問52
頻出度★★★
IT を利用した業務処理の統制のうち, ソフトウェアによる自動処理と人手による処理を組み合わせた統制について記述しているものはどれか。
平成23年度 秋期 ITパスポート試験 問52
マネジメント系システム監査 › 内部統制
This question's explanation and your answers so far.
解説
問 52
Incorrectア
This is completed solely by manual work, namely the salesperson who developed the client entering the information directly, and it contains no element of an automatic check by software. It describes a control carried out by hand, not a combined one. Also, when the person enters the data themselves they know the content well, so mistakes in passing information along are reduced, but the person who enters and the person who checks remain the same, so there is no mechanism for a third party to find input errors or fraud.
- イ
正解 The correct answer is イ. What the question asks for is a business processing control in which automated processing by software and manual processing by people are combined. Read the mechanism in イ as two parts. First, the system automatically judges whether the order amount has exceeded a certain figure, and if it has, it stops the processing and requires approval. This is the part handled automatically by software. Next, a manager looks at the content of the halted transaction and performs the approval action. This is the part handled manually by a person. In other words, the machine detects every relevant case without omission and passes it to a person, and the person makes the final judgment on appropriateness. This division of roles is exactly a control that combines automated processing with manual work. In addition, because the checking is done by a manager who is not the salesperson who entered the data, it also satisfies the internal control aim of mutual checking (confirmation by multiple eyes), which does not let a single person complete a transaction alone.
Incorrectウ
This is a human operating rule that limits the registration of new clients to a dedicated contract officer who is skilled in the operation, and it too describes a control achieved only by people. Narrowing down who does the work does reduce input errors through familiarity, but there is no part where the system automatically inspects the content or requires approval, so it does not count as a combination of automated and manual processing.
Incorrectエ
This is completed solely by automated processing, namely software automatically generating manufacturing instruction data from registered order-receipt data, and there is no part where a person is involved. It is a typical example of an automated business processing control. It can remove the labor of transcribing data and the transcription mistakes that go with it, but if the original order-receipt data itself is wrong, an incorrect manufacturing instruction will simply be created as it is, so it cannot be called a control that combines human judgment.
ここがポイント
- Controls over IT-based business processing (application controls) are considered in three groups: controls the system performs automatically, controls performed only by people, and controls that combine the two. When reading the choices, the decisive way to tell them apart is to look for whether both a part where the system automatically judges and controls and a part where a person judges and approves are written.
- A mechanism that makes approval by a higher-level person mandatory for transactions above a certain amount is a representative example of internal control that realizes segregation of duties and mutual checking. The aim is not to let one person complete a transaction alone, but to have it pass through another person's eyes so that errors or fraud are found early.
用語