p. 378 · PDF 385

1 System Audit

A system audit is a way to objectively certify whether or not the measures against risks concerning the information system are developed and operated appropriately from an independent standpoint. In addition, accountability to the stakeholders is fulfilled by sharing the audit results.

1 - 1 Purpose and Concept of Audit

An audit refers to supervising/verifying an event or a subject. Apart from system audits, audits related to companies and information systems include the following.

• Accounting audit This is an audit that verifies the reliability of financial statements. • Business operations audit This is an audit that verifies effectiveness, security, reliability, and such other aspect of business activities. • Information security audit This is an audit that verifies whether or not risk management pertaining to information security measures is effectively conducted. It is conducted in accordance with the Information Security Audit Standards, from the viewpoint of whether or not the audit target is compliant with the Information Security Management Standards. • Personal information protection audit This is an audit that verifies whether or not the personal information protection system satisfies JIS Q 15001 (Personal information protection management system — Requirements) or a privacy mark system compliant with JIS Q 15001. • Compliance audit This is an audit that verifies whether or not any law (e.g., the Copyright Act, the Industrial Property Law, the Unfair Competition Prevention Act, laws and regulations on labor such as the Labor Standards Act, business-related laws and regulations) is violated.

View original source box · p. 378

Enlarge original source box

The bordered list identifies accounting, business operations, information security, personal information protection and compliance audits, followed by each original description.

While audits have the following sections, these are not exclusive. For example, an accounting audit, which is one of the statutory audits, is conducted as an external audit by a certified public accountant.

p. 379 · PDF 386

Audit classification	Overview
Statutory audit	This refers to an audit that is stipulated as mandatory by laws such as the Companies Act.
Voluntary audit	This refers to an audit that is conducted by the organizations at their own discretion for a specific purpose.
External audit	This refers to an audit that is conducted by a certified public accountant, an external association (i.e., auditing organizations), etc.
Internal audit	This refers to an audit that is conducted by the audit department of the organization that has a department to be audited.

View original table · p. 379

Enlarge original table

In addition, for the purpose of popularizing audits, the “list of companies providing system auditing services” and the “list of companies providing information security auditing services” are published, which are the summarized list of parties (including individual business operators) that conduct audits according to the audit standards and management standards defined by the Ministry of Economy, Trade and Industry. Users can access these lists.