IPA IP 2025 Question 38
A question IPA Japan published in 令和7年度 ITパスポート試験 公開問題 問38, translated into English. ITPEC is based on the same exams.
Which of the following is the most appropriate description of an information security audit?
Explanation
Verifying or evaluating whether the risk management of the organization's information assets is effective — that is an information security audit.
An information security audit is carried out by auditors independent of the audited area. They check, against audit criteria, whether the risks to the organization's information assets are managed effectively, that is, whether the controls protecting confidentiality, integrity and availability are designed and operated properly, and they report the result with assurance or advice. Its object is information security, not the use of IT systems in general.
Answer (d)
Why not others:
- •(a) — verifying and evaluating the use of IT systems against set criteria and giving assurance on governance and advice for improvement is a system audit
- •(b) — a tool that physically prevents a computer from being stolen or taken out without permission is a security wire (cable lock), a physical security measure, not an audit
- •(c) — setting the IT strategy and policies for the ideal use of IT systems, and the activities to realize them, to raise the organization's value and the trust in it, is IT governance
Key rule: System audit: the risks of IT systems and their use, with governance; information security audit: the risk management of information assets; IT governance is what management does, the audits only check it.
System Audit · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.