AP26 System Audit, Internal Control, Security Risk, and Incident Handling

2026 basis · no pass guarantee

Learning index

1. Purpose and flow of system audit
2. Internal control and IT controls
3. Security risk assessment and treatment
4. Security-incident handling and evidence preservation
5. Five original four-choice questions
6. Sources, boundary, and disclaimers

Shared terminology table

The following reference table is byte-identical in all three locale files.

日本語	English	한국어
システム監査	system audit	시스템 감사
独立性	independence	독립성
客観性	objectivity	객관성
監査証拠	audit evidence	감사 증거
監査調書	audit working papers	감사 조서
内部統制	internal control	내부통제
職務分掌	segregation of duties	직무 분장
リスクアセスメント	risk assessment	리스크 평가
リスク対応	risk treatment	리스크 대응
残留リスク	residual risk	잔여 리스크
インシデントハンドリング	incident handling	인시던트 처리
トリアージ	triage	트리아지
証拠保全	evidence preservation	증거 보전

1. System audit: independent evaluation, not management

A system audit independently and objectively evaluates whether information systems and their controls support organizational objectives, using sufficient appropriate audit evidence. Its flow is risk-based plan → execute audit procedures → obtain sufficient appropriate evidence → document procedures, evidence, judgments, and conclusions in working papers → report → follow up. A preliminary survey narrows scope and risks; the main survey combines interviews, observation, inspection, reperformance, sampling, and, where useful, CAATs.

Independence has two dimensions: the audit function’s organizational position and the practitioner’s independence in fact and mind. Reporting through the audited operation can distort scope or findings. Objectivity means deciding from verifiable facts without bias or conflicting interests. Auditors should not audit their own designs or operations. They need competence, due professional care, and confidentiality: information learned through the audit is not disclosed or used outside its proper purpose.

Sufficiency concerns the quantity and coverage of evidence; appropriateness concerns relevance and reliability. Original records from an independent source, direct observation or reperformance, and records produced under reliable controls generally outweigh an unsupported oral claim. No source is infallible, so approvals, configurations, logs, and interviews should be corroborated. Conflicts call for more procedures and a documented judgment.

Management owns remediation. It designs and operates controls, allocates resources, and accepts risk. If auditors take those decisions and later evaluate them, they create a self-review threat. Auditors report findings and recommendations, assess management’s action plan, deadlines, and risk acceptance, then follow up on implementation and effectiveness.

2. Internal control: management’s own system

Internal control is management’s system for achieving organizational objectives, not an auditor-owned process. Its six elements are control environment; risk assessment and response; control activities; information and communication; monitoring; and response to IT. Ethics and accountability set the environment; risks are identified, assessed, and treated; approvals, reconciliations, and access restrictions perform control activities; useful information reaches the right people; monitoring tests continued operation; and IT dependencies and changes receive explicit attention.

General IT controls support many systems: identity and access, change management, development/operations separation, backup, operations, and physical security. Application controls govern particular transactions, such as input completeness, calculation accuracy, processing authorization, and output reconciliation. Weak general controls can undermine continued reliance on application controls.

Segregation of duties separates incompatible tasks such as request, approval, execution, recording, and review. If staffing prevents full separation, compensating controls can include independent retrospective review, log alerts, or management approval. Preventive controls stop an event (least privilege, preapproval), detective controls reveal it (reconciliation, alerts), and corrective controls restore and prevent recurrence (backup restoration, configuration repair).

Internal control gives reasonable, not absolute, assurance. Human error, collusion, management override, change, and cost-benefit constraints are inherent limitations. Evaluate actual design and operating effectiveness, not merely whether a policy document exists.

3. Security risk assessment and treatment

The sequence is identify → analyze → evaluate → treat. Identify assets, threats, vulnerabilities, and existing controls. Analyze likelihood and impact quantitatively or qualitatively. Evaluate the result against predefined acceptance criteria and priorities. Select avoidance, reduction, sharing (for example insurance or a contract), or retention. Assign an owner, target date, and measures to every risk and action.

For an independently checkable example, a single loss of JPY 4,000,000 at an annual rate of 0.25 gives an ALE of 4,000,000 × 0.25 = JPY 1,000,000. A JPY 300,000 annual control reducing the rate to 0.05 gives residual ALE of 4,000,000 × 0.05 = JPY 200,000. Gross reduction is JPY 800,000; net annual benefit is 800,000 − 300,000 = JPY 500,000. Financial benefit alone is not the decision: legal duties, safety, reputation, and authorized acceptance of residual risk still matter.

A risk register records description, cause, asset, likelihood and impact, existing controls, response, owner, due date, residual risk, and acceptance decision. Material changes and acceptances are communicated to stakeholders and reassessed periodically.

4. Security-incident handling

Fictional case, containing no personal data: monitoring finds an unusual administrator login and unauthorized executable on an internal build server overnight.

1. Detect and report: record time, account, asset, and first observation; notify through the defined path.
2. Triage and scope: establish severity, affected hosts and accounts, time window, and signs of spread. Keep assumptions distinct from facts.
3. Contain and preserve: limit spread while using authorized procedures to acquire volatile memory, processes, and connections first, then nonvolatile disk images and logs. Do not alter originals. Record hashes, collector, time, and each transfer to maintain chain of custody.
4. Eradicate: remove malicious files, persistence, and compromised accounts, and correct the entry cause.
5. Recover and monitor: restore service in validated stages and watch for indicators of recurrence.
6. Report or disclose: determine and record notifications required by law, contract, and internal policy.
7. Learn: review root cause, response strengths and gaps, then update controls, playbooks, training, and the risk register.

Never delete, tamper with, or needlessly destroy evidence; a premature reboot can lose volatile evidence. AP26 security incident handling emphasizes attack scope, containment, forensic evidence, reporting, and prevention of recurrence. AP25 service-management incidents prioritize rapid restoration of normal service. The objectives and decision criteria differ.

5. Original questions

Question 1 — auditor independence

Which arrangement best preserves auditor independence and objectivity?

• ア: The designer of the audited system performs the audit alone.
• イ: An auditor separate from operations evaluates it and reports to a board audit body.
• ウ: The operations manager has final authority to rewrite scope and conclusions.
• エ: The auditor operates remediation and later audits its effectiveness.

Answer: イ. ア creates self-review; イ provides organizational separation and an appropriate reporting line; ウ permits interference; エ assumes management responsibility and then self-reviews it.

Question 2 — sufficient appropriate evidence

Which approach most strongly supports a conclusion on access controls?

• ア: Record only the administrator’s oral assurance.
• イ: Increase sample size without checking source reliability.
• ウ: Corroborate original approvals, configurations, and logs, and reperform selected transactions.
• エ: Attach a recent but unrelated security article.

Answer: ウ. ア lacks corroboration. イ increases quantity but not appropriateness. ウ combines relevant, reliable evidence with an independent procedure. エ is irrelevant to the audit objective.

Question 3 — segregation of duties

Which design best strengthens internal control over payments?

• ア: Separate vendor creation, payment request, approval, and reconciliation privileges.
• イ: Give one employee every privilege but rotate the password frequently.
• ウ: Remove approval to speed processing.
• エ: Let the payer review only their own transactions afterward.

Answer: ア. ア separates incompatible duties. イ leaves concentrated authority; password rotation does not cure that. ウ removes a preventive control. エ is self-review, not an independent detective control.

Question 4 — ALE and control benefit

A loss is JPY 4,000,000 and its annual rate is 0.25. A JPY 300,000 annual control reduces the rate to 0.05. What is the net annual benefit?

• ア: JPY 200,000
• イ: JPY 300,000
• ウ: JPY 800,000
• エ: JPY 500,000

Answer: エ. ア is residual ALE; イ is control cost; ウ is gross loss reduction. エ is (1,000,000 − 200,000) − 300,000 = JPY 500,000.

Question 5 — evidence preservation

What is the most appropriate action while containing a suspected compromised server?

• ア: Immediately delete every log and suspicious file.
• イ: Limit spread while collecting volatile data first and recording hashes and custody transfers.
• ウ: Factory-reset it without an evidence record.
• エ: Announce a definitive cause externally before scoping.

Answer: イ. ア and ウ destroy evidence. イ combines containment, volatility priority, and chain of custody. エ bypasses validation and the reporting process.

Answer sequence: [2, 3, 1, 4, 2] = [イ, ウ, ア, エ, イ]. Every question is original. No IPA past question was reproduced, translated, or adapted. Past questions used: none.

6. Official sources, boundary, and disclaimers

• IPA, Applied Information Technology Engineer Examination (Level 3) Syllabus Ver.7.2: PDF 56 / printed footer 52; PDF 57 / footer 53; PDF 59 / footer 55; PDF 98 / footer 94; PDF 99 / footer 95; PDF 100 / footer 96; PDF 101 / footer 97; PDF 102 / footer 98.
• IPA current syllabus and revision overview and revision information.
• Sources checked: 2026-10-21. PDF page numbers and printed footer page numbers are distinct numbering systems.

This material is neither affiliated with nor endorsed by IPA and does not guarantee a passing result. It contains no personal data. AP26 ends with audit, internal control, security management, risk, and security-incident handling. AP27 covers system strategy, business processes, and procurement. No third-party commentary was used.