ITPEC FE System Audit Questions with Answers

System Audit

25 questions · Fundamental Engineering

Oct 2025 · Question 45

In the system design phase, when an audit is performed on the control to reduce the risk of user requirements not being met, which of the following is a point to be checked?

a)Whether programming is performed in accordance with the specified conventions and standardsb)Whether the program specifications are created on the basis of the system design documentsc)Whether the test plan is created on the basis of the system test requirements, and the manager’s approval of the system operations department is obtainedd)Whether the user department participates in the review of the system design documents

Apr 2025 · Question 45

Which of the following is a checkpoint for auditing the control of risks related to information leakage and unauthorized use of documents concerning a system?

a)Creating the necessary documents even in prototype developmentb)Standardizing documentsc)Taking measures to ensure the confidentiality of documentsd)Updating documents without delay as changes are made in the system

Oct 2024 · Question 45

Which of the following is the most appropriate description of a system auditor?

a)The entire audit interview must be conducted by one (1) system auditor, because discrepancies may occur in the record if multiple auditors are involved.b)The system auditor must instruct the department being audited to implement improvement measures for deficiencies identified during the audit interview.c)The system auditor must make an effort to obtain documents and records that support the information obtained from the department being audited during the audit interview.d)The system auditor must select audit interviewees from administrators who have been an auditor within the department being audited.

Apr 2024 · Question 45

Which of the following is the most appropriate description concerning an interview conducted by a system auditor?

a)The administrator of the audited department, who has experience in auditing tasks, is selected as the interviewee.b)The entire interview is conducted by one (1) system auditor, as discrepancies may occur in the record if multiple auditors are involved.c)The system auditor instructs the audited department to take improvement measures for deficiencies found during the interview.d)The system auditor makes an effort to obtain documents and records that support the information obtained from the audited department during the interview.

Oct 2023 · Question 59

Which of the following is an explanation of an audit work paper?

a)A compilation of the information security promissory letter that is presented to the audited department when the auditor implements an auditb)A compilation of the standards and guidelines used by the auditor for implementing an auditc)A document that must be disclosed along with the audit report to prove that the auditor has fulfilled his or her obligations with proper attentiond)An execution record of the auditing procedure by an auditor, and it forms the basis of the audit opinion

Oct 2023 · Question 60

Which of the following is an appropriate description concerning a system audit team?

a)For an audit of the development progress in an information systems department, the audit team consists of members of the information systems department who are familiar with the details of the development.b)In order to enable the person requesting the audit to issue improvement instructions on the basis of the audit report, the system audit team reports the audit results to the person requesting the audit.c)When an audit of the information system is performed as a part of the business operations audit, the audit team is formed by the members of the user’s department.d)When the system audit team accepts the help of an expert, the decisions concerning the range of support, methods, and audit results is the responsibility of the expert.

Oct 2022 · Question 59

Which of the following is the most appropriate purpose for which a system auditor exchanges opinions with an audited department concerning the draft version of an audit report?

a)To confirm that there are no factual errors in the findings and recommendations to be described in the audit reportb)To issue the audit report to the audited department before the audit report is submitted to the person who is requesting the auditc)To receive the approval of the responsible person of the audited department concerning the recommendations described in the audit reportd)To substitute with additional auditing activities concerning the part of the audit report for which evidence is insufficient by orally confirming with the audited department

Oct 2022 · Question 60

Which of the following is the appropriate activity performed by a system auditor who audits access control?

a)Creating and storing the access control records for the softwareb)Establishing an access control policy for the networkc)Implementing the access control procedures for hardwared)Viewing the access control rules for data

Apr 2022 · Question 59

Which of the following is an appropriate description of a checkpoint during the audit of a control for reducing the risk of system trouble regarding the application of a software patch?

a)A database administrator is appointed and master data management procedures are specified.b)Capacity planning procedures are set out.c)Hardware maintenance records are created and managed by system administrators.d)The system’s operation status is properly checked before commencing full-time operations.

Apr 2022 · Question 60

Which of the following is subject to system audits that evaluate and verify internal controls related to IT?

a)Methods for ensuring accuracy when the sales department inputs into and updates the databaseb)The process by which the business planning department leads the creation of a mid-term business planc)The results of employee personnel evaluations led by the personnel departmentd)The status of production equipment review conducted by the manufacturing department for the purpose of reducing defects

Apr 2021 · Question 59

In the system design stage, which of the following is the point to be checked during the audit of control for reducing the risk of non-fulfillment of user requirements?

a)All programming should be performed in accordance with the specified standards and conventions.b)The program specifications should be created on the basis of the system design documents.c)The test plan should be created on the basis of the system test requirements and must also be approved by the responsible person of the system operations department.d)The user department should participate in the review of system design.

Apr 2021 · Question 60

When IT controls are classified into preventive controls and detective controls, which of the following is to be classified as a detective control?

a)A data entry manual is created, and the persons in charge of data entry are trained.b)A data entry screen is designed so that operation errors are unlikely to occur.c)Access rights are assigned only to the person in charge of data entry.d)An output list resulting from data entry is cross-checked with the input form.

Oct 2021 · Question 59

Which of the following is the most appropriate point to be checked in the audit of a system test?

a)The test cases were created comprehensively.b)The test plan was approved only by the responsible person on the user’s side.c)The test was performed in an environment where the actual business operations are performed.d)The test was performed only by the person in charge on the user’s side.

Oct 2021 · Question 60

The director requested a system auditor to audit the operating status of an accounting system that was developed by the information systems department and is operated by the accounting department. Which of the following is the most appropriate description concerning the system auditor for this audit?

a)The system auditor must be a certified public accountant because the accounting system must conform to the various standards of business accounting.b)The system auditor must be a person who belongs to neither the information systems department nor the accounting department to guarantee independence.c)The system auditor must report directly to the accounting department manager because the accounting system handles highly confidential information.d)The system auditor must report directly to the information systems department manager to perform system audits efficiently.

Apr 2020 · Question 58

Among situations that are identified as results of performing an ISMS internal audit on the basis of ISO/IEC 27001:2013 (Information security management systems—Requirements), which of the following is a situation that the auditor should record in the audit report as a finding?

a)After a risk assessment was performed, risk acceptance criteria were determined.b)An incident of erroneous disposal of personal information was reported to a competent authority with specified procedures.c)Spyware was detected by a malware scan, and it was disinfected.d)The use of a USB memory was permitted in accordance with defined procedures.

Apr 2020 · Question 59

An information security audit was performed about the security when backup media that contain confidential information are handed over to a vendor for external storage. Among situations that are identified as a result of this audit, which of the following is a situation that the auditor should record in the audit report as a finding?

a)The person in charge at the outsourcer describes the date and details in a dedicated record book and gets a stamp of receipt from the vendor each time the media is handed over.b)The person in charge at the outsourcer puts the backup media in a cardboard box and hands it over to the vendor.c)The responsible person at the outsourcer concludes a contract that requires confirmation of the storage status of media at the vendor at every set period, and then the media is handed over.d)The responsible person at the outsourcer concludes an outsourcing contract that includes confidentiality provisions with the vendor, and then the media is handed over.

Oct 2020 · Question 59

Which of the following is the most appropriate measure that a management executive must take to secure the appearance of independence for an internal system auditor?

a)Assigning the system auditor to the internal audit departmentb)Making it compulsory for the system auditor to undergo continuous learning of ITc)Setting up an auditing-skills training system for the system auditord)Specifying and publishing the knowledge and experience necessary for the system auditor

Oct 2020 · Question 60

When software asset management is audited, which of the following activities is the most appropriate?

a)It is checked to see if compatibility with existing systems is evaluated at the time of installation.b)It is checked to see if evidence, such as a software-license certificate, is properly retained.c)It is checked to see if failures are localized via database partitioning or other methods.d)It is checked to see if the organizational and functional structure of the software provider is considered.

Oct 2019 · Question 59

Which of the following is an appropriate activity for a system auditor?

a)The auditor moves forward with the preparation of an audit report because the initially scheduled period finished in the middle of an investigation.b)The auditor orders improvements for problems that are found in the course of each investigation.c)The auditor points out items that need to be improved regarding problems found during the investigation.d)The auditor summarizes audit opinions for matters that have not been fully investigated, on the basis of his or her past experience.

Oct 2019 · Question 60

Among the implementation structures of a system audit, which of the following is the most important to avoid from the standpoint of the independence of a system auditor?

a)Mr. A of the general affairs department, who was appointed as a member of the audit team, audits the status of entrance and exit control for the general affairs department together with other team members.b)Mr. B of the audit department audits the status of personal information management by an external contractor to whom his company outsources business operations that deal with personal information.c)Mr. C, who was transferred to the audit department five (5) years ago from a development manager position in the information system department, audits the status of Internet use in the marketing department.d)Mr. D of the legal department cooperates with an auditor in an audit of the validity of an outsourcing contract in response to a request from the audit department.

Apr 2019 · Question 58

Which of the following is the system audit implementation structure that should be avoided from the standpoint of independence of the system auditors?

a)A person, who five (5) years ago was transferred to the audit department from a development manager position in the information systems department, audits the status of the Internet usage in the marketing department.b)A person in the audit department audits the status of the personal information management in the external contractor to whom personal information handling is outsourced.c)A person in the general affairs department, who is appointed as a member of the audit team, audits the status of the entrance and exit control in the general affairs department, together with the other members.d)A person in the legal department, in response to a request by the audit department, cooperates with the auditors in auditing of the validity of the outsourcing contracts.

Apr 2019 · Question 59

Which of the following is an appropriate activity that is undertaken by a system auditor who audits access control?

a)Confirmation of the management status of the access control concerning the datab)Creation and storage of a management table for the access control concerning the softwarec)Establishment of a management policy for the access control concerning the networkd)Implementation of the operations management for the access control concerning the hardware

Apr 2019 · Question 60

Which of the following is subject to system audits that evaluate and verify the internal control related to IT?

a)The methods for ensuring accuracy in the processes of input and update of a database performed by the sales departmentb)The process for the creation of a mid-term business plan by the business planning departmentc)The results of the employee personnel evaluations by the personnel departmentd)The status of the production equipment review conducted by the manufacturing department for the purpose of reducing defects

Oct 2018 · Question 59

Among the statuses found through auditing the operation management of the system operations, which of the following must be described in the audit report as a finding?

a)The operator decides a daily operation plan and approves it himself.b)The operator records the exception handling that occurs during the operation.c)The person responsible for operations checks the operation records created by the operator.d)The person responsible for operations stores the operation records by specifying the time period.

Apr 2018 · Question 60

Which of the following is an appropriate description concerning the implementation of a system audit?

a)For an audit of the development status of an information systems department, the audit team consists of members of the information systems department who are familiar with the details of the development.b)In order to enable the person requesting the audit to issue improvement instructions on the basis of the audit report, the system auditor reports the audit results to the person requesting the audit.c)When a system audit is performed as part of an operations audit, the audit team consists of members of the user department.d)When a system auditor accepts the help of other experts, the experts become responsible for decisions concerning the scope and methods of support, as well as the audit result.