ITPEC IP October 2025 Question 63

Verifying that controls against information-system risks are implemented and operated appropriately — this is what a system audit does.

A system auditor, independent of the department being audited, collects audit evidence and checks whether the controls that address the risks of an information system (to its reliability, security and efficiency) are properly designed and actually work. The auditor then reports the findings to top management with recommendations for improvement, and follows up on them. Management builds and runs the controls; the audit evaluates them.

Answer (b)

Why not others:

• •(a) — a framework for implementing IT service management is ITIL (or ISO/IEC 20000), not an audit
• •(c) — technology and techniques for developing good software efficiently are software engineering
• •(d) — applying knowledge, skills, tools and techniques to project activities to meet project requirements is the PMBOK definition of project management

Key rule: An audit is an independent evaluation: the auditee runs the controls, and the auditor gathers evidence on whether they work and reports to management.

System Audit · AI-written, may contain errors