ITPEC IP October 2023 Question 63
Which of the following is a process where a third party inspects and evaluates the security and reliability of the information system of a company, and if necessary, the third party makes suggestions and recommendations to the party being inspected and evaluated.
Explanation
System audit — an independent third party inspects and evaluates an information system and recommends improvements.
A system auditor, independent of the system and of the department being audited, collects audit evidence, judges whether the information system is secure, reliable and effective, and reports the findings together with recommendations for improvement. The audited side then plans and makes the improvements; the auditor only points them out.
Answer (a)
Why not others:
- •(b) System management — the day-to-day operation and control of a system by the people responsible for it, not an independent evaluation
- •(c) System design — deciding the structure, functions, data and interfaces of a system before it is built
- •(d) System test — checking that a built system meets its requirements, done by the developers or users, not a third-party evaluation with recommendations
Key rule: Independence, evaluation against criteria and recommendations to the audited party are the marks of an audit; the auditor recommends but does not fix.
System Audit · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.