IPA IP 2020 Question 41
A question IPA Japan published in 令和2年度 10月 ITパスポート試験 公開問題 問41, translated into English. ITPEC is based on the same exams.
Same question on ITPEC: Oct 2022 Q64
Which of the following is the appropriate combination of terms or phrases to be inserted into blanks A and B in the description below concerning the purpose of system audits?
With regard to the appropriate design and operation of the control for risks concerning information systems, the system auditor A contributes to the realization of IT governance by performing B.
Explanation
A: having an independent and professional standpoint, B: evaluation — the system auditor evaluates controls from outside the audited work.
The purpose of a system audit is for an auditor who is independent of the audited department and has professional knowledge to check and evaluate whether the controls for information-system risks are properly designed and operated. The auditor then reports the results and gives recommendations for improvement, which helps management govern IT. Designing and running the controls stays with management and the departments concerned.
Answer (d)
Why not others:
- •(a) — wrong on both blanks: an auditor from the responsible department audits their own work, and implementing controls is management's job, not the auditor's
- •(b) — evaluation is right, but an auditor belonging to the responsible department is not independent, however well they know the business
- •(c) — the standpoint is right, but an auditor who implements the controls would then be auditing their own work
Key rule: An auditor must be independent in both appearance and fact, and only evaluates and recommends; the audited side designs, implements and improves the controls.
System Audit · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.