IPA IP 2026 Question 47
A question IPA Japan published in 令和8年度 ITパスポート試験 公開問題 問47, translated into English. ITPEC is based on the same exams.
When audits are classified into accounting audits, business operations audits, information security audits, and system audits, which of the following is the most appropriate description concerning the system audit?
Explanation
Verifying that the organization responds appropriately to risks related to information systems — that is the object of a system audit.
A system auditor, independent of the audited area, checks whether the controls over the risks of information systems are designed and operated appropriately, and reports the findings and recommendations to management. Each kind of audit has its own object:
- •accounting audit: the financial statements and the processing behind them
- •business operations audit: whether the work of the organization is done rationally and efficiently according to its policies
- •information security audit: the management of information security risks
- •system audit: the management of the risks of information systems
Answer (c)
Why not others:
- •(a) — effective risk management against the leakage of information is the object of an information security audit
- •(b) — the processing up to the financial statements is checked by an accounting audit
- •(d) — whether all the organization's work, the use of systems included, is run rationally and efficiently under its policies is a business operations audit
Key rule: Name the audit by its object: financial statements (accounting), all business work (business operations), information security (information security), information-system risk (system).
System Audit · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.