IPA IP 2024 Question 48
A question IPA Japan published in 令和6年度 ITパスポート試験 公開問題 問48, translated into English. ITPEC is based on the same exams.
Which of the following is the most appropriate description concerning the method of selecting the criteria for judgment that are used in a system audit?
Explanation
Standards other than the System Management Standards may be used, depending on the theme — the auditor chooses the criteria for judgment to fit the audit.
In Japan, METI’s System Audit Standards ask the system auditor to set the criteria for judgment that suit the purpose and theme of each audit. METI’s System Management Standards are the usual source, but they are a menu, not a checklist: the auditor picks the relevant items and adapts them, and may add or use other standards (for example the Information Security Management Standards, ISO/IEC standards or the organization’s own rules) where the theme calls for them.
Answer (b)
Why not others:
- •(a) — the items are selected and adapted to the audit; using all of them as they are is not required
- •(c) — forbidding other standards contradicts choosing the criteria by theme; a security audit, for example, naturally draws on security standards
- •(d) — the System Management Standards are not limited to one development method; their items can be selected and adapted for an agile project too
Key rule: Audit criteria are chosen per audit: start from the standard framework, select and adapt what fits, and add other standards where the theme requires them.
System Audit · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.