JP2017021848A - Remote examination system, information processor, remote examination method, and remote examination program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce the burden of an examination of standard authentication of a management system.SOLUTION: A remote examination system includes a storage part on a network for storing a plurality of data groups in which one data group is a group of data about one piece of business regarding a plurality of pieces of business, a reception part for receiving a setting which is individually performed about a plurality of data groups by an owned organization of a plurality of data groups and is referable or irreferable to access from an examination organization, a setting holding part for holding a setting of each of the plurality of data groups, and a providing part for providing a data group that is referable by the examination organization to the access from the examination organization on the basis of the setting held by the setting holding part. The providing part provides a business selection screen including selection items for selecting business to the access from the examination organization, and cannot include selection items of business corresponding to a data group set as an irreferable one by the setting holding part in the business selection screen.SELECTED DRAWING: Figure 4

Description

  The present invention relates to a remote screening system for performing screening with reference to data from a remote location.

In organizations such as companies, a plurality of management systems have been constructed and operated in order to comply with the Personal Information Protection Law and the Financial Instruments and Exchange Law and to maintain certification standards. Examples of management systems include ISO (International Organization for Standard) 9000, which is a quality management system, and ISO 14, which is an environmental management system.
001, ISO 27001, which is an information security management system, and ISO 20000, which is an IT service management system.

  These management system certification standards are often examined in two stages: the first stage of document examination and the 2nd stage of field examination. For example, in the case of the 1st stage audit, the company to be audited sends the document to be audited to the auditing organization using means such as mail or e-mail.

JP 2003-296428 A

  However, since the documents to be examined are diverse and enormous, it takes time and labor to prepare. In addition, on the side of the document review, for example, every time there is a shortage of documents to be examined, it is time-consuming to contact the company to be audited and to prompt the documents for shortage or to visit the site. It was.

  An object of the present invention is to provide a remote examination system for reducing the burden of examination for standard certification of a management system.

  One aspect of the present invention is that, for a plurality of tasks, one data group is a collection of data for one task, a storage unit on the network that stores a plurality of data groups, and a plurality of data groups A setting that is individually set for a plurality of data groups by the owning organization, and that accepts a referenceable or non-referenceable setting for access from an examination organization, and holds settings for each of the plurality of data groups And a providing unit that provides a data group that can be referred to by the examination organization based on the settings held in the setting holding unit with respect to access from the examination organization. The providing unit provides a job selection screen including a selection item for selecting a job for access from the certification body, and the job selection screen corresponds to a data group that is set as non-referenceable in the setting holding unit. Do not include business choices.

Furthermore, the present invention can be grasped as an apparatus, a method, or a program executed by a computer as one aspect. Further, one aspect of the present invention may be a program in which such a program is recorded on a recording medium that can be read by a computer, other devices, machines, or the like. Here, a computer-readable recording medium is a recording medium that stores information such as data and programs by electrical, magnetic, optical, mechanical, or chemical action and can be read from a computer or the like. Say.

  According to the present invention, it is possible to reduce the burden of examination for certification of management system standards.

It is a figure for demonstrating the outline | summary of the integrated management system concerning 1st Embodiment. It is a figure which shows the structural example of an integrated management system. It is a figure which shows the example of the hardware constitutions of information processing apparatus. It is a figure which shows the example of the functional block of an integrated management system. It is a figure which shows an example of a login table. It is a figure which shows the example of a company information table. It is a figure which shows an example of the data stored in one company schema. It is a figure which shows the example of a user information table. It is an example of the examination classification definition table classified by theme. It is an example of a main menu default value definition table. It is an example of a submenu default value definition table. It is an example of an examination information table. It is an example of a main menu display setting table. It is an example of a submenu display setting table. It is an example of the flowchart which shows the flow of a process of the integrated management system of pre-screening preparation. It is an example of a screening information list screen. It is an example of a screening information setting screen. It is an example of the content of a user registration notification mail. It is an example of a screening object setting screen. It is a figure which shows the flow of a process of login. It is a figure which shows the flow of a process of login. It is a figure which shows an example of the login screen for judges. It is a figure which shows an example of the top screen for judges. It is an example of the flowchart of a process of an integrated management system in case examination is performed about an incident management function. It is an example of an incident list screen. It is an example of an incident single-cut screen. It is an example of an incident approval history screen. It is an example of the flowchart of a process of an integrated management system when examination about a regulation management function is performed. It is an example of the folder list screen of regulation management. It is an example of a regulation list screen. It is an example of a file download screen including a file download pop-up. It is an example of the flowchart of a process of an integrated management system in case examination is performed about a taking-out management function. It is an example of a take-out list screen. It is an example of the content confirmation screen of take-out information. It is an example of a take-out approval history screen. It is a figure which shows the flow of the process of examination result registration. It is an example of a record management folder list screen. It is an example of a recording information list screen. It is an example of a recording information edit screen. It is an example of a file registration screen.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. The configuration of the following embodiment is an exemplification, and the present invention is not limited to the configuration of the embodiment.

<First Embodiment>
<System configuration>
In the first embodiment, the present invention integrates a plurality of management systems such as an information security management system (hereinafter referred to as ISMS) and a personal information protection management system (hereinafter referred to as PMS). The case of applying to the management system will be described. However, the application target of the present invention is not limited to the integrated management system, and can be applied to a single management system such as ISMS or PMS.

  FIG. 1 is a diagram for explaining the outline of the integrated management system according to the first embodiment. The integrated management system shown in FIG. 1 is a system in which the management systems of ISMS and PMS are integrated.

  The integrated management system is built on a network, and can be accessed from terminals of each company, examination organization, system management organization, etc. through the network. The integrated management system has, for example, an ISMS-specific function (ISMS function), a PMS-specific function (PMS function), a function common to ISMS and PMS (common management function), and a management function.

  In the integrated management system, functions that overlap between the ISMS and the PMS are shared as a common management function. Therefore, the work and activities that have been performed redundantly are unified, and labor is saved.

  In the integrated management system, a common interface is provided between the ISMS and the PMS. Therefore, the user only needs to access the interface (Web page) provided by the integrated management system without performing processing on different data files for each management system, and man-hours can be saved.

  In the integrated management system, a plurality of workflows that define the order of procedures are prepared for processes common to a plurality of management systems such as ISMS and PMS. By using the workflow, the user inputs predetermined information, and the process proceeds according to the workflow. Therefore, the process can be efficiently performed. For example, one of the workflows is an approval request workflow. The approval request workflow defines the flow from the approval request to the end of approval. Events such as issuance and termination of workflows and processes executed during the workflow are recorded as trails (evidence) in the recording database.

In addition to the trail, various data are stored in the recording database. The record database exists on the network and can be accessed anytime and anywhere by the user of the enterprise using the integrated management system via the network. Further, since the integrated management system integrates the management systems of a plurality of companies, the data on the record database is separated for each user company in order to guarantee security between the companies. That is, access from the user terminal of the company A using the integrated management system to the data of the company A is permitted, and access to the data of the company other than the company A is prohibited.

  Each of the ISMS function, PMS function, common management function, and management function is a set (function group) of a plurality of functions. In the first embodiment, a function is a set of processes relating to a document generated in business, and the difference in function means that the type of document to be processed, that is, the type of business from which the document is generated differs. It shows that. For example, the common management function includes an incident management function, a regulation management function, a take-out management function, a record management function, and the like. For this reason, the data on the recording database is classified for each function and stored for each user company. That is, on the recording database, the data is classified and stored in the type of business.

  In the first embodiment, in the integrated management system on the network as described above, it is possible to conduct examination from a remote location (remote examination) by making the examination body's examiner accessible, and the certification standard is examined. Reduce the burden.

In the first embodiment, the examination proceeds according to the following flow.
(1) Pre-audit preparation The company to be audited (hereinafter referred to as the auditee company) issues an ID for accessing the integrated management system to the auditor of the auditing organization. In addition, the information disclosed to the examiner differs depending on the examination type and may be the minimum information necessary for the examination. Therefore, the auditee company sets whether to disclose information to the examiner for each function.
(2) Examination The examiner conducts examination by accessing the integrated management system using the ID issued by the auditee company and confirming the trail. At this time, the information disclosed to the examiner is information on a function for which information disclosure is set for the examiner by the auditee company in preparation for examination. In the first embodiment, the examination is performed in two stages of the first stage (document examination) and the 2nd stage (local examination).
(3) Registration of examination results When the examination of each stage of the 1st stage and the 2nd stage is completed, the examiner accesses the integrated management system and registers the examination results.

  Since the integrated management system can be accessed via the network, the auditor can perform the first stage audit from a remote location by accessing the integrated management system without visiting the audited company. Also, in the integrated management system, data such as trails is stored by function when it is created, so the auditee company can prepare examination documents simply by setting whether to disclose each function. , The burden of examination will be reduced.

  FIG. 2 is a diagram illustrating a configuration example of the integrated management system 1. The integrated management system 1 includes a Web server 2 installed in a DMZ (DeMilitarized Zone), an application server 3 and a database server 4 installed in a secure network. The user terminal accesses the integrated management system 1 through the Internet. At this time, the user terminal accesses the Web server 2 and receives the service of the integrated management system 1 by the application server 3 and the database server 4 via the Web server 2. That is, the Web server 2 provides an interface of the integrated management system 1 to the user terminal through Web access.

  In the example shown in FIG. 2, it is assumed that the hardware devices that constitute the integrated management system 1 are installed on the Internet. However, the present invention is not limited to this, and the integrated management system 1 may be built in a private network such as an in-house LAN. In this case, the Web server 2, the application server 3, the database server 4, and the user terminal Are connected to each other via a LAN. Further, one Web server 2, one application server 3, and one database server 4 may be provided. In the first embodiment, an example in which an integrated management system is realized on a so-called cloud in which a plurality of Web servers 2, application servers 3, and database servers 4 are installed will be described. Further, the explanation will be made assuming that the organization using integrated management is a company.

  FIG. 3 is a diagram illustrating an example of a hardware configuration of the information processing apparatus. An information processing apparatus 500 illustrated in FIG. 3 is an apparatus that is employed as, for example, the Web server 2, the application server 3, and the database server 4 illustrated in FIG.

  The information processing apparatus 500 includes a control unit 51, an input device 53, an output device 54, an auxiliary storage device 55, a medium drive device 56, and a network interface 57, and these hardware components are connected by a bus 59. The information processing apparatus 500 is, for example, a server dedicated computer, a general-purpose computer, or the like. The information processing apparatus 500 can also be used as a user terminal. When the information processing apparatus 500 is employed as a user terminal, the information processing apparatus 500 is a personal computer (PC), a PDA (Personal Digital Assistant), a mobile phone terminal, a smartphone, or the like.

  The input device 53 is a device that accepts input from outside the device. The input device 53 includes, for example, a keyboard and a scanner. Data input to the input device 53 is output to the control unit 51.

  The network interface 57 is an interface for inputting / outputting information to / from the network. The network interface 57 is connected to a wired network and a wireless network. The network interface 57 is, for example, a NIC (Network Interface Card), a wireless LAN (Local Area Network) card, a wireless signal processing circuit including an antenna, or the like. The network interface 57 receives data from the connected network. Data received by the network interface 57 is output to the control unit 51.

  The control unit 51 includes a processor 51A and a main storage device 51B. The main storage device 51B provides the processor 51A with a storage area and a work area for loading a program stored in the auxiliary storage device 55, and is used as a buffer. The main storage device 51B is a semiconductor memory such as a RAM (Random Access Memory) and a ROM (Read Only Memory).

The auxiliary storage device 55 stores various programs and data used by the processor 51A when executing each program. The auxiliary storage device 55 is, for example, an EPROM (Erasable
Includes Programmable ROM and Hard Disc Drive. The auxiliary storage device 55 holds data such as an operating system (OS), various other application programs, and screen data.

The processor 51A is, for example, a CPU (Central Processing Unit). The processor 51A executes various processes by loading the OS and various application programs held in the auxiliary storage device 55 to the main storage device 51B and executing them.

  The medium driving device 56 reads data from the portable recording medium 60 and outputs it to the control unit 51. The portable recording medium 60 is a recording medium such as a USB (Universal Serial Bus) flash memory, a CD (Compact Disc), a DVD (Digital Versatile Disc), or a Blu-ray (registered trademark) disk.

  The output device 54 outputs the processing result of the control unit 51. The output device 54 includes, for example, a display and a printer.

  FIG. 4 is a diagram illustrating an example of functional blocks of the integrated management system 1. The integrated management system 1 includes a processing unit 10, a schema group 20 of each company, and a company information master 30. The processing unit 10 is realized by one or a plurality of Web servers 2 and application servers 3. Each company's schema group 20 and company information master 30 are each formed in a storage device held by one or a plurality of database servers 4. The schema is a storage area having a predetermined capacity created in the storage device of the database server.

  The processing unit 10 includes a screen control unit 11, a login unit 12, an input reception unit 13, a distribution unit 14, a workflow processing unit 15, a system management unit 16, a common management unit 17A, an ISMS management unit 17B, and a PMS management unit 17C. . These functional blocks may be, for example, functional blocks of the application server 3. Alternatively, the screen control unit 11, the login unit 12, the input reception unit 13, and the distribution unit 14 may be functional blocks of the Web server 2, and the other functional blocks may be functional blocks of the application server 3. In the first embodiment, the processing of each functional block is executed by one or a plurality of information processing apparatuses. However, the present invention is not limited to this, and one information processing apparatus may execute processing of all functional blocks, or a plurality of information processing apparatuses when one information processing apparatus executes processing of a plurality of functional blocks. The processing of all functional blocks may be executed by.

  The input reception unit 13 terminates the Web access from the user terminal and outputs it to the distribution unit 14. The distribution unit 14 distributes the access from the user terminal input from the input reception unit 13 to the login unit 12, the system management unit 16, the common management unit 17A, the ISMS management unit 17B, and the PMS management unit 17C. The access content includes, for example, information of an access destination such as a URL, and the distribution unit 14 uses the information on the access destination to manage the system management unit 16, the common management unit 17A, the ISMS management unit 17B, and the PMS management. It is determined to which of the sections 17C the access should be distributed.

  The login unit 12 authenticates the user of the accessing user terminal. The login unit 12 holds session information 121. The session information 121 is information related to the session of the logged-in user who has been successfully authenticated. The session information 121 stores information acquired at the time of user authentication. One piece of information stored in the session information is schema information 1211. The schema information 1211 is information related to the data storage destination of the company to which the logged-in user belongs, and is, for example, a server name, a port number, and a schema name. In addition to the schema information 1211, for example, information on services available to the user is stored in the session information 121. By holding the session information 121, access destination search processing that occurs each time a logged-in user accesses can be omitted, and the access time can be shortened. When the user logs out, information about the user (including schema information 1211) in the session information 121 is deleted.

The ISMS management unit 17B is a functional block group that performs management specific to ISMS. The PMS management unit 17C is a functional block group that executes management specific to PMS. The common management unit 17A is a functional block group that executes management common to ISMS and PMS. The common management unit 17A, the ISMS management unit 17B, and the PMS management unit 17C are units that execute the processes of the common management function, the ISMS function, and the PMS function shown in FIG.

  Each of the common management unit 17A, the ISMS management unit 17B, and the PMS management unit 17C includes a plurality of management units. Each of these management units is a processing unit that executes processing of functions included in each function group.

  For example, the common management unit 17A includes an incident management unit 171, a regulation management unit 172, a record management unit 173, and the like. The incident management unit 171, the regulation management unit 172, and the record management unit 173 execute the processes of the incident management function, the regulation management function, and the record management function, respectively, included in the common management function.

  The incident management unit 171 executes processing related to the incident. An incident is an event that occurs with respect to assets (including information assets) managed in the integrated management system 1 such as equipment loss and data outflow. The rule management unit 172 executes processing related to the rules of each management system. The record management unit 173 executes processing related to trail management that is not managed by each processing unit of the integrated management system 1. The trail managed by the recording management unit 173 includes, for example, a paper-based management book converted to electronic data. In the first embodiment, the process related to the examination result is executed by the record management unit 173.

  The storage location of the data handled by each management unit is prepared separately for each management unit. For example, data handled by the incident management unit 171, the regulation management unit 172, and the record management unit 173 are stored in the incident table, the regulation management table, and the record management table of each company schema, respectively.

  The processes performed by the respective management units include, for example, processes such as registration, update, reference, deletion, list display, workflow issuance and close. The incident management unit 171, the regulation management unit 172, and the record management unit 173 are respectively provided with corresponding submenu units 171 A, 172 A, and 173 A. Each submenu part 171A, 172A, 173A includes, for example, a registration part, a reference part, an update part, and a list part. In the case where workflow issuance and closing are also executed, each of the submenu units 171A, 172A, and 173A may be provided with a workflow issuing unit and a closing unit.

  For example, the registration unit 171B of the submenu unit 171A of the incident management unit 171 registers an incident in an incident table (described later) when incident information is newly created by the user and a registration instruction is input. For example, when a reference instruction for information on a predetermined incident is input by a user, the reference unit 171C of the submenu unit 171A of the incident management unit 171 reads the information on the predetermined incident from the incident table and outputs the information.

  For example, the update unit 171D of the submenu unit 171A of the incident management unit 171 updates the corresponding incident in the incident table when update information for an existing incident is input by the user and an update instruction is input. For example, the list unit 171E of the submenu unit 171A of the incident management unit 171 generates list information of all incidents stored in the incident table when an incident list display instruction is input by the user.

  The management unit included in the common management unit 17A illustrated in FIG. 4 is an example and a part, and is not limited thereto. For example, the common management unit 17A includes a correction prevention management unit that executes processing related to management correction and incident prevention planning, a self-check management unit that performs processing related to checking each item of internal audit, You may provide the education management part which performs the process concerning promotion of the knowledge education regarding ISMS and PMS.

  The management unit is not shown for the ISMS management unit 17B and the PMS management unit 17C. For example, the ISMS management unit 17B performs risk analysis such as leakage and loss of information assets, information asset management unit that manages highly confidential information assets such as in-house equipment, personnel information and financial information, etc. Includes an information asset risk analysis and management unit, a takeout management unit that manages the takeout of information assets, and an effectiveness measurement management unit that measures the effectiveness of ISMS. For example, the PMS management unit 17C includes a personal information protection management unit that manages customer personal information, a complaint management unit that manages customer complaints to the user company, and personal information that manages disclosure, correction, and suspension of use of personal information. Including the Disclosure / Correction / Suspension Management Department, the Consignee Management Department that manages information related to outsourcing companies that handle personal information, and the Personal Information Risk Analysis Management Department that performs risk analysis of leakage, loss, etc. of personal information .

  Moreover, although illustration is abbreviate | omitted, the submenu part is also provided about each management part contained in ISMS management part 17B and PMS management part 17C. Note that the processing units included in the submenu unit are not limited to the registration unit, the update unit, the update unit, and the list unit, and can be appropriately changed according to the processing of each management unit.

  The workflow processing unit 15 executes various workflows issued by the common management unit 17A, the ISMS management unit 17B, and the PMS management unit 17C.

  The system management unit 16 manages the entire integrated management system 1 and corresponds to, for example, the management function of FIG. Specifically, the system management unit 16 executes processes related to workflow definition, user registration, and the like. In addition, the system management unit 16 includes an examination information management unit 161.

  The examination information management unit 161 manages information relating to examination. The information related to auditing includes, for example, setting of auditing type, auditing institution name, auditing schedule, auditor information, function information disclosed to auditors, and the like. The examination information management unit 161 issues an initial password for login to the examiner when the information of the examiner is newly registered. Details of the processing of the examination information management unit 161 will be described later.

  The screen control unit 11 generates a screen to be provided to the user terminal. The screen control unit 11 includes a screen creation display unit 111 and a menu creation unit 112.

  The screen creation display unit 111 reads a format corresponding to an instruction from each management unit of each management unit from a storage unit (not shown) that stores a plurality of screen formats, and stores information in the format from each management unit. Is stored to generate a screen and transmitted to the user terminal.

  In the first embodiment, the screen of the integrated management system 1 includes an area for displaying a menu and an area for displaying the contents of the selected menu. The menu creation unit 112 generates information on an area for displaying the menu. The menu is determined according to the user's authority. User authority includes, for example, general users, department heads, and judges. For example, when the user is a judge, the menu creation unit 112 includes an item for calling a function for which disclosure is set for the judge in the menu, and for a function for which disclosure is not set. , An item for calling the function is not included in the menu.

<Information handled by the system>
The company information master 30 is generated in a storage area that can be used by all user terminals of all companies that use the integrated management system 1 (without access restrictions). The company master 30 stores a login table 31 and a company information table 32 which are information accessed by users of all companies using the integrated management system 1.

  FIG. 5 is a diagram illustrating an example of the login table 31. The login table 31 is a table used for determining a company to which a user belongs at the time of login. One login table 31 is created for the entire integrated management system 1. The login table 31 includes e-mail addresses and company codes of all users of the integrated management system 1 (including users of companies and examination organizations).

  FIG. 6 is a diagram illustrating an example of the company information table 32. The company information table 32 holds information about companies that use the integrated management system 1 and is used to specify the schema of each user company of the integrated management system 1. One company information table 221 is created for the entire integrated management system 1.

  The company information table 32 includes a company code, a server name of the company schema, a port number, a schema name, a company type, a company size, a service available, the number of contract users, a usable disk capacity, and the like. The “company code” is a code for identifying a company assigned by the administrator of the integrated management system 1. The storage area allocated to the company can be specified by the server name, port number, and schema name. In “business type” and “scale”, codes matching the business type and scale of the entry company are stored.

  The information stored in the company information master 30 is accessed by users of all companies that use the integrated system 1, so that information that can identify each company and user (for example, company name, industry type, scale, etc.) for security enhancement. , User names and other proper nouns) are coded.

  FIG. 7 is a diagram illustrating an example of data stored in one company schema 20. The company schema 20 is generated in a storage area where access from users of other companies is prohibited. Each company schema 20 includes a user information table 21, a user company setting table group 22, a judge setting table group 23, a workflow table 24, a common management record data group 25A, an ISMS management record data group 25B, and PMS management record data. Group 25C and examination result storage folder 26 are held.

  The user company setting table group 22 stores a main menu table and a sub menu table which are referred to for menu setting when the user has the user authority of the corresponding company. The main menu is a menu for calling each management unit included in each management unit such as the incident management unit 171, the regulation management unit 172, and the record management unit 173 included in the common management unit 17A. The submenu includes, for example, a registration unit 171B, a reference unit 171C, an update unit 171D, a list unit 171E, and the like included in the submenu unit 171A corresponding to the incident management unit 171. This is a menu for calling each processing unit. In the main menu table, a main menu is set according to the contract contents of the user company. In the submenu table, for each main menu that can be used by the user company, for example, information on submenus that can be used is registered for each user authority.

The workflow table 24 holds information related to workflows issued by the common management unit 17A, the ISMS management unit 17B, and the PMS management unit 17C. The information regarding the workflow includes, for example, the workflow ID, the management unit that has created the workflow, the user ID of the workflow transmission source, the user ID of the workflow transmission destination, the creation date and time, and the like. If the workflow is an approval request workflow, the user ID, approval date, approval result, and the like of the approver are also stored in the workflow table 24.

  The common management record data group 25 includes an incident table, a rule management table, and a record for storing data handled by each management unit such as the incident management unit 171, the rule management unit 172, and the record management unit 173 included in the common management unit 17A. Contains management tables. In these tables, for example, information such as process ID, type, content, approval status, registration date, registrant, and the like are stored. The description of the ISMS management record data group 25B and the PMS management record data group 25C is omitted, but a table is included to store data to be handled for each management unit included in the ISMS management unit 17B and the PMS management unit, respectively. ing.

  The ISMS management record data group 25B and the PMS management record data group 25C are provided when the user company has a contract for ISMS and PMS, respectively.

  The examination result storage folder 26 is a folder in which examination result files created by the judges are stored. In the examination result storage folder 26, a user who has an auditor authority can register, refer to, edit, and delete a file, and a user who does not have an auditor authority cannot register, edit, and delete a file. A user who does not have the judge authority can refer to a file stored in the examination result storage folder 26 if the user has a predetermined user authority such as a department head.

  FIG. 8 is a diagram illustrating an example of the user information table 21. The user information table 21 stores information related to users of the corresponding company and is used for user authentication at the time of login. The user information table 21 holds information such as a user ID, a mail address, a user name, a login password, a personnel number, a department code, an authority, and a name. Since the user information table 21 is a table used for user authentication at the time of login, information on the examiner of the examination organization is also stored. As for the examiner of the examination organization, a reception number determined when a contract for examination between the user company and the examination organization is established is stored in the user information table 21.

  New additions, deletions, updates, and the like of users in the user information table 21 are updated by a user having administrator authority of the integrated management system 1 of the user company through the system management unit 16. For example, one user information table 21 is held for one company schema 20.

  Returning to FIG. 7, information to be referred to by the access of the user having the judge authority is stored in the setting table group 23 for the judge. More specifically, the setting table group for judges 23 includes a theme-specific examination type definition table 231, a main menu default value definition table 232, a submenu default value definition table 233, an examination information table 234, and a main menu display setting table. 235, and a sub menu display setting table 236 is included.

FIG. 9 is an example of the theme-specific examination type definition table 231. The theme-specific examination type definition table 231 is a table for defining a management department to be examined for each theme of examination. For example, if the examination theme is ISMS, the ISMS management unit 17B that executes functions specific to ISMS and the common management unit 17A are subject to examination. For example, if the examination theme is PMS, the PMS management unit 17C and the common management unit 17A, which are functions unique to the PMS, are subject to examination. In the theme-specific examination type definition table 231 shown in FIG. 9, the management section to be examined is marked as “examination type”.

  For example, one theme-specific examination type definition table 231 is held for one company schema 20. Even if the companies are different, the management department that is subject to examination by theme does not change, and therefore, the theme-specific examination type definition table 231 may be unified by all the companies using the integrated management system 1. When each company manages the theme-specific examination type definition table 231, registration, update, reference, etc. of the theme-specific examination type definition table 231 are performed through the system management unit 16.

  FIG. 10 is an example of the main menu default value definition table 232. The main menu default value definition table 232 is a table for defining a main menu that can be presented to the examiner. Defining the main menu that can be presented to the auditor means defining information that can be disclosed to the auditor as a functional unit.

  In the first embodiment, the examination is performed in two stages, the 1st stage and the 2nd stage, and the information referred to is different, so in the main menu default value definition table 232, the judges for each of the 1st stage and the 2nd stage. The main menu that can be presented is defined.

  In the main menu default value definition table 232, “1” is set for a function that is required to disclose information to the examiner. “0” is set for a function that allows selection of information disclosure to the judge. Functions that do not require disclosure of information to the examiner are not registered in the main menu default value definition table 232. In the example shown in FIG. 10, the function name is registered, and the name of the function block in FIG. 4 and the item name of the main menu in the screen examples shown in the subsequent drawings do not necessarily match. Not exclusively.

  FIG. 11 is an example of the submenu default value definition table 233. The submenu default value definition table 233 is a table for defining functions that can be presented to the examiner as a submenu in each main menu included in the main menu default value definition table 232. The submenu default value definition table 233 also defines submenus that can be presented to the examiner for each of the 1st stage and the 2nd stage.

  In the submenu default value definition table 232, “1” is set in the submenu that must be presented to the examiner. “0” is set in the submenu that can be selected for presentation to the judges. A submenu that does not need to be presented to the examiner is not registered in the submenu default value definition table 233.

  One main menu default value definition table 232 and one sub menu default value definition table 233 are held for each schema 20 of one company. User operations such as registration, update, and reference to the main menu default value definition table 232 and the sub menu default value definition table 233 are performed through the system management unit 16.

FIG. 12 is an example of the examination information table 234. The examination information table 234 is a table for storing information concerning examination. In the examination information table 234, for example, the reception number, the name of the examination organization, the start date and the end date of each examination implementation in the 1st stage and the 2nd stage, and each of the certification bodies that can use the integrated management system 1 in the 1st stage and the 2nd stage The start date and end date of the period (indicated as “examination period” in the figure), and the examination type are stored. The examination periods of the 1st stage and the 2nd stage may be set to one month before and after the examination start date by default, for example, when the examination execution start date is input.

  The examination information table 234 is used, for example, for authentication when the examiner logs in (described later). One examination information table 234 is held in one company schema 20. In addition, user operations such as registration, update, and reference to the examination information table 234 are performed through the system management unit 16.

  FIG. 13 is an example of the main menu display setting table 235. The main menu display setting table 235 is a table for storing user settings of the main menu presented to the examiner. Since the user setting of the main menu is performed for each examination contract, there are as many main menu display setting tables 235 as the number of examination contracts in one company schema 20. Therefore, a reception number is stored in the main menu display setting table 235 to identify the contract.

  The functions included in the main menu display setting table 235 are functions included in the examination type corresponding to the examination theme of the contract, and are functions registered in the main menu default value definition table 232. In the main menu display setting table 235, a 1st stage default value, a 1st stage setting value, a 2nd stage default value, and a 2nd stage setting value are stored for each function. The 1st stage default value and the 2nd stage default value of each function of the main menu display setting table 235 are read from the main menu default value definition table 232 and stored.

  The 1st stage setting value and the 2nd stage setting value of each function of the main menu display setting table 235 are set by the user. When the 1st stage setting value and the 2nd stage setting value are “1”, the function is an examination target and is displayed on the main menu. When the 1st stage setting value and the 2nd stage setting value are “0”, the function is not an examination target and is not displayed on the menu.

  However, when the 1st stage default value and the 2nd stage default value are “1”, it is indicated that it is essential to present the corresponding function to the judge. Therefore, an error occurs when the 1st stage default value or the 2nd stage default value is “1” and the 1st stage setting value or the 2nd stage setting value is “0” (described later).

  FIG. 14 is an example of the submenu display setting table 236. The submenu display setting table 236 is a table that stores user settings for displaying the submenu in the main menu. Since the user setting of the submenu is also performed for each examination contract, there are as many submenu display setting tables 236 as the number of examination contracts in one company schema 20. Therefore, the reception number is stored in the submenu display setting table 236 to identify the contract.

  The submenu display setting table 236 is a submenu of functions included in the main menu display setting table having the same receipt number, and is a submenu registered in the submenu default value definition table 233. In the submenu display setting table 236, a 1st stage default value, a 1st stage setting value, a 2nd stage default value, and a 2nd stage setting value are stored for each submenu. The 1st stage default value and 2nd stage default value of each submenu of the submenu display setting table 236 are read from the submenu default value definition table 233 and stored.

  The first stage default value, the first stage setting value, the second stage default value, and the second stage setting value are the same as those of the main menu display setting table 235.

  The tables shown in FIGS. 5, 6, and 8 to 14 are examples, and are not limited thereto. In each table, entry items and the like can be appropriately changed according to the design of the integrated management system 1.

<Process flow>
Hereinafter, the flow of the remote examination process using the integrated management system 1 will be described using the example of the screen of the integrated management system 1 as appropriate in the order of (1) preparation before examination, (2) examination, and (3) registration of examination results. explain.

<(1) Preparation before examination>
Pre-examination preparations are performed by the user of the user company. The pre-examination preparation process includes, for example, registration of information relating to the examination, registration of information relating to the auditor, and issuance of a password.

  FIG. 15 is an example of a flowchart showing a flow of processing of the integrated management system 1 for preparation before examination. The process shown in FIG. 15 is started when a menu selection for calling the system management unit 16 is received from a user terminal of a user company who has logged into the integrated management system 1. In the flowchart shown in FIG. 15, selection of the main menu and submenu from the user terminal, pressing of an operation button on the screen, selection of a link on the screen, and the like are performed by the distribution unit 14 by the system management unit 16 and It is sent to the examination information management unit 161. In the following description of the flowcharts, functional blocks will be mainly described. However, in practice, the processor 51A of the device that executes the processing of each functional block is executing.

  In OP1, the system management unit 16 accepts selection of a submenu for calling the examination information management unit 161 from the user terminal. As a result, the examination information management unit 161 is called.

  In OP2, the examination information management unit 161 instructs the screen control unit 11 to generate an examination information list screen. The examination information list screen is a screen that is displayed when a submenu for calling the examination information management unit 161 is selected, and is a screen on which a part of information of each examination registered in the examination information table 234 is displayed as a list. (FIG. 16 to be described later). The examination information management unit 161 reads out a predetermined part of each examination information from the examination information table 234 and transmits it to the screen control unit 11 together with an instruction to generate the examination information list screen. The screen creation display unit 111 of the screen control unit 11 arranges information in the format of the examination information list screen, creates the examination information list screen, and transmits it to the user terminal. Thereby, the screen of the user terminal transitions to the examination information list screen.

  In OP3, the examination information management unit 161 receives a transition instruction from the user terminal to the examination information setting screen. The transition instruction to the examination information setting screen is transmitted from the user terminal by pressing a predetermined operation button in the examination information list screen, for example. The examination information setting screen is a screen for registering examination and examiner information (FIG. 17 described later).

In OP4, the examination information management unit 161 instructs the screen control unit 11 to transmit the examination information setting screen. The screen creation display unit 111 of the screen control unit 11 reads the format of the examination information setting screen and transmits it to the user terminal. Thereby, the screen of the user terminal changes from the examination information list screen to the examination information setting screen. The user inputs information on the examination and the examiner on the examination information setting screen.

  In OP5, the examination information management unit 161 receives the examination and examiner information input on the examination information setting screen and a registration instruction for these pieces of information from the user terminal. The examination and examination information registration instruction is transmitted from the user terminal by pressing a predetermined operation button in the examination information setting screen, for example.

  In OP6, the examination information management unit 161 issues an initial password for login to a newly registered examiner, upon receipt of an examination and an instruction for registering information of the examiner. When there are a plurality of newly registered judges, the examination information management unit 161 issues an initial password to each judge. In the first embodiment, an email address is used as the user ID at the time of login. That is, in the first embodiment, the user ID at the time of login is set by the user company.

  In OP7, the examination information management unit 161 stores the examination information input on the examination information setting screen in the examination information table 234. Further, the examination information management unit 161 stores the information of the examiner input on the examination information setting screen and the initial password issued in OP6 in the user information table 21. At this time, the examination information management unit 161 stores the authority of the examiner as “examiner” in the user information table 21.

  In OP8, the examination information management unit 161 generates a user registration notification mail for notifying the completion of registration of user information and the initial password, and transmits it to the newly registered examiner. The user registration notification mail is transmitted to the e-mail address of the examiner entered on the examination information setting screen.

  In OP9, the examination information management unit 161 receives a transition instruction from the user terminal to the examination target setting screen. The transition instruction to the examination target setting screen is transmitted from the user terminal by pressing a predetermined operation button on the examination information setting screen, for example. The examination target setting screen is a screen for setting a function to be examined, that is, a menu to be presented to the examiner (FIG. 19 described later).

  In OP10, the screening information management unit 161 instructs the screen control unit 11 to generate a screening target setting screen. The examination information management unit 161 reads predetermined information from the theme-specific examination type definition table 231, the main menu default value definition table 232, and the submenu default value definition table 233 together with the instruction to generate the examination target setting screen, and the screen control unit 11 to send. The screen creation display unit 111 of the screen control unit 11 arranges the predetermined information in the format of the screening target setting screen, generates a screening target setting screen, and transmits it to the user terminal. Thereby, the screen of the user terminal changes from the examination information setting screen to the examination target setting screen. The user inputs the setting of the function to be examined on the examination target setting screen displayed on the user terminal.

  In OP11, the examination information management unit 161 receives, from the user terminal, information on setting of functions to be examined input on the examination target setting screen and a registration instruction for information on these settings. An instruction for registering information on setting of the function to be examined is transmitted from the user terminal by pressing a predetermined operation button in the examination target setting screen, for example.

In OP12, the examination information management unit 161 uses the setting information of the function to be examined input by the user as the first stage setting value and 2nd stage setting value of the main menu display setting table 235 and the sub menu display setting table 236. ,Store. At this time, the examination information management unit 161 sets the 1st stage default value to “1” and the 1st stage setting value “0” in the main menu display setting table 235 and the submenu display setting table 236, or 2nd. If there is a menu whose stage default value is “1” and the second stage setting value is “0”, an error is output. This ensures that functions that must be presented to the judges are presented to the judges. Thereafter, the process shown in FIG. 15 ends.

(Screen transition example of user terminal prepared before examination)
FIG. 16 is an example of an examination information list screen displayed on the user terminal. In the first embodiment, the entire screen of the integrated management system 1 presented on the user terminal including the examination information list screen is divided into three frames. A user name and a logout button are arranged in a frame 310 at the top of the screen. In the frame 320, a main menu is arranged. In the frame 330, submenus included in the selected main menu are displayed as tabs, and a screen corresponding to the selected submenu is displayed. In the first embodiment, while the user is logged in, the information displayed in the frames 310 and 320 does not change, and the information displayed in the frame 330 changes according to the menu selection.

  The examination information list screen shown in FIG. 16 is a top screen of the submenu “remote examination”, and is a screen transmitted to the user terminal in OP2 of FIG. “System management” in the main menu is a menu for calling the system management unit 16. The sub-menu “Remote Screening” is a menu for calling the screening information management unit 161 in the system management unit 16. In the first embodiment, the main menu “system management” and the submenu “remote examination” are not presented to a user with auditor authority, and even a user of a user company is not a user with system management authority. Is not presented.

  A part of the information of all examinations registered in the examination information table 234 is displayed on the examination information list screen. In the example shown in FIG. 16, the reception number, the name of the examination organization, the outline of the examination, the date and period of the 1st stage examination, and the date and period of the 2nd stage examination are displayed. In the frame 330 portion of the examination information list screen, a part of the examination information read from the examination information table 234 by the examination information management unit 161 by the screen creation display unit 111 is converted into a predetermined format of the examination information list screen. Created by placing in position.

  In the first embodiment, the examination information list screen includes an operation button B1 for “registration information registration”. When the user presses the operation button B1, the screen changes to the examination information setting screen.

  FIG. 17 is an example of an examination information setting screen displayed on the user terminal. The examination information setting screen is a screen for registering information related to examination, and is a screen transmitted to the user terminal in OP4 of FIG. The examination information setting screen includes, for example, an “examination information” field for setting examination information, and an “auditor information” field for setting information on an auditor. Information input to each item of “examination information” is stored in the examination information table 234. Information input to each item of “judgment information” is stored in the user information table 21 together with the authority “judgment”.

  On the examination information setting screen, an “update” operation button B2 and an “examination object setting” operation button B3 are arranged. When the “update” operation button B2 is pressed, the information input in the “examination information” and “examiner information” fields is reflected in the examination information table 234 and the user information table 21, respectively (FIG. 15, OP7). See), an initial password is issued to the judge, and a user registration completion email is sent. By pressing the “examination object setting” operation button B3, the screen changes from the examination information setting screen to the examination object setting screen (FIG. 15, OP9, OP10).

FIG. 18 shows an example of the contents of the user registration notification mail. The user registration notification e-mail is, for example, an e-mail transmitted from the integrated management system 1 to the examiner's user terminal when the “update” operation button B2 on the examination information setting screen shown in FIG. 17 is pressed.

  The user registration notification email includes information that is required to be input at the time of login. In the first embodiment, information required to be input upon login includes, for example, a reception number, an email address, a password, and a login URL. In the first embodiment, the login URL is divided between the user of the user company and the examiner of the examination organization, and the examiner is notified of the login URL for the examiner. By receiving the user registration notification e-mail, the examiner belonging to the examination organization can acquire information that is required to be input when logging in, and can log in to the integrated management system 1.

  FIG. 19 is an example of a screening object setting screen displayed on the screen of the user terminal. The examination target setting screen is a screen for setting a function to be examined, and is a screen transmitted to the user terminal in OP10 of FIG. Setting the function to be judged means setting the main menu and submenu to be presented to the judge.

  The screening target setting screen displays a main menu that can be presented to the judges, and a check button for selecting whether to present to each judge at each of the first stage and the second stage for each main menu. The In FIG. 19, when the “target” check button is selected, it is shown that the corresponding main menu is presented to the judge. Further, in FIG. 19, when the “excluded” check button is selected, it is indicated that the corresponding main menu is not presented to the judge. For the main menu including a sub menu that can be presented to the examiner, a detailed setting button B4 is displayed.

  The main menu that can be presented to the examiner displayed on the examination target setting screen is the main menu registered in the main menu default value definition table 232 for the examination type corresponding to the examination theme. In addition, the “target” and “non-target” check buttons of the 1st stage and the 2nd stage are selected according to the 1st stage default value and the 2nd stage default value stored in the main menu default value definition table 232 as an initial state. It is displayed in the state.

  In the first embodiment, when the 1st stage default value and the 2nd stage default value are “1” in the main menu default value definition table 232, the check button for the 1st stage and 2nd stage on the examination target setting screen is “Target The state in which “is selected” is the initial state. In the main menu default value definition table 232, when the 1st stage default value and the 2nd stage default value are “0”, “not applicable” is selected for the check button of the 1st stage and 2nd stage of the examination target setting screen. The state becomes the initial state.

  The examination target setting screen is generated as follows, for example. First, the examination information management unit 161 acquires the examination type of the examination theme from the theme-specific examination type definition table 231. Next, the examination information management unit 161 displays the functions that can be presented to the examiner with the obtained examination type function (equivalent to the main menu), the 1st stage default value of each function, and the 2nd stage default value as the main menu default. The information is acquired from the value definition table 232 and transmitted to the screen control unit 11 together with the generation instruction for the examination target setting screen. The screen creation display unit 111 of the screen control unit 11 arranges the information received from the screening information management unit 161 at a predetermined position in the format of the screening target setting screen, and generates a screening target setting screen. At this time, the screen creation display unit 111 sets the selection state of the “target” or “non-target” check button of each function to a selection state according to the 1st stage default value and the 2nd stage default value.

  When the 1st stage default value and the 2nd stage default value are “1”, the “not applicable” check button may be displayed so that it cannot be selected. This is because when the 1st stage default value and the 2nd stage default value are “1”, the main menu and the sub menu are essential for examination. In the examination target setting screen shown in FIG. 19, in the main menu whose 1st stage default value and 2nd stage default value is “1”, the display color of the “not applicable” check button is changed so that the user cannot select it. Yes.

  Further, the examination information management unit 161 also reads the information in the submenu default value definition table 233 and transmits it to the screen control unit 11. Based on the information in the submenu default value definition table 233 received from the examination information management unit 16, the screen creation display unit 111 of the screen control unit 11 displays “detailed settings” for functions having a submenu (equivalent to the main menu). "Is displayed.

  When the “detailed setting” operation button B4 in the examination object setting screen is pressed, a transition is made to a screen for setting whether or not the submenu is to be examined, or a popup is displayed. Similarly to the main menu, the sub-menu is displayed with the “target” and “non-target” check buttons selected according to the default values of the first stage and the second stage of the sub-menu default value definition table 233.

  When the “update” operation button B5 in the examination target setting screen is pressed, the user settings for examination of each main menu and submenu are transmitted to the integrated management system 1 from the user terminal. This information is stored in the main menu display setting table 235 and the sub menu display setting table 236 by the examination information management unit 161. For the main menu and submenu for which the “target” check button is selected, “1” is stored in the setting values of the main menu display setting table 235 and the submenu display setting table 236. For the main menu and submenu for which the “not applicable” check button is selected, “0” is stored in the setting values of the main menu display setting table 235 and the submenu display setting table 236.

<(2) Examination>
(2) The audit is conducted by an auditor of the certification body. First, login processing to the integrated management system 1 will be described.

(Login process)
20A and 20B are diagrams illustrating a flow of login processing. 20A and 20B is started when the login unit 12 receives a login request, a mail address, and a password from the user terminal. The login request from the user terminal is transmitted, for example, when a predetermined operation button on the screen of the user terminal is pressed. In the flowcharts shown in FIGS. 20A and 20B, selection of the main menu and submenu from the user terminal, pressing of an operation button on the screen, selection of a link on the screen, and the like are performed by the distribution unit 14 by the login unit. 12 is sent.

  In OP31, the login unit 12 determines whether or not the user is an examiner of the examination organization. In the first embodiment, whether or not the user is an auditor of the auditing organization is determined by the URL accessed from the user terminal because the login URL is different between the user of the user company and the auditor of the auditing organization. . If the user is a judge (OP31: YES), the process proceeds to OP32. If the user is a user of the user company (OP31: NO), the process proceeds to OP43.

  In OP32, the login unit 12 acquires a company code corresponding to the user's mail address from the login table 31 of the company information master 30 (OP32: YES). The login unit 12 reads the server name, port number, and schema name corresponding to the acquired company code from the company information table 32 of the company information master 30. If the company code corresponding to the user's email address is not acquired from the login table 31 of the company information master 30 (OP32: NO), the accessing user is not registered, so the login unit 12 indicates that the login failed. Determination is made, and the process shown in FIG. 20A ends. In the case of login failure, a screen for notifying login failure may be transmitted to the user terminal.

  In OP33, the login unit 12 registers the mail address and password input by the user in the user information table 21 held in the company schema 20 specified by the server name, port number, and schema name acquired in OP32. It is determined whether or not it has been performed, and user authentication is performed.

  In OP34, when the mail address and password input by the user are registered in the user information table 21, the login unit 12 determines the success of user authentication (OP34: YES). The login unit 12 stores the server name, port number, and schema name acquired in OP32 in the schema information 1211 of the session information 121. By keeping the user's schema information 1211 until the user logs out, the access time to each company schema 20 can be shortened. Thereafter, the process proceeds to OP35.

  If the email address and password input by the user are not registered in the user information table 21, the login unit 12 determines that user authentication has failed (OP34: NO), and the process illustrated in FIG. 20A ends. .

  In OP <b> 35, the login unit 12 acquires the reception number associated with the user's mail address from the user information table 21. In OP36, the login unit 12 acquires a record corresponding to the reception number acquired in OP35 from the examination information table 234.

  In OP37, the login unit 12 compares the current time with the 1st stage examination period included in the examination information table 24 acquired in OP36, and determines whether or not it is currently within the 1st stage examination period. If it is currently within the examination period of the 1st stage (OP37: YES), the process proceeds to OP38. If it is not currently within the examination period of the 1st stage (OP37: NO), the process proceeds to OP39.

  In OP38, the log-in unit 12 extracts the main menu whose first stage setting value is “1” from the main menu display setting table 235 because the user is an examiner and is currently within the examination period of the first stage. Thereafter, the process proceeds to OP41.

  In OP39, the login unit 12 compares the current time with the 2nd stage examination period included in the examination information table 24 acquired in OP36, and determines whether or not it is within the current 2nd stage examination period. If it is currently within the examination period of the 2nd stage (OP39: YES), the process proceeds to OP40.

If it is not currently within the 1st stage screening period or the 2nd stage screening period (OP39: NO), the login section 12 is logged in because it is outside the period during which the user who is a judge can access the integrated management system 1. Determine failure. In this case, the held session information 121 and schema information 1211 are deleted in OP34. Thereafter, the process illustrated in FIG. 20A ends.

  In OP40, the login unit 12 extracts the main menu whose 2nd stage setting value is “1” from the main menu display setting table 235 because the user is an examiner and is currently in the examination period of the 2nd stage. Thereafter, the process proceeds to OP41.

  In OP41, the login unit 12 instructs the screen control unit 11 to generate a top screen. The login unit 12 transmits the main menu and submenu extracted in OP38 or OP39 to the screen control unit 11 together with an instruction to generate a top screen. The menu creation unit 112 of the screen control unit 11 creates a menu display including the main menu received from the login unit 12. The screen creation display unit 111 generates the top screen by arranging the menu display at a predetermined position in the format of the top screen. While the user is logged in, the menu display generated in OP41 is used. In OP42, the screen creation display unit 111 transmits the generated top screen to the user terminal. As a result, the process shown in FIG. 20A ends.

  FIG. 20B shows the flow of the login process of the user of the user company. In OP43, the login unit 12 acquires a company code corresponding to the user's mail address from the login table 31 of the company information master 30 (OP43: YES). The login unit 12 reads the server name, port number, and schema name corresponding to the acquired company code from the company information table 32 of the company information master 30.

  If the company code corresponding to the user's email address is not acquired from the login table 31 of the company information master 30 (OP43: NO), the accessing user is not registered, and the login unit 12 indicates that the login failed. Determination is made, and the process shown in FIG. 20B ends.

  In OP44, the login unit 12 registers the mail address and password input by the user in the user information table 21 held in the company schema 20 specified by the server name, port number, and schema name acquired in OP43. It is determined whether or not it has been performed, and user authentication is performed.

  In OP45, when the mail address and password input by the user are registered in the user information table 21, the login unit 12 determines the success of user authentication (OP45: YES). The login unit 12 stores the server name, port number, and schema name acquired in OP43 in the schema information 1211 of the session information 121. Thereafter, the process proceeds to OP46.

  When the email address and password input by the user are not registered in the user information table 21, the login unit 12 determines that user authentication has failed (OP45: NO), and the process illustrated in FIG. 20B ends. .

  In OP46, since the user is a user belonging to the user company, the login unit 12 reads the information stored in the user company setting table group 22 and transmits it to the screen control unit 11 together with the top screen generation instruction. The menu creation unit 112 generates a menu display based on the received information, and the screen creation display unit 111 generates the top screen by arranging the menu display at a predetermined position in the format of the top screen.

  In OP47, the screen creation display unit 111 transmits the generated top screen to the user terminal. Thereby, the process shown in FIG. 20B is completed.

(Screen transition example of user terminal for login process)
FIG. 21 is a diagram illustrating an example of a login screen for the judge. The login screen for the examiner is displayed by accessing the URL for the examination organization. The login screen for the judge shown in FIG. 21 is provided with input fields for a reception number, an e-mail address, and a password.

  The login screen for the judge has a “Login” operation button B6. By pressing the “Login” operation button B6, an email address, a password, and a login are entered from the user terminal to the integrated management system 1. A request is sent. If the login is successful, the screen changes from the login screen to the top screen.

  FIG. 22 is a diagram showing an example of the top screen for the judge. On the top screen for the judges, the main menu set by the auditee company is displayed. That is, in the main menu display setting table 235, the main menu in which the 1st stage setting value or the 2nd stage setting value is set to “1” is displayed. As a result, the judges cannot access functions corresponding to the main menu that is not displayed. When one of the main menus is selected, the screen changes to a screen corresponding to the selected main menu. In the example shown in FIG. 22, the user name of the logged-in user is displayed.

(Examination process)
When the examiner logs in to the integrated management system 1, the examination is performed while referring to the information on the function to be examined. Hereinafter, as an example, the flow of processing of the integrated management system under examination regarding the incident management function of the common management function, the regulation management function, and the export management function of the ISMS management function will be described.

(Processing during examination of incident management function)
FIG. 23 is an example of a flowchart of processing of the integrated management system 1 when examination is performed for the incident management function. The flowchart shown in FIG. 23 is started when a main menu corresponding to the incident management function is selected on the user terminal of the examiner. In the flowchart shown in FIG. 23, selection of the main menu and submenu from the user terminal, pressing of an operation button on the screen, selection of a link on the screen, and the like are performed by the allocating unit 14 in the common management unit 17A. It is sent to the incident management unit 171.

  In OP51, the incident management unit 171 of the common management unit 17A instructs the screen control unit 11 to generate an incident list screen. The incident list screen is a screen for displaying a list of incidents registered in the incident table. In the first embodiment, the incident list screen is set as a default screen when the main menu corresponding to the incident management function is selected. It is a screen. The list unit 171E of the incident management unit 171 reads predetermined information from the incident table and transmits it to the screen control unit 11. The screen creation display unit 111 of the screen control unit 11 arranges the received information at a predetermined position in the format of the incident list screen, generates an incident list screen, and transmits it to the user terminal. As a result, the incident list screen is displayed on the user terminal of the examiner.

  When the incident management unit 171 receives a transition instruction from the user terminal to the incident single-cut screen of a predetermined incident (OP52: YES), the process proceeds to OP53. The incident single-cut screen is a screen for displaying detailed information of one incident. For example, when a link indicating one of the incidents displayed on the incident list screen is selected, the transition instruction to the incident single-cut screen is transmitted from the user terminal.

  In OP <b> 53, the incident management unit 171 transmits an incident single-cut screen generation instruction to the screen control unit 11. The reference unit 171B of the incident management unit 171 reads the detailed information of the incident designated from the user terminal from the incident table, and transmits it to the screen control unit 11 together with the instruction for generating the incident single-cut screen. The screen creation display unit 111 of the screen control unit 11 arranges the received information in the format of the incident single-cut screen, generates an incident single-cut screen, and transmits it to the user terminal. As a result, an incident single-cut screen including the detailed information of the incident selected by the judge is displayed on the user terminal of the judge.

  When the incident management unit 171 receives a transition instruction from the user terminal to the approval history screen (OP54: YES), the process proceeds to OP55. The approval history screen is a screen for displaying the approval history related to the target incident on the incident single-cut screen. The transition instruction to the approval history screen is transmitted from the user terminal, for example, by pressing a predetermined operation button on the incident single-cut screen.

  In OP55, the incident management unit 171 transmits to the screen control unit 11 an instruction to generate an approval history screen for the target incident on the incident single-cut screen. The reference unit 171B of the incident management unit 171 reads the approval history of the target incident on the incident single-cut screen from the incident table, and transmits it to the screen control unit 11 together with an instruction to generate the approval history screen. The screen creation display unit 111 of the screen control unit 11 arranges the received information in the format of the approval history screen, generates an approval history screen for the target incident of the incident single-cut screen, and transmits it to the user terminal. Thereby, the approval history screen of the incident selected by the judge is displayed on the user terminal of the judge.

  Note that the processing illustrated in FIG. 23 ends in each processing, for example, when a main menu corresponding to a function other than the incident management function is selected or when a logout is performed. Further, the flowchart shown in FIG. 23 shows the process of the integrated management system 1 for an example of the operation under review performed by the auditor authority user in the incident management function, and the integrated management system in the incident management function The processing of 1 is not limited to this.

(Screen transition example during examination of incident management function)
FIG. 24 is an example of an incident list screen. The incident list screen is displayed when the submenu “incident list” of the main menu “incident management” is selected. In the first embodiment, when the main menu “incident management” is selected, the first screen is displayed. (FIG. 23, OP51).

  In the example shown in FIG. 24, the main menu “incident management” is a menu for calling an incident management function, and has submenus “incident list” and “incident all items list”. The sub-menus “incident list” and “incident all item list” are functions that refer to information, and are menus that can be presented to the examiner. In the sub-menu display setting table 236, setting values This is a submenu set to “1”. Therefore, when the submenu “all incident item list” is selected on the incident list screen shown in FIG. 24, the screen transitions to a screen displaying the incident all item list.

On the incident list screen, predetermined information of all incidents registered in the incident table is displayed. On the incident list screen, operations such as sorting incidents and filtering can also be performed using predetermined operation buttons. For example, the sorting and filtering of incidents are processed by the list unit 171E, the processing result is transmitted to the screen control unit 11, and the incident list screen displaying the sorted and filtered incident list as the processing result is generated and transmitted. .

  In the example shown in FIG. 24, the number, status, drafter, type, date and time of occurrence, summary, etc. of each incident are displayed. In the example shown in FIG. 24, the number of each incident is a link L1, and when the link L1 of the number of the incident whose details are to be referred to is selected, a screen is displayed on the incident single-cut screen displaying the details of the incident. Transition (FIG. 23, OP52, OP53).

  FIG. 25 is an example of an incident single-cut screen. Detailed information stored in the incident table of the target incident selected from the incident list screen is displayed on the incident single-cut screen. In the first embodiment, the operation button B7 for “Approval history display” is arranged on the incident single-cut screen, and the screen changes to the approval history screen by pressing the operation button B7 for “Approval history display” ( FIG. 23, OP54, OP55).

  FIG. 26 is an example of an incident approval history screen. On the incident approval history screen, the approval history of the target incident stored in the incident table is displayed. Although not shown in the respective screen examples shown in FIGS. 24 to 26, operation buttons and the like of functions other than the reference may be displayed in the format. When an operation button for a function (registration, change, etc.) other than that referred to by a user with auditor authority is pressed, the authority of the user is determined. When the user has auditor authority, for example, the user presses the operation button. Is disabled. In this way, the user with the juror authority is restricted in operation so that it cannot be registered, changed or the like other than reference.

(Processing during review of regulation management function)
FIG. 27 is an example of a flowchart of processing of the integrated management system 1 when examination is performed for the regulation management function. The flowchart shown in FIG. 27 is started when a main menu corresponding to the regulation management function is selected on the user terminal of the judge. In the flowchart shown in FIG. 27, selection of the main menu and submenu from the user terminal, pressing of an operation button on the screen, selection of a link on the screen, and the like are performed by the allocating unit 14 in the common management unit 17A. It is sent to the regulation management unit 172.

  In OP61, the regulation management unit 172 of the common management unit 17A instructs the screen control unit 11 to generate a folder list screen. The folder list screen is a screen that displays a list of folders registered in the regulation management table. In the first embodiment, the folder list screen is set as a default screen when the main menu corresponding to the regulation management function is selected. It is a screen. A list unit (not shown) of the rule management unit 172 reads the list information of the folders registered in the rule management table and transmits it to the screen control unit 11. The screen creation display unit 111 of the screen control unit 11 arranges the received folder list information at a predetermined position in the format of the folder list screen, generates a folder list screen, and transmits it to the user terminal. Thereby, the folder list screen is displayed on the user terminal of the judge.

  When the rule management unit 172 receives a transition instruction from the user terminal to the rule list screen of a predetermined folder (OP62: YES), the process proceeds to OP63. The regulation list screen is a screen for displaying a list of regulation files stored in one folder. The transition instruction to the regulation list screen is transmitted from the user terminal when, for example, one of the folder links displayed on the folder list screen is selected.

In OP <b> 63, the rule management unit 172 transmits a rule list screen generation instruction to the screen control unit 11. The list unit of the regulation management unit 172 reads the list information of the regulation file stored from the target folder of the folder group (not shown) of the regulation management function of the company schema 20, and generates a regulation list screen together with a screen control unit. 11 to send. The screen creation display unit 111 of the screen control unit 11 arranges the received list information of the specified files in the format of the specified list screen, generates a specified list screen, and transmits it to the user terminal. As a result, a rule list screen for a list of rule files stored in the folder selected by the judge is displayed on the user terminal of the judge.

  When the regulation management unit 172 receives a file reference request from the user terminal (OP64: YES), the process proceeds to OP65. The file reference request is transmitted from the user terminal by, for example, selecting a file name link of a specified file displayed on the specified list screen.

  In OP <b> 65, the regulation management unit 172 transmits a file download popup generation instruction to the screen control unit 11. The screen creation display unit 111 of the screen control unit 11 arranges the requested file information in the file download popup format, generates a file download popup, and transmits the file download popup to the user terminal. As a result, a file download pop-up of the file selected by the judge is displayed on the judge's user terminal.

  In OP66, the rule management unit 172 receives a file download start instruction from the user terminal, and the reference unit (not shown) of the rule management unit 172 reads the specified file from the target folder on the rule list screen. Send to user terminal.

  Note that the processing illustrated in FIG. 27 ends in each processing, for example, when a main menu corresponding to a function other than the prescribed management function is selected or when a logout is performed. Further, the flowchart shown in FIG. 27 shows processing of the integrated management system 1 for an example of an operation during examination performed by the auditor authority user in the regulation management function, and the integrated management system in the regulation management function. The processing of 1 is not limited to this.

(Example of screen transitions during screening of the regulation management function)
FIG. 28 is an example of a folder list screen for rule management. The folder list screen for regulation management is a screen that is displayed when the submenu “folder list” of the main menu “regulation management” is selected. In the first embodiment, the main menu “regulation management” is selected. This is the first screen displayed in this case (FIG. 27, OP61).

  In the example shown in FIG. 28, the main menu “regulation management” is a menu for calling the regulation management function, and has a submenu “folder list”. Since the submenu “folder list” is a function for referring to information, it is a menu that can be presented to the examiner, and is a submenu that is set to the setting value “1” in the submenu display setting table 236. It is.

  Information on all folders registered in the rule management table is displayed on the rule list screen. In the example shown in FIG. 28, the rule list screen displays the name of the folder and the number of registered files, and the folder name is a link L2. When the link L2 of the folder name for which a list of registered files is to be referred to is selected, the screen changes to a regulation list screen that displays a list of files registered in the folder (FIG. 27, OP62, OP63).

FIG. 29 is an example of a regulation list screen. On the regulation list screen, list information of regulation files registered in the target folder is displayed. In the example shown in FIG. 29, the specified number, specified name,
The file status, file version number, registration date, management information display, and document browsing link L3 are displayed. When the document browsing link L3 is selected, a file download pop-up of the corresponding specified file is displayed (FIG. 27, OP64, OP65).

  FIG. 30 is an example of a file download screen including a file download pop-up. By selecting “Open” or “Save”, the judge can view the prescribed file.

(Processing during examination of export management function)
FIG. 31 is an example of a flowchart of processing of the integrated management system 1 when examination is performed for the take-out management function. The flowchart shown in FIG. 31 is started when a main menu corresponding to the carry-out management function is selected on the user terminal of the examiner. In the flowchart shown in FIG. 31, selection of the main menu and submenu from the user terminal, pressing of an operation button on the screen, selection of a link on the screen, etc. are performed by the distribution unit 14 in the ISMS management unit 17B. Sent to a take-out management unit (not shown).

  In OP51, the takeout management unit of the ISMS management unit 17B instructs the screen control unit 11 to generate a takeout list screen. The take-out list screen is a screen for displaying a list of take-out information registered in a take-out management table (not shown). In the first embodiment, the main menu corresponding to the take-out management function is selected. This is the screen that is set as the default screen. A list section (not shown) in the submenu section of the takeout management section reads predetermined information from the takeout management table and transmits it to the screen control section 11. The screen creation display unit 111 of the screen control unit 11 arranges the received information at a predetermined position in the format of the take-out list screen, generates a take-out list screen, and transmits it to the user terminal. Thereby, a take-out list screen is displayed on the user terminal of the judge.

  When the take-out management unit receives a transition instruction from the user terminal to the content confirmation screen for predetermined take-out information (OP72: YES), the process proceeds to OP73. The content confirmation screen for the export information is a screen for displaying details of one export information. The transition instruction to the content confirmation screen of the take-out information is transmitted from the user terminal when, for example, one of the links of the take-out information displayed on the take-out list screen is selected.

  In OP <b> 73, the carry-out management unit transmits an instruction to generate a content confirmation screen for carry-out information to the screen control unit 11. The reference part (not shown) of the submenu part of the takeout management part reads detailed information of the takeout information designated from the user terminal from the takeout management table, along with an instruction to generate a content confirmation screen of the takeout information, It transmits to the screen control unit 11. The screen creation display unit 111 of the screen control unit 11 arranges the received information in the format of the take-out information content check screen, generates a take-out information content check screen, and transmits it to the user terminal. As a result, a screen for confirming the content of the carry-out information selected by the judge is displayed on the user terminal of the judge.

  When the take-out management unit receives an instruction to transition from the user terminal to the approval history screen (OP74: YES), the process proceeds to OP75. The approval history screen is a screen for displaying the approval history of the target bring-out information on the content confirmation screen. The transition instruction to the approval history screen is transmitted from the user terminal, for example, by pressing a predetermined operation button on the content confirmation screen.

In OP <b> 75, the take-out management unit transmits an instruction to generate an approval history screen for the take-out information targeted for the content confirmation screen to the screen control unit 11. The reference unit of the take-out management unit reads the approval history of the target take-out information from the take-out management table, and transmits it to the screen control unit 11 together with an instruction to generate an approval history screen. The screen creation display unit 111 of the screen control unit 11 arranges the received information in the format of the approval history screen, generates an approval history screen of the target carry-out information, and transmits it to the user terminal.
As a result, an approval history screen for the carry-out information selected by the judge is displayed on the judge's user terminal.

  Note that the processing illustrated in FIG. 31 ends in each processing, for example, when a main menu corresponding to a function other than the carry-out management function is selected or when a logout is performed. Further, the flowchart shown in FIG. 31 shows the processing of the integrated management system 1 for an example of the operation being performed by the judge authority user in the export management function, and the integration in the export management function. The processing of the management system 1 is not limited to this.

(Screen transition example during examination of the export management function)
FIG. 32 is an example of a take-out list screen. The take-out list screen is displayed when the sub-menu “take-out list” of the main menu “take-out management” is selected. In the first embodiment, the main menu “take-out management” is selected. Is the first screen displayed (FIG. 31, OP71).

  In the example shown in FIG. 32, the main menu “take-out management” is a menu for calling out the take-out management function, and has sub-menus “take-out list” and “take-out history”. The sub-menus “take-out list” and “take-out history” are functions that refer to information, and are menus that can be presented to the examiner. In the sub-menu display setting table 236, the setting value “1” ”Is the submenu set. Therefore, when the sub-menu “take-out history” is selected on the take-out list screen shown in FIG. 32, the screen changes to a screen for displaying the take-out history.

  On the take-out list screen, information on predetermined items among all take-out information registered in the take-out management table is displayed. In the example shown in FIG. 32, the name, status, type of take-out information, take-out form, take-out destination, etc. of each take-out information are displayed. In the example shown in FIG. 32, an operation button B8 for “content confirmation” is arranged for each piece of take-out information. When the “confirm content” operation button B8 is pressed, the screen changes to a content confirmation screen displaying details of the corresponding bring-out information (FIG. 31, OP72, OP73).

  FIG. 33 shows an example of a content confirmation screen for take-out information. On the content confirmation screen, detailed information of target export information stored in the export management table is displayed. In the content confirmation screen, in the first embodiment, an “approval history display” operation button B9 is arranged, and when the “approval history display” operation button B9 is pressed, the screen transitions to the approval history screen (FIG. 31, OP74, OP75).

  FIG. 34 is an example of a take-out approval history screen. On the take-out approval history screen, an approval history of target take-out information stored in the take-out management table is displayed.

<(3) Registration of examination results>
(3) Registration of audit results is performed by an auditor of the auditing organization. In the first embodiment, the examination result is registered by uploading a file created in the user terminal of the judge to the integrated management system. In the first embodiment, registration of examination results is processed by a record management function.

  FIG. 35 is a diagram showing the flow of the examination result registration process. The flow in FIG. 35 is started when selection of a main menu corresponding to the recording management function is received. In the flowchart shown in FIG. 35, selection of the main menu and submenu from the user terminal, pressing of an operation button on the screen, selection of a link on the screen, and the like are performed by the distribution unit 14 on the record management unit 173. Sent.

  In OP81, the recording management unit 173 instructs the screen control unit 11 to generate a recording management folder list screen. The record management folder list screen is a screen for displaying a list of folders registered in the record management table. In the first embodiment, the record management folder list screen is set as a default screen when the main menu corresponding to the record management function is selected. It is a screen that has been. A list unit (not shown) of the submenu unit 173A of the recording management unit 173 reads predetermined information from the recording management table and transmits it to the screen control unit 11. The screen creation display unit 111 of the screen control unit 11 arranges the received information at a predetermined position in the format of the recording management folder list screen, generates a recording management folder list screen, and transmits it to the user terminal. As a result, the record management folder list screen is displayed on the user terminal of the judge.

  In OP82, the recording management unit 173 receives selection of a submenu corresponding to the recording registration function from the user terminal. In OP83, the recording management unit 173 instructs the screen control unit 11 to generate a recording information list screen. The recorded information list screen is a screen that displays a list of files stored in the examination result storage folder 26 that stores examination result files. A list section (not shown) of the submenu section 173A of the recording management section 173 reads out information on one of the files stored in the examination result storage folder 26 and transmits it to the screen control section 11. The screen creation display unit 111 of the screen control unit 11 arranges the received information at a predetermined position in the format of the recording information list screen, generates a recording information list screen, and transmits it to the user terminal. Thereby, the record information list screen is displayed on the user terminal of the judge.

  In OP84, the recording management unit 173 receives a new file registration instruction from the user terminal to the examination result storage folder 26. The new file registration instruction is transmitted by pressing a predetermined operation button on the recorded information list screen.

  If the user is a judge (OP85: YES), the process proceeds to OP86. If the user is a user belonging to the user company (OP85: NO), the processing shown in FIG. 35 is terminated. Registration of a file in the examination result storage folder 26 is a process permitted to a user having a judge authority, and a user belonging to a user company refers to a file registered in the examination result storage folder 26. This is because registration is not permitted even if it is possible.

  In OP86, the recording management unit 173 instructs the screen control unit 11 to generate a recording information editing screen. The recording information editing screen is a screen for setting management information of files to be registered in the examination result storage folder 26. The screen creation display unit 111 of the screen control unit 11 transmits the format of the recording information editing screen to the user terminal. As a result, the record information editing screen is displayed on the user terminal of the judge.

  In OP87, the recording management unit 173 receives a transition instruction from the user terminal to the file registration screen. The file registration screen is a screen for registering the examination result file. The transition instruction to the file registration screen is transmitted from the user terminal, for example, by pressing a predetermined operation button in the recording information editing screen.

  In OP88, the recording management unit 173 instructs the screen control unit 11 to generate a file registration screen. The screen creation display unit 111 of the screen control unit 11 transmits the format of the file registration screen to the user terminal. Thereby, the file registration screen is displayed on the user terminal of the judge.

In OP89, the recording management unit 173 receives a file upload request from the user terminal. The file upload request is transmitted from the user terminal by pressing a predetermined operation button in the file registration screen, for example. The record management unit 173 accepts file upload from the user terminal.

  In OP90, the registration unit (not shown) of the submenu unit 173A of the recording management unit 173 stores the uploaded file in the examination result storage folder 26. Thereafter, the process shown in FIG. 35 ends.

(Screen transition example of the process of registration of examination results)
FIG. 36 is an example of a record management folder list screen. The recording management folder list screen is displayed when the submenu “folder list” of the main menu “recording management” is selected. In the first embodiment, the main menu “recording management” is selected. Is the first screen displayed (FIG. 35, OP81).

  In the example shown in FIG. 36, the main menu “record management” is a menu for calling a record management function, and has a submenu “folder list” and a submenu “record registration”. Since the submenu “folder list” is a function for referring to information, it is a menu that can be presented to the examiner, and is a submenu that is set to the setting value “1” in the submenu display setting table 236. It is. Further, the submenu “record registration” is a function for registering a file in the examination result storage folder 26, and therefore is a menu that must be presented to the examiner. In the submenu display setting table 236, the setting value “1” ”Is the submenu set. When the submenu “record management” is selected, the screen transits to the record information list screen (FIG. 35, OP82, OP83).

  FIG. 37 is an example of a recorded information list screen. On the recording information list screen, a list of management information of files stored in the examination result storage folder 26 is displayed. In the example shown in FIG. 37, a record number, a record name, a registration date, and the like are displayed. In FIG. 37, the name of the examination result storage folder 26 is described as a certification organization record folder.

  On the recording information list screen, an operation button B10 for "new recording registration" is arranged. By pressing the “new record registration” operation button B10, the screen changes to a record information edit screen (FIG. 35, OP84, OP86).

  FIG. 38 is an example of a recorded information editing screen. The recording information editing screen is a screen for editing management information of files stored in the examination result storage folder 26. The file management information includes, for example, a recording number, a recording name, a version number, a usage, and a setting for whether or not to disclose to a user with general user authority. On the recording information editing screen, a “file registration” operation button B11 is arranged. When the “file registration” operation button B11 is pressed, the screen changes to a file registration screen (FIG. 35, OP87, OP88).

  FIG. 39 is an example of a file registration screen. On the file registration screen, an “upload” operation button B12 is arranged. When the “upload” operation button B12 is pressed, the registered file is uploaded to the integrated management system.

<Operational effects of the first embodiment>
In the first embodiment, for each function, the auditee company sets whether or not to make an examination target, that is, whether or not to disclose information to the judge. In the first embodiment, the function to be examined can be set by selecting the function to be examined on the screen of the user terminal (for example, the examination object setting screen in FIG. 19). Functions that are not subject to review are not displayed in the menu on the screen provided to the reviewer, and the reviewer cannot refer to it. As a result, the auditee company can prepare for examination by a simpler operation, and can limit the information disclosed to the examiner to the information to be examined.

  In the first embodiment, the auditee's user ID is registered from the user terminal by the auditee company, so that the integrated management system 1 issues an initial password, and further sends a registration completion e-mail to the judge. To do. As a result, it is possible to save the auditee company from notifying the certification body of the registration information of the auditor.

  Since the auditor can access the integrated management system 1 from the user terminal of the auditing organization, the auditor can refer to the information to be audited without visiting the audited company, and the audit results can also be kept in the auditing organization. This reduces the burden on the auditor's examination.

  In the first embodiment, menus that are not subject to examination are not displayed on the screen of the judges, making access by the judges impossible, but instead, all menus are displayed, but from the judges. By setting the access to be ignored, it may be impossible for the judges to access the menus that are not subject to examination.

DESCRIPTION OF SYMBOLS 1 Integrated management system 11 Screen control part 12 Login part 16 System management part 20 Company schema 21 User information table 23 Setting table group 26 for a judge 26 Examination result storage folder 30 Company information master 31 Login table 32 Company information table 111 Screen creation display part 112 Menu creation unit 161 Examination information management unit 232 Main menu default value definition table 233 Submenu default value definition table 235 Main menu display setting table 236 Submenu display setting table

Claims (9)

For a plurality of tasks, one data group is a collection of data for one task, a storage unit on the network for storing a plurality of data groups,
A setting unit individually configured for the plurality of data groups by an organization that owns the plurality of data groups, and a reception unit that receives a referenceable or non-referenceable setting for access from the examination organization;
A setting holding unit for holding the setting for each of the plurality of data groups;
A providing unit that provides a data group that can be referred to by the examination organization based on the setting held in the setting holding unit with respect to access from the examination organization;
With
The providing unit provides a business selection screen including a selection item for selecting a business for access from the examination organization, and the business selection screen includes data set to be inaccessible by the setting holding unit. Do not include the selection item of the business corresponding to the group,
Remote examination system. The accepting unit does not accept a non-referenceable setting for the data group corresponding to the examination target business of the certification body by the possessing organization;
The remote examination system according to claim 1. When registration of the identification information of the user of the certification body from the possessing organization is accepted, the login password of the user is issued, and an email is sent to the user's email address with the identification information of the user and the login password. Registration section to send and notify,
The remote examination system according to claim 1, further comprising: A login information storage unit for storing identification information and a login password of the user of the examination organization;
An examination information storage unit for storing a period of examination of the examination object of the examination organization;
Using the identification information and login password stored in the login information storage unit, a login unit that authenticates the user of the examination organization,
Further comprising
The log-in unit determines that the authentication of the user of the certification body is unsuccessful, although the authentication using the identification information of the user of the certification body and the login password is successful, but is outside the examination period,
The remote examination system according to any one of claims 1 to 3. The examination body can register the examination result, and the possessing organization cannot register the examination result storage unit,
The remote examination system according to claim 1, further comprising: A first management unit that performs management related to processing unique to the first information processing system;
A second management unit for performing management related to processing unique to the second information processing system;
A common management unit for performing management related to processing common to the first information processing system and the second information processing system;
Further comprising
The storage unit includes a first plurality of data groups managed for each operation of the first management unit, a second plurality of data groups managed for each operation of the second management unit, and the common management unit Storing a third plurality of data groups managed for each business,
The accepting unit is configured to select a data group for the examination target business of the examination organization from the first plurality of data groups, the second plurality of data groups, and the third plurality of data groups. , Accepting a referenceable or non-referenceable setting for access from the certification body,
The remote examination system according to any one of claims 1 to 5. For a plurality of business operations stored in a storage unit on the network, one data group is a collection of data for one business operation, and the settings made individually for the plurality of data groups by an organization that owns the plurality of data groups A reception unit that accepts a referenceable or non-referenceable setting for access from a certification body;
A setting holding unit for holding the setting for each of the plurality of data groups;
A providing unit that provides a data group that can be referred to by the examination organization based on the setting held in the setting holding unit with respect to access from the examination organization;
With
The providing unit provides a business selection screen including a selection item for selecting a business for access from the examination organization, and the business selection screen includes data set to be inaccessible by the setting holding unit. Do not include the selection item of the business corresponding to the group,
Information processing device. In a remote examination system comprising: at least one computer on a network; and a storage unit that stores a plurality of data groups, wherein one data group is a collection of data for one task, for a plurality of tasks.
The at least one computer comprises:
It is a setting that is individually made for the plurality of data groups by an organization that owns the plurality of data groups, and accepts a setting that can be referred to or cannot be referred to for access from the examination organization,
Storing the setting for each of the plurality of data groups in a setting holding unit;
Based on the settings held in the setting holding unit for the access from the examination organization, a data group that can be referred to by the examination organization is provided.
In the providing, a job selection screen including a selection item for selecting a job for access from the examination organization is provided, and the job selection screen includes a data group that is set to be inaccessible in the setting holding unit Do not include the selection items of the work corresponding to
Remote examination method. On the computer,
For a plurality of business operations stored in a storage unit on the network, one data group is a collection of data for one business operation, and the settings made individually for the plurality of data groups by an organization that owns the plurality of data groups And accepting the setting of referenceable or non-referenceable for access from the certification body,
The setting for each of the plurality of data groups is stored in a setting holding unit,
Based on the settings held in the setting holding unit for the access from the examination organization, a data group that can be referred to by the examination organization is provided,
In the provision, a business selection screen including a selection item for selecting a business for access from the examination body is provided, and the business selection screen includes a data group that is set as non-referenceable in the setting holding unit Do not include the selection item of the work corresponding to
Remote audit program for.

Images