational audits.
AnalogyIt is like a head-office supervisor touring a store to see whether opening prep and restocking follow the manager's procedures, and pointing out any wasted effort.
Exam points
ExamAn operational audit 業務監査 by corporate auditors 監査役 checks whether the directors取締役 perform their duties in compliance with laws, regulations, and the articles of incorporation.
An information security audit情報セキュリティ監査 independently verifies and evaluates whether the controls protecting an organization's information assets情報資産 match the risks and are working effectively.
Controls here mean measures such as access restrictions and rules on taking information out, which keep the confidentiality機密性, integrity完全性, and availability可用性 of information. The auditor checks not only whether rules have been set but also whether they are actually followed.
AnalogyIt is like an inspector walking through the office and checking not just the safe keys and entry logs but also papers left lying on desks, to see whether company information is properly protected.
Exam points
ExamAn information security audit 情報セキュリティ監査 verifies and evaluates whether the organization's risk management リスクマネジメント for its information assets 情報資産 is working well.
ExamLike other audits, an information security audit starts by drawing up an audit plan.
A systems auditシステム監査 is an activity in which independent experts inspect and evaluate whether an organization's information systems are prepared for risksリスク, that is, whether the mechanisms that keep risks in check (controlsコントロール) are properly designed and actually working.
Planning (IT strategy and plans)
Development
Operation
Maintenance
Its purpose is to evaluate how the organization handles IT-related risks and, through that evaluation, to help the organization achieve its goals. The scope is not limited to systems in operation but covers every stage in the figure above, from planning to maintenance.
AnalogyIt is like an inspector with no stake in a building who reviews it from the design stage through how it is used after completion, and advises the owner to fix anything unsafe.
Exam points
ExamA systems audit システム監査 covers the whole life cycle of an information system, including planning and development, not just operation after go-live.
ExamAn audit carried out by a company's own audit department is called an internal audit内部監査. Even when a systems audit is done as an internal audit, the evaluation is handled by a department independent of the operations being audited.
ExamFor issues raised in a systems audit, the head of the department concerned plans and carries out the improvements.
A systems auditorシステム監査人 is a person who, from a position independent独立 of the audit target, professionally inspects and evaluates information systems and reports the results to the party that requested the audit.
Client requests the audit
Auditor plans, investigates, evaluates
Auditor reports and recommends fixes
Audited department makes improvements
Auditor checks improvement progress
The auditor checks how far the improvements have progressed and evaluates the results.
4 / 4
The auditor draws up an audit plan and evaluates based on the audit evidence監査証拠 (the documents and records that support the evaluation) gathered during the investigation. After reporting, the auditor checks and evaluates how far the audited department被監査部門 has progressed with its improvements, which is called follow-upフォローアップ.
AnalogyIt is like having your class's test graded not by you but by an unrelated teacher; because the grader has no stake in the results, the evaluation can be fair.
How to rememberIn the Japanese word for audit 監査, the first character means "watch over" and the second means "examine." Watching over your own work is not an audit, so let the two characters remind you of independence.
Exam points
ExamEvery auditor involved in an audit must be independent独立 of the audit target. Auditors are chosen from people who stand apart from the operations being audited.
ExamIn an audit requested by top management, the audit report 監査報告書 is submitted, and advice and recommendations for improvement are given, to top management as the client.
ExamAuditors base their judgments on sufficient and appropriate audit evidence 監査証拠. A contingency-fee contract, where the fee depends on the outcome, undermines fair judgment and so violates professional ethics.
The Systems Audit Standardsシステム監査基準 are standards issued by Japan's Ministry of Economy, Trade and Industry that set out the code of conduct行動規範 for systems auditors and how audits should proceed.
Systems Audit Standards
System Management Standards
What it defines
Auditor's mindset and audit procedures
How information systems should be managed
When it is used
Deciding how to conduct the audit
Judging how well the target is managed
Role
Rules for the auditing side
Yardstick for evaluation (audit criteria)
It sets out the auditor's mindset and how to plan, investigate, and report, so that any auditor can conduct an audit to a consistent level. The System Management Standardsシステム管理基準, by contrast, give the yardstick (audit criteria判断尺度) auditors use to judge how well the target is managed.
AnalogyIt is like the rulebook that sports referees follow. Whichever referee blows the whistle, the way calls are made and the level of fairness stay the same.
Exam points
ExamThe aim of the Systems Audit Standards システム監査基準 is to keep audit quality consistent and make audits effective with little waste.
ExamAudit criteria 判断尺度 are chosen to fit the purpose and target of the audit, so other suitable standards can be used besides the System Management Standards システム管理基準.
The risk-based approachリスクアプローチ is a way of auditing that identifies areas where problems are likely or would have a large impact, and concentrates audit time and staff on them.
Identify risks
Rate by likelihood and impact
Assign time and staff to high-risk areas
Examine focus areas in detail
Focus areas are examined in detail, while procedures for low-risk areas are simplified.
4 / 4
Time and staff for an audit are limited, so examining everything to the same depth is hard. The auditor therefore assesses the risks first, examines high-risk areas more closely, and simplifies procedures for low-risk ones.
AnalogyIt is like a health checkup where the doctor looks carefully at areas with a family history or worrying readings and checks areas that seem fine only briefly.
How to remember"Approach" is how you get close to something. The bigger the risk, the closer you get; start from the plain meaning of the English word.
Exam points
ExamBased on the risk assessment, a systems audit システム監査 checks both whether controls コントロール are in place as a mechanism (design 整備) and whether they are actually followed (operation 運用).
Mix-upThe risk-based approach リスクアプローチ decides where an audit puts its focus; it is different from the auditor personally taking measures to reduce risks.
A systems audit inspects and evaluates how information systems are prepared for risks, from planning to maintenance, to help the organization achieve its goals.
A systems auditor stays independent of the audit target, evaluates based on audit evidence, and reports and makes recommendations to the client.
The Systems Audit Standards are the code of conduct for the auditing side, while audit criteria are chosen to fit the audit's purpose.
Under the risk-based approach, audit time and staff are concentrated on high-risk areas.