ITPEC IP April 2024 Question 63

Activities that do not make use of information systems are not targeted — a system audit examines information systems and the work that relies on them.

A system audit is an independent evaluation of an organization's information systems (their planning, development, operation and use, and the controls around them) to judge whether they are reliable, secure and effective and support the business goals. Its scope is set by the information system: any organization, public or private, and any business activity that uses one can be audited, whether or not the system is connected to the Internet. An activity carried out entirely without an information system gives a system audit nothing to evaluate.

Answer (d)

Why not others:

• •(a) — private companies' information systems are targets; most system audits are in fact commissioned by companies
• •(b) — a standalone or closed-network system is still an information system; Internet use does not decide the scope
• •(c) — restricting the audit to accounting describes an accounting audit; a system audit covers sales, production, personnel and any other activity that uses information systems

Key rule: An audit is defined by its object: an accounting audit looks at the financial statements, a system audit at information systems and their use, whatever the organization or network.

System Audit · AI-written, may contain errors