ITPEC IP October 2020 Question 63

Controlling the risks of the information system so it functions safely, effectively and efficiently — the purpose of a systems audit.

A systems auditor, independent of the systems being audited, evaluates the controls over the risks surrounding an information system: whether it is reliable, secure, effective and efficient, and whether it contributes to business objectives. The auditor reports the findings to management with advice and recommendations, so that management can bring those risks under control. The audit checks and advises; it does not itself operate, develop or plan the system.

Answer (d)

Why not others:

• •(a) — taking backups is an operational task in running the system; an audit may check that backups are taken, but taking them is not its purpose
• •(b) — improving the skills of development staff is human resource development
• •(c) — investigating user needs and documenting them as computerization requirements is systemization planning and requirements definition, work the audit evaluates rather than performs

Key rule: A systems audit is an independent evaluation of how well information-system risks are controlled, reported to management; the auditor never does the operations, development or planning being audited.

System Audit · AI-written, may contain errors