A log collection part of a log analysis server collects an application log from a WF server, collects an operation log from an ID control part which relays an access from an operator terminal to a business server, and which as well records access status to the business server as an operation record in the operation log, and collects an access log from the business server which records accessed status as an access record in the access log. A log analysis part determines, based on the application log, the operation log, and the access log collected by the log collection part, whether or not the accessed status recorded as the access record is an authorized access.