In a systems audit, which of the following does the systems auditor mainly use as the yardstick for judging whether an organization's management of its information systems is appropriate?

Answer: A. System Management Standards

In Japan, the Ministry of Economy, Trade and Industry publishes the System Audit Standards and the System Management Standards. The System Management Standards set out what an organization should do to manage its information systems properly, and systems auditors use them as the yardstick for audit judgments. The System Audit Standards set out the code of conduct for systems auditors when they carry out audits (how audits should be planned, performed, reported and so on). Audit working papers are documents recording the procedures the auditor carried out, the evidence obtained and the conclusions.

• A. Correct. They set out the management an organization should carry out and serve as the yardstick for audit judgments.
• B. They set out the code of conduct for systems auditors, not a yardstick for judging whether management is appropriate.
• C. These are documents recording the procedures and conclusions of the auditor, not a yardstick for judgment.