ITPEC IP October 2022 Question 64
Which of the following is the appropriate combination of terms or phrases to be inserted into blanks A and B in the description below concerning the purpose of system audits?
With regard to the appropriate design and operation of the control for risks concerning information systems, the system auditor A contributes to the realization of IT governance by performing B.
Explanation
A: having an independent and professional standpoint, B: evaluation — the system auditor evaluates controls from outside the audited work.
The purpose of a system audit is for an auditor who is independent of the audited department and has professional knowledge to check and evaluate whether the controls for information-system risks are properly designed and operated. The auditor then reports the results and gives recommendations for improvement, which helps management govern IT. Designing and running the controls stays with management and the departments concerned.
Answer (d)
Why not others:
- •(a) — wrong on both blanks: an auditor from the responsible department audits their own work, and implementing controls is management's job, not the auditor's
- •(b) — evaluation is right, but an auditor belonging to the responsible department is not independent, however well they know the business
- •(c) — the standpoint is right, but an auditor who implements the controls would then be auditing their own work
Key rule: An auditor must be independent in both appearance and fact, and only evaluates and recommends; the audited side designs, implements and improves the controls.
System Audit · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.