IPA IP 2026 Question 35

Topic: System Audit

A question IPA Japan published in 令和8年度 ITパスポート試験 公開問題 問35, translated into English. ITPEC is based on the same exams.

For the management and processes involved in the planning, development, operation, and maintenance of information systems, management needs to perform evaluation, direction, and monitoring as its activities in IT governance. Which of the following lists all and only the appropriate descriptions concerning the activities of management in IT governance?

AResponsibility and authority are delegated to an external consultant, who is left to handle everything from strategy formulation to monitoring.BInformation is collected to check to what extent the effects assumed in the information system strategy have been achieved.CThe responsibilities and personnel required to realize the information system strategy are assigned to the organization.DMultiple future visions of the information system are envisaged, and external information system experts are asked to perform a comparative analysis for evaluation.

Explanation

B, C, D — management evaluates, directs and monitors IT, and may use outside experts, but cannot hand its own responsibility over to them.

The IT governance standard ISO/IEC 38500 gives management three tasks:

  • •Evaluate the current and future use of IT: D, comparing several future visions with the help of an expert analysis, then evaluating them
  • •Direct the preparation and implementation of plans and policies: C, assigning the responsibilities and staff that the strategy needs
  • •Monitor performance and conformance: B, collecting information on how far the expected effects have been achieved

A hands responsibility and authority for everything, from strategy to monitoring, to an outside consultant. Management can delegate tasks, but it stays accountable for IT governance and must make the decisions itself.

Answer (d)

Why not others:

  • •(a) A, B, C — includes A, which gives up the responsibility that governance places on management
  • •(b) A, C — includes A and leaves out B, the monitoring activity
  • •(c) B, C — leaves out D; asking experts for analysis is fine as long as management does the evaluation

Key rule: IT governance is management's Evaluate–Direct–Monitor cycle; advice may come from outside, but accountability cannot be delegated.

System Audit · AI-written, may contain errors

Practice this exam

This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.