問49
頻出度★★★
内部統制に関する記述として, 適切なものはどれか。
平成21年度 秋期 ITパスポート試験 問49
マネジメント系システム監査 › 内部統制
This question's explanation and your answers so far.
解説
問 49
Incorrectア
The one responsible for establishing and operating internal control is management itself, not the internal auditor. From a position independent of management, the internal auditor evaluates whether internal control is functioning effectively and reports the results to management (independent monitoring); the auditor is not in a position to supervise management.
Incorrectイ
In principle, risk is assessed by combining two axes — likelihood of occurrence (frequency) and degree of impact — not by only one of them. Looking only at impact means overlooking small deficiencies that occur frequently. Moreover, the objectives of internal control include not only reliability of financial reporting but also effectiveness and efficiency of operations, compliance with laws and regulations, and more.
Incorrectウ
When the operating department itself checks its own work with a checklist, that is «ongoing monitoring (self-assessment)», not independent monitoring. Independent monitoring refers to periodic evaluation by parties independent of the execution of operations, such as an internal audit department. The choice confuses the two names, so it is wrong.
- エ
正解 Internal control is a management process built into and operated within business activities so that management can obtain «reasonable assurance» regarding the achievement of organizational objectives such as effectiveness and efficiency of operations, reliability of financial reporting, compliance with laws and regulations, and safeguarding of assets. The party responsible for establishing and operating it is management, and it provides only reasonable assurance rather than absolute assurance — both points match the definition, so エ is correct.
ここがポイント
- Definition of internal control: a process built into and operated within business activities so that management obtains «reasonable assurance» regarding the achievement of organizational objectives. Responsibility for establishing and operating it lies with management.
- Two types of monitoring: ongoing monitoring (self-assessment) performed by the operating departments themselves, and independent monitoring performed by parties in an independent position such as the internal audit department.
用語