問36
頻出度★★★
内部統制に関する記述 a～c のうち, 適切なものだけを全て挙げたものはどれか。 a 経営者は内部統制の整備と運用の責任をもっている。 b 内部統制の運用については, 組織の全員が自らの業務との関連において一定の役割を担っている。 c 費用対効果にかかわらず, 内部統制は整備すべきである。
平成23年度 秋期 ITパスポート試験 問36
マネジメント系システム監査 › 内部統制
This question's explanation and your answers so far.
解説
問 36
- ア
正解 The correct answer is ア (only a and b are appropriate). Internal control is a process that is built into business operations and carried out by everyone inside the organization in order to obtain reasonable assurance that four objectives are achieved: effectiveness and efficiency of operations, reliability of financial reporting, compliance with laws and regulations related to business activities, and safeguarding of assets. As for a, the ultimate responsibility for establishing this internal control (building the mechanisms) and operating it (running it day to day) lies with management, and management is also in the position of evaluating whether its own company's internal control is functioning effectively, so a is appropriate. As for b, internal control does not belong only to management or the audit department. From the board of directors, corporate auditors and managers down to general employees, every member of the organization takes on a certain role such as approving, recording and checking, in relation to the duties they are in charge of, and only then does internal control work. If it is left entirely to one particular department, control becomes a mere formality, so b is appropriate as well. On the other hand, as for c, internal control has inherent limitations (errors in judgment, collusion among several people, unforeseen events, and so on) and cannot reduce risk to zero. The principle is therefore to compare the loss that the risk could cause with the cost of introducing and operating the control, and to establish control reasonably within the range where it is worth the cost. Statement c, which says control should be established regardless of cost-effectiveness, is not appropriate. Hence ア, which lists only a and b, is the correct answer.
Incorrectイ
The combination a, b, c is correct as far as a and b being appropriate goes, but it is wrong because it also includes c, which is not appropriate. Statement c, which says internal control should be established regardless of cost-effectiveness, amounts to claiming that it does not matter even if the cost of the control exceeds the size of the risk it is meant to prevent, and that goes against the basic idea of internal control. Internal control is a means of supporting the original business activities; excessive control lowers operational efficiency and instead gets in the way of the organization as a whole achieving its objectives. The principle is to weigh cost against effect and design control at a reasonable level, so a combination that includes c cannot be chosen.
Incorrectウ
The combination a, c is right in that it includes a, which is appropriate, but it makes a double mistake: it drops b, which is equally appropriate, and picks up c, which is not appropriate. Statement b, that every member of the organization plays a certain role in relation to their own duties in operating internal control, is an important property contained in the very definition of internal control, so it cannot be treated as inappropriate. If one misunderstands internal control as something carried out only by management or the internal audit department, the everyday control activities on the front line (mutual checks, approval procedures, reconciliation of records, and so on) drop out. Statement b must be included, while c, conversely, must not be.
Incorrectエ
The combination b, c is right in that it includes b, which is appropriate, but it drops a, which is equally appropriate, and picks up c, which is not appropriate, so it is wrong. Statement a, that management is responsible for establishing and operating internal control, states where the responsibility for establishment and operation lies, and management being the ultimate party responsible is a basic principle of internal control. Every member of the organization taking on a role (b) and management being responsible for the whole mechanism (a) do not contradict each other; both hold at the same time. Leaving a out already makes the option wrong, and including c makes it untenable as well.
ここがポイント
- Internal control = a process built into business operations and carried out by everyone inside the organization in order to obtain reasonable assurance that four objectives are achieved: effectiveness and efficiency of operations, reliability of financial reporting, compliance with laws and regulations, and safeguarding of assets. The ultimate responsibility for establishing and operating it lies with management, while the actual operation is carried out by every member of the organization, from management down to general employees, each playing a role in relation to their own duties.
- Internal control has inherent limitations (errors in judgment, collusion between the people in charge, unforeseen events, management override), so risk cannot be reduced to zero. The principle is therefore to take cost-effectiveness into account and establish control at a reasonable level matching the size of the risk; a statement that control should be strengthened without regard to cost is wrong (a classic trap).
用語