False-negative reporting on weaknesses means the control weaknesses in the network are not identified and therefore may not be addressed, leaving the network vulnerable to attack. False-positive reporting is one in which the controls are in place, but are evaluated as weak, which should prompt a rechecking of the controls. Less-detail reporting and differential reporting functions provided by these tools compare scan results over a period of time.

セクション：情報システムの取得、開発、導入

セクション：情報資産の保護
Explanation:
適切に計画されたリスクベースの監査プログラムは、監査の効率性と有効性を向上させる。
この種の監査の高度さや形式は、対象企業の規模や複雑さによって大きく異なる。