IPA IP 2025 Question 53
A question IPA Japan published in 令和7年度 ITパスポート試験 公開問題 問53, translated into English. ITPEC is based on the same exams.
Which of the following is the most appropriate description concerning “response to IT,” which is one of the basic elements of internal control?
Explanation
It does not force new IT systems or updates if existing IT can meet the objectives — response to IT means using IT appropriately, not buying more of it.
Japan’s standard for internal control over financial reporting (the J-SOX framework) has six basic elements: COSO’s control environment, risk assessment and response, control activities, information and communication, and monitoring, plus response to IT. Response to IT means grasping the IT environment around the organisation and using IT appropriately and effectively within internal control. The standard adds that this does not require a new IT system or an update of the existing one: if the objectives can be reached by widening who uses the existing IT or changing how it is used, that is enough.
Answer (b)
Why not others:
- •(a) — IT speeds up processing and reduces careless errors, but cannot prevent all of them: wrong input, program faults and unauthorised changes remain, which is why IT controls are needed
- •(c) — processing built into programs is harder, not easier, to change, since each change needs the programs modified and tested
- •(d) — heavy dependence on IT does not make the objectives hard to reach; it makes response to IT an indispensable element in judging whether internal control is effective
Key rule: Response to IT is about using IT appropriately for internal control; it neither guarantees error-free work nor demands new systems.
System Audit · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.