問45
頻出度★★★
基本方針に基づいて内部統制を整備及び運用する役割と最終責任を有する者はだれか。
平成22年度 春期 ITパスポート試験 問45
マネジメント系システム監査 › 内部統制
This question's explanation and your answers so far.
解説
問 45
Incorrectア
Shareholders invest in the company and, through the general meeting of shareholders, elect directors and thereby entrust management of the company to them. They receive profit (dividends) from the results of management and have the right to choose the managers, but they do not carry the executive role of establishing the internal control mechanism themselves or operating it day to day. Therefore they are not the ones with ultimate responsibility for its establishment and operation.
Incorrectイ
A statutory auditor has the role of monitoring and auditing, from an independent standpoint, whether directors and management are carrying out their duties properly. With internal control as well, the statutory auditor is on the side that checks whether the mechanism built by management is functioning effectively, not the side that establishes and operates it. The one who checks and the one who establishes and operates need to be separated, so if the statutory auditor bore ultimate responsibility, mutual checks and balances would no longer work.
- ウ
正解 The correct answer is ウ, management. Internal control is a mechanism that the organization itself builds into its work and operates, in order to achieve the objectives of effectiveness and efficiency of operations, reliability of financial reporting, compliance with laws and regulations, and safeguarding of assets. For this mechanism, the board of directors decides the basic policy of the way internal control is to be put in place, and it is the role of management to actually build the systems, rules and business processes based on that basic policy and to operate them day to day. Management is in the position of bearing ultimate responsibility for all of the activities of the organization, and responsibility for whether internal control functions effectively is included in that. Therefore, the one who has the role and ultimate responsibility for establishing and operating internal control based on the basic policy is management. It helps to remember that management alone handles both establishment (building the mechanism) and operation (keeping the built mechanism running), and also bears responsibility for the results.
Incorrectエ
Internal auditors are placed inside the organization and, under the direction of management, evaluate the effectiveness of operations and of internal control and report problems to management. In terms of the components of internal control, they are the ones who carry out monitoring (supervisory activity), and they stay in the position of advising management on improvements. They are not the parties who establish and operate the mechanism, and ultimate responsibility still rests with management.
ここがポイント
- The division of roles in internal control - the board of directors decides the basic policy, management establishes and operates internal control based on that policy and bears ultimate responsibility, the statutory auditor monitors from an independent standpoint, and the internal auditor evaluates effectiveness as monitoring. Sort it out in three layers: who decides, who builds and runs it, and who checks it.
- Memorize together the four objectives of internal control (effectiveness and efficiency of operations, reliability of financial reporting, compliance with laws and regulations related to business activities, and safeguarding of assets) and the six basic components (control environment, risk assessment and response, control activities, information and communication, monitoring, and response to IT). Internal audit is positioned within these as monitoring.
用語