JP3208680B2 - Information system auditing equipment - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an information system auditing apparatus for auditing an information system.

[0002] The use of computers in recent years has become indispensable as a social information infrastructure. In addition, corporate management strategies are changing to those intended. As a result, the consequences of an information system being shut down, misused, or not functioning effectively have become more important. It is necessary to audit the reliability, security, efficiency, etc. of the operation of information systems. For this reason, the Ministry of International Trade and Industry has established and instructed information system auditing standards in 1985, but the implementation rate in companies is low. The reasons for this are "no system auditor" and "I do not know the procedure" in many cases. For this reason, it is necessary that the department to be audited can perform an audit using a self-diagnosis system without a system auditor.

[0003]

2. Description of the Related Art Heretofore, management of various information systems and the like using computers in a company has been performed individually by a manager in charge of reliability, safety, efficiency and the like as appropriate according to the business.

[0004] Further, a company having a specialized system auditor has created a unique worksheet based on the above-mentioned information system auditing standard, and has manually performed a check based on the worksheet.

[0005]

Accordingly, in the past, companies without a specialized system auditor have recognized the necessity of auditing information systems, but have conducted system audits of information processing systems using computers. The reality is that it is impossible to do so, and there has been a problem that its reliability and safety have not been fully grasped and its countermeasures have not been taken.

[0006] The present invention solves these problems,
Information system audits in companies such as "no system auditor" or "I don't know the system audit procedure"
The purpose is to enable self-diagnosis using the knowledge of experts.

[0007]

Means for solving the problem will be described with reference to FIG. In FIG. 1, a question item / level / content storage unit 23 preliminarily stores expert question items, implementation levels, and order displayed on a screen and asking a question, and also corresponds to the question items and implementation level answers. The expert recommendation is stored in advance.

[0008] The evaluation section 52 calculates an evaluation value based on the input answer in response to the display taken out from the question item / level / content storage section 23.

[0009]

According to the present invention, as shown in FIG. 1, a question item and an implementation level extracted from a question item / level / content storage unit 23 are displayed, and in response to a user inputting an answer, an evaluation unit. An evaluation value is calculated based on the input answer 52, an evaluation is determined based on the calculated evaluation value, and a corresponding audit recommendation is output.

[0010] For a question item and an implementation level for which the answer is not appropriate, an individual recommendation sentence extracted from the question item / level / content storage unit 23 is output. Therefore, in the audit of information systems in a company such as "No system auditor" or "I do not understand the procedure of system audit", users can use the knowledge of experts only by answering the questions displayed on the screen. To perform self-diagnosis.

[0011]

Next, the structure and operation of an embodiment of the present invention will be sequentially described in detail with reference to FIGS.

FIG. 1 is a block diagram showing one embodiment of the present invention.
This means that questions based on the knowledge of an information system expert are displayed on the screen, and in response to the user inputting the status of the company's information system as an answer to this expert question, The self-diagnosis is performed by quantifying the evaluation value corresponding to the answer of the item, displaying the evaluation of each item and the overall evaluation as an easy-to-understand diagnosis result. This will be described sequentially below.

In FIG. 1, an input unit 1 performs various inputs, such as answering a question, inputting evaluation criteria data for self-diagnosis in advance, and inputting a standard recommendation sentence. Yes, input of business type, scale, features, etc. 1
1, an audit viewpoint / target business / implementation level input 12, a question answer input 13, a self-diagnosis evaluation standard data input 14, a basic recommendation text input 15, and the like.

The input 11 such as the personality, size, and characteristics of the business type of the company
At the time of system auditing of information systems, the company / industry (for example, the difference between a calculation center of a general company and an information processing company) and the size of the information system department are classified into several to several tens of ranks, and evaluation based on the response results This is an input for reflection (see S1 in FIG. 2).

Audit viewpoint, target business, and execution level input 12
Is to specify the audit targets such as safety and reliability perspectives, planning, development, operation work, etc., and input them to reflect in the flow of questions. This is an input for inputting a section of whether to pierce deeply and reflecting it in a question (see S2, S3, S4, etc. in FIG. 2).

The question answer input 13 corresponds to the display of the question 11 in which the above-mentioned input 11 such as the personality, size, and characteristics of the business type of the enterprise, and the knowledge of experts who meet the conditions of the audit viewpoint, the target business, and the execution level 12 are collected. An answer is input for each question, for example, an answer of "YES" or "NO" (S8 in FIG. 3).
Etc.).

The self-diagnosis evaluation criterion data input 14 is an input of an objective evaluation criterion by numerical values in order to evaluate the result of the self-diagnosis based on the question, such as good or bad (see FIG. 11).

The basic recommendation input 15 is a basic clause input for evaluating the result of the self-audit and transmitting the recommendation, and constructing a necessary recommendation by combining the basic clauses. (See FIG. 12).

The knowledge storage unit 2 stores the input audit viewpoint, target business, and execution level, and the characteristics, scale, and characteristics of the business type of the enterprise, and stores in advance the knowledge of a diagnosis expert of the information system. For example, it stores the audited company characteristics and the like, and includes an audit viewpoint / target business / execution level storage unit 21, a question / answer control unit 22, a company characteristic storage unit 25, and the like.

Audit viewpoint, target business, execution level storage unit 2
Reference numeral 1 stores an audit viewpoint, a target job, an execution level, and the like, which are input by the user from the screen through an audit viewpoint, target job, and execution level input 12.

The question / answer control section 22 controls the "question sending order and answer method" so that a self-diagnosis suitable for the purpose can be made.
3, a question in which the expert's knowledge is aggregated is taken out and displayed on the screen, an answer to the question item is stored in the question answer storage unit 24 (S1 in FIG. 2).
To S8).

The question item / level / content storage unit 23 collects the knowledge of the expert, and responds to the differences in the target task, the execution level, etc., in terms of the items and contents of the question that meet each purpose, and the individual recommendation text. Are stored in advance, and are expert knowledge sources created by the expert system (see FIGS. 14 and 15).

The question answer storage unit 24 stores answers to questions for use in later evaluation. The company characteristic storage unit 25 stores the business type, scale, and the like input by the user in the business type, size, and feature input 11.
It stores features and the like (see FIG. 10 and the like). The stored business type, scale, and characteristics are reflected in the evaluation performed by the evaluation unit 52 described later. This reflection is reflected when calculating the evaluation value as a weight value for the question number in the evaluation table 53, as shown in FIG.

The criterion evaluation table 3 is for calculating an evaluation value based on the evaluation input from the user through the self-diagnosis evaluation criterion data input 14, that is, the answer to the question, and setting the total evaluation. For example, the evaluation is set as follows, as shown in FIG.

[0025] The basic recommendation clause section table 4 is for setting a basic recommendation sentence input by the user through the basic recommendation sentence input 15, that is, a basic recommendation sentence for evaluation. For example, FIG.
The clause of the basic recommendation sentence shown in Fig. 2 is set as follows.

Evaluation Basic recommendation clause Good Good It is operated as per the storage manual, and the compliance status is generally good. Normal Operation is in accordance with the storage manual, and compliance is generally good, but some points need to be improved.

Bad Storage is not being operated as per the manual, and improvement is needed to ensure that the manual is thoroughly implemented. The system self-diagnosis unit 5 is for self-diagnosis and evaluation of the information system based on the answer result of the question, and creates a recommendation and a recommendation text as needed. The system includes a question result control unit 51 and an evaluation unit 52. It is composed of

[0028] The question result control unit 51 includes an audit viewpoint, a business type,
Assuming that the size of the company is a precondition (specifically, considering the weight value of the question item), the question answer is quantified so that it can be objectively evaluated.

The evaluator 52 operates the evaluation table 53 based on the quantified answer results (response results of the self-diagnosis) and evaluates each question item (audit item, question number) and the overall value. Evaluation values are obtained and evaluated (FIG. 2,
(See FIG. 3).

The evaluation table 53 is a table that stores a recommendation level α and a weight β in association with a question number, and is used when calculating an evaluation value. This weighting β is set according to the nature, size, characteristics, etc. of the company type,
These are reflected in the evaluation value.

The output unit 6 creates and displays a recommendation based on the evaluation results (individual evaluation, comprehensive evaluation) evaluated by the self-diagnosis unit 5 and outputs a self-diagnosis report. The system includes a recommendation statement creation / output unit 61, a system audit / self-diagnosis report creation / output unit 62, a recommendation statement display 63, a self-diagnosis report output 64, and the like.

The recommendation text creation / output unit 61 uses the basic recommendation / phrase table 4 to determine the recommendation text (several ranks) corresponding to the audit item that needs improvement based on the answer result to the question and the evaluation. It is created and displayed on the screen as a recommendation display 63 (see S11 in FIG. 3).

The system audit / self-diagnosis report creation / output unit 62 extracts the basic recommendation sent from the recommendation sentence creation / output unit 61 and the corresponding individual improvement recommendation corresponding to the answer to the question. A compiled system audit / self-diagnosis report is created and printed out on paper as a self-diagnosis report output 64 and output (FIG. 14, FIG. 1).
5 etc.).

Next, the operation of the configuration shown in FIG. 1 will be described in detail with reference to FIGS. 2 and 3. In FIG. 2, S1
Displays the initial screen. This, as shown in the figure, displays a title of an expert system for system audit, and prompts the user to input the name of the department to be audited. This time, "Company A calculation center" is input from the keyboard at the position of xx... X on the initial screen (kanji can be input).

In step S2, a screen for selecting a task to be audited is displayed. As shown in the figure, as the tasks to be audited, here, "planning tasks", "development tasks", and "operation tasks" are displayed, and one of these is prompted. This time, select the operation business.

In step S3, an inspection question level setting screen is displayed. In this case, as shown in the figure, the following a or b is input as an audit question level. a. Diagnosis by general activity items b. Diagnosis by specific items, detailed item diagnosis over details In this case, a is selected.

In step S4, a screen for selecting an audit target is displayed.
As shown in the figure, one of the following seven items such as data and program management is selected as an audit target.

Data program management Operation: Creation and input of input data Facility management Management and utilization of output information Personnel Outsourcing This time, select "Data / program management".

In step S5, a screen for selecting an audit content is displayed.
This is, as shown in the figure, the audit
0 items are displayed as follows, and are selected from these items (a plurality of items can be selected).

・ Storage ・ Discard ・ Access management ・ Backup recovery ・ Program change procedure ・ Database update procedure ・ Reception of changed program ・ Data handling rules ・ Important forms management ・ Others Select “Save” this time .

Step S6 of FIG. 3 displays an inspection viewpoint selection screen. In this case, as shown in the figure, three items are displayed as the inspection viewpoints as described below, and the items are selected from these items (a plurality of items can be selected).

・ Reliability ・ Safety ・ Efficiency This time, select “Reliability”.

In step S7, an audit response guidance screen is displayed. In this case, as shown in the figure, the questions up to the previous screen are collectively displayed here, and if so, the process proceeds to the next screen. The following is displayed this time.

・ Audit target department: Company A calculation center ・ Audit target: Operational work ・ Audit question level: Diagnosis based on general items ・ Audit target: Data and program management ・ Audit contents: Storage ・ Audit viewpoint: Reliability This time is OK, so go to the next.

In step S8, a question screen (question of level A) is displayed. This means that, as shown in the figure, the top-level questions (diagnosis based on general items) in the "audit item analysis table"
Display and listen in the following order.

Compliant with the storage manuals ・ Distributed storage ・ Generation management ・ Consignment of storage ・ Ascertaining the storage status Here, in detail, for example, as shown in FIG. The contents of the questions are displayed as shown in correspondence with 1 to 12, and the user is prompted to answer either YES / NO. Here, the answer is YES or NO as shown in the figure.
Enter Similarly, the process is repeated for “distributed management” and thereafter, and an answer (YES / NO) is input for each item.

In step S9, a diagnosis is made. That is, in response to the user inputting the answer in S8, the evaluation value is calculated and the diagnosis is performed (described later with reference to FIG. 5). A step S10 edits the recommendation sentence. That is, based on the evaluation value and the answer (YES / NO) obtained by the diagnosis in S9, when the comprehensive evaluation and the answer of the individual item are not appropriate, the recommendation sentence corresponding to the individual answer is edited. .

In step S11, an audit result display screen for each item is displayed. The result of the diagnosis is displayed in S9, and the audit result edited in S10 in the recommendation is displayed as shown in the lower right. In other words, here:-Audit results-Operation is performed as per the storage manual, and the compliance status is generally good.

・ On-site guidance ・ To perform accurate storage, appoint a Live Ryan and carry out the entry and exit work. Is displayed.

As described above, in the order of the items to be audited, the tasks to be audited, the tasks to be audited, the question level of the audit, the items to be audited, the audit contents, and the audit viewpoint Select and input the situation sequentially, display the optimal question items based on the expert's knowledge based on these, prompt the answer, and calculate the evaluation value of each item in response to the input of the answer. Evaluation is requested and the corresponding recommendation is displayed, along with individual on-site guidance for the inappropriate response of each item, urgent improvement recommendation or normal improvement recommendation is also displayed. Thus, by inputting the status of the information system of the user and answering a question, a self-diagnosis is performed, and the result (recommendation sentence) can be obtained.

FIG. 4 shows an example of a question and an example of an answer on the question screen “Compliance with Storage Manual” of the present invention. Here, the question number is a unique question number. The content of the question indicates a format for displaying the question on the screen. In response to the question being displayed on the screen, the user answers YES or N
This is an input field for inputting O. Here, it is assumed that “YES” or “NO” is input for each question item as shown in the figure.

Next, the calculation of the evaluation value will be described in detail with the answers shown in FIG. 4 in the order shown in FIG. In FIG. 5, S20 represents a diagnosis, and S9 in FIG.
Corresponds to the diagnosis of This diagnosis is performed from the following S21 to S2
6 is a procedure for obtaining an evaluation value for each question number and an overall evaluation.

In step S21, an evaluation value is calculated. this is,
As noted on the right, Ask for. For example, as shown in the evaluation table 53 of FIG. 6 corresponding to the question of “compliance with the storage manual” of FIG. 4 described above, the recommendation level α and the weight β at that time are shown in FIG. It is stored in correspondence with the above-mentioned input (for example, the question level of auditing, work, etc.). An evaluation value t obtained by multiplying the stored recommendation level α and weight β in the evaluation table 53 of FIG. 6 is calculated and set as shown in the figure. For example, since the recommendation level α = 5 and the weight β = 3 for the question number 1 in FIG.
X3 = 15 is set as the evaluation value t as shown in the figure. Next, Σ (α × β) is obtained. In this case, the evaluation values of the respective question numbers are calculated as described in the column of the evaluation value t in FIG. 6, and Δt = 98 is obtained here as a sum of these.

In step S22, correction weighting is calculated. This is because the sum of the evaluation values Δt is 10
The correction weight is calculated so that it becomes zero.
In the example, 12 questions are asked about "compliance with the storage manual", but the number of questions, the recommendation level, and the weighting value of other items are different, and the recommendation level x weighting also changes. Therefore, correction is made so that Σ (recommended level × weighting) = 100 so that evaluation can be performed based on a certain standard.

.Theta. = 100.SIGMA. @ T. In the example, .theta. = 100.SIGMA.98 = 1.02. ΣT = Σ (α × γ) = 100 Therefore, in the example of FIG. 6, as described above, θ = 1.02
Γ = β × θ = 1.02β as shown by γ in the correction weighting of FIG. 6, and the weighting β
Is multiplied by 1.02, and the correction weighting γ is set as shown in FIG.

In step S23, a recommended score is calculated. This is, as described on the right side: -Recommended score = Recommendation level × 0 (if the answer is YES) 1 (if the answer is NO) α1 = α × 0 or 1 For example, in FIG. 6, in the case of question number 1, the recommendation level α = 5 and the answer is Y
Since it is ES, α1 = 5 × 0 = 0. Also, in the case of question number 9, the recommendation level α = 1 and the answer is N
Since it is O, α1 = 1 × 1 = 1.

In step S24, an evaluation value is calculated. This, as described on the right, Becomes For example, in the case of question number 9, since the recommended score α1 = 1 and the correction weight γ = 3.06, A1 = 1 × 3.06 = 3.06.

In step S25, individual items are evaluated. This is, as described on the right side: ・ Σ (A1) = less than 10 points → good 10 points or more and less than 30 points → normal 30 points or more and less than 100 → bad is evaluated for each individual item, ie, displayed in S8 of FIG. Each item "Compliance with storage manual" is evaluated. For example, in the answer example of FIG. 4 described above, as shown in FIG. 6, Σ (A1) = 3.06, which is less than 10 points, and the individual evaluation is “good”.

As described above, for the answer to the question for each individual item, the correction weight γ is obtained for each question number, and the recommended score multiplied by the recommendation level × the answer (0 for YES, 1 for NO) is obtained. Next, correction weight × recommended score = evaluation value A1
And Σ (A1) is used as the evaluation value. Through these operations, it is possible to numerically evaluate (good, normal, or bad evaluation) for each item of the information system (for example, for each "observation of the storage manual").

FIG. 6 shows an explanatory diagram of the evaluation of the present invention. This is an evaluation table 53 in which a recommendation level α and a weight β are stored in association with a question number, and an evaluation value A1 is obtained in accordance with the order of FIG.
Here, Σ (A1) = 3.06, which is less than 10 points, and an evaluation “good” is obtained.

FIG. 7 is a diagram for explaining a recommendation sentence editing according to the present invention. In FIG. 7, S30 represents recommendation sentence editing, and FIG.
Corresponds to the editing of the recommendation sentence in S10.

In step S31, a basic recommendation statement is created. This is, as shown in the lower part, a basic recommendation sentence is created by referring to the evaluation criterion table 3 based on the evaluation value. This is because, for example, the evaluation Σ (A1) of the individual item is calculated in S25 of FIG. 5, and when the evaluation value at that time is 3.06, the evaluation criterion table 3 in S32, for example: less than 10 points → good ・ more than 10 points Less than 30 points → Normal ・ 30 points or more and less than 100 points → Bad Refer to and judge the evaluation as “Good”. Then, in step S33, the standard recommendation clause table 4 is referred to, and here, as the basic recommendation clause of evaluation “good”, “the operation is performed as per the storage manual and the compliance status is generally good” is extracted.
Display on the screen.

By editing the recommendation sentence described above, the evaluation value (Σ
(A1)), an evaluation (good, normal, bad) is obtained by referring to the evaluation criterion table 3, and a recommendation sentence corresponding to this evaluation is extracted from the basic recommendation sentence clause 4, and the audit result ( (Recommended).

FIG. 8 is a diagram for explaining the preparation of an individual recommendation sentence according to the present invention. In FIG. 8, S40 represents the creation of an individual recommendation sentence, which is created together with the case of S10 in FIG. 3, and the answer of the question answer storage unit 24 is a recommendation sentence corresponding to the question number of NO here. The individual recommendation message is created by referring to the individual recommendation message in the question item / level / content storage unit 23.

More specifically, the question answer storage unit 24 in S41
Of the answers corresponding to the following question numbers stored in
(In this case, the answer to question number 9)
The specific recommendation corresponding to the question number 9 in FIG. 15 and the type of the recommendation, which are the question item / level / content storage unit 23, are taken out together. And carry out the loading / unloading work. "

As described above, regarding the question number whose answer is stored as NO in the question answer storage unit 24,
With reference to, for example, FIGS. 14 and 15 which are the level / content storage unit 23, the individual recommendation text and the type of the recommendation text (emergency improvement recommendation, normal improvement recommendation, on-site guidance) corresponding to NO of the corresponding question number are extracted, As described above, the individual recommendation text is displayed following the type of the recommendation text.

FIG. 9 is an explanatory view (part 1) of the present invention. In FIG. 9, S51 denotes an audit viewpoint / target business / execution level storage unit 21. As shown in the lower part, S51 is input from the screen by the operation from S1 in FIG. 2 to S6 in FIG.
The contents checked in S7 are stored. Here, it is stored as follows.

・ Audit department name Company A Computing center ・ Audit business operation business ・ Audit question level Diagnosis based on general items ・ Audit data and program management ・ Audit contents storage ・ Audit viewpoint Reliability As described above, audit Viewpoint, target task, and implementation level memory 2
1 is used to store items input from the screen and retrieve a question of an item corresponding to these stored contents from the question item / level / content storage unit 23.

FIG. 10 is an explanatory diagram (part 2) of the present invention. In FIG. 10, S52 represents the company characteristic storage unit 25 for storing weights for questions matching the company characteristics. This is input and stored by the designer (user) in advance as necessary. For example, in the case of “General corporate calculation center” and “Compliance with the storage manual”, as shown in the lower row, Remember. These memorized question numbers and weights are
When obtaining the evaluation value of the individual item of “compliance with the storage manual”, the evaluation value is stored in the question number and weighting fields of the evaluation table 53 of FIG. 6 described above, and the evaluation value is calculated according to the procedure described above.

FIG. 11 is an explanatory view (3) of the present invention. In FIG. 11, S53 represents the evaluation criterion table 3, and is a table for distinguishing “good”, “normal”, and “bad” from the evaluation value. This is set in advance by the designer (user) arbitrarily inputting as necessary. For example, as shown Set as Here, by arbitrarily setting the value,
The evaluation can be changed and set to a reasonable value for the expert.

FIG. 12 is an explanatory view (part 4) of the present invention. In FIG. 12, S54 indicates the basic recommendation clause section table 4 and stores the main text of the recommendation. As shown in the lower part, the main text of the recommendation corresponding to the evaluation “good”, “normal”, and “bad” set in the evaluation criterion table 3 in FIG. Entered and set. For example, Evaluation Basic Recommendation Clause Good Operation is performed as per the storage manual, and compliance is generally good.

Normal Operation is performed in accordance with the storage manual, and the compliance status is generally good. However, some points need improvement. Poor Operation is not performed as per the storage manual, and improvement is required to ensure that the manual is thoroughly implemented. And set it.

FIG. 13 is an explanatory view (part 5) of the present invention. In FIG. 13, S55 indicates the question answer storage unit 24, which stores answers to individual questions. here,
As shown in “Compliance with Storage Manual” in FIG.
ES / NO), as shown in the lower row, Remember.

FIGS. 14 and 15 show examples of the question / level / content storage section of the present invention. This corresponds to the question, level, and item of “Compliance with Storage Manual” on the screen of S8 in FIG.
The contents are obtained by collecting expert knowledge and storing them in advance. Here, the item “Compliance with the storage manual” corresponding to the audit content displayed collectively in S7 of FIG. 3 is described. The numbers 1 to 12 at the left end are the question numbers. As shown in the figure, the central investigation confirmation items and the recommendation contents are individually displayed when a question (investigation confirmation items) is displayed as a question on the screen as shown in FIG. 4 and when (N) (representing NO) is selected. There is a recommendation sentence for the item and a portion displayed as the type of the recommendation sentence. These are previously described by collecting the knowledge of information system specialists. For example, if the answer to the question with the question number 9 described above is "Does the librarian perform the entry / exit work?", As an individual recommendation corresponding to (N), A recommendation statement is displayed, stating "Please appoint a librarian and carry out entry / exit work to perform accurate storage work." Other cases are displayed in the same manner.

[0075]

As described above, according to the present invention,
A configuration in which a question is taken out from the question item / level / content storage unit 23, a question is displayed, an evaluation value is calculated based on the input answer, and a corresponding audit recommendation and an individual recommendation are output. Therefore, the system audit of the information system can be performed and the recommendation sentence based on the knowledge of the expert can be obtained even if there is no auditor who is specialized in the information system. As a result, information systems audits in a company, such as "no system auditor" or "do not understand the system audit procedure", can be performed only by the administrator by answering the questions displayed on the screen, and the knowledge of the expert can be obtained. The system can be improved by looking at the recommendation text generated by using the system, and the system can be self-diagnosed.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of one embodiment of the present invention.

FIG. 2 is an explanatory view of a specific example of the present invention.

FIG. 3 is an explanatory view of a specific example of the present invention.

FIG. 4 is an example of a question and an example of an answer on a question screen “Compliance with a storage manual” of the present invention.

FIG. 5 is an explanatory diagram illustrating an evaluation of the present invention.

FIG. 6 is an explanatory diagram illustrating an evaluation of the present invention.

FIG. 7 is an explanatory diagram of recommendation sentence editing of the present invention.

FIG. 8 is an explanatory diagram of creating an individual recommendation sentence of the present invention.

FIG. 9 is an explanatory view (No. 1) of the present invention.

FIG. 10 is an explanatory diagram (No. 2) of the present invention.

FIG. 11 is an explanatory view (No. 3) of the present invention.

FIG. 12 is an explanatory view (No. 4) of the present invention.

FIG. 13 is an explanatory view (No. 5) of the present invention.

FIG. 14 is an example (part 1) of a question item / level / content storage unit of the present invention.

FIG. 15 is an example (part 2) of a question item / level / content storage unit of the present invention.

[Explanation of symbols]

 1: Input section 11: Input of personality, size, characteristics, etc. of company type 12: Input of audit viewpoint, target business, and implementation level 13: Input of question answer 14: Input of self-diagnosis evaluation standard data 15: Input of basic recommendation text 2: Knowledge storage section 21: Audit viewpoint / target business / implementation level storage unit 22: Question / answer control unit 23: Question item / level / content storage unit 24: Question / response storage unit 25: Company characteristic storage unit 3: Evaluation criteria table 4: Basic recommendation Sentence phrase table 5: System self-diagnosis unit 51: Question result control unit 52: Evaluation unit 53: Evaluation table 6: Output unit 61: Recommendation text creation / output unit 62: System audit / self-diagnosis report creation / output unit 63: Recommendation text display 64: Self-diagnosis report output

──────────────────────────────────────────────────続 き Continued on the front page (58) Field surveyed (Int. Cl. ⁷ , DB name) G06F 11/22-11/34 G05B 23/00-23/02

Claims (2)

(57) [Claims] 1. An information system auditing apparatus for performing an audit of an information system, wherein an auditing point of an input auditing target, a target operation, and an execution level are provided.
A question item / level / content storage unit for storing question items, execution levels and order in advance based on setting information relating to, and recommendation to be reflected in an evaluation result of an audit based on the setting information.
Notification level and weighting value in association with the question item
An evaluation table for storing, in response to that retrieves and displays the question items, based on the inputted answers, the recommendation level and weighting
Calculate each question and the overall evaluation value based on the
An evaluation unit for determining the question and the overall evaluation; and the quality based on each of the determined questions and the overall evaluation.
An information system auditing device comprising: an output unit that outputs an audit recommendation sentence from a question item / level / content storage unit . 2. The information system auditing device according to claim 1,
And the answer is not appropriate,
If the recommendation is applied from the question item / level / content storage
An information system auditing device comprising an output unit for outputting a statement .