問43
頻出度★★★
内部統制機能を構築するに当たって, 仕事の役割分担や仕事の権限を明確にすることを何というか。
平成23年度 特別試験 ITパスポート試験 問43
マネジメント系システム監査 › 内部統制
This question's explanation and your answers so far.
解説
問 43
- ア
正解 The correct answer is ア, segregation of duties. Segregation of duties means defining in advance, for each piece of work, who may do what and how far they may go — that is, the division of roles and the scope of authority — and separating duties so that work is not concentrated in one person. The wording in the question, “clarifying the division of work roles and work authority,” is exactly the definition of segregation of duties. Among the basic components of internal control it belongs to control activities, and it is put into practice in ways such as assigning the person who places an order, the person who inspects and accepts the goods, and the person who approves payment to different people, or separating the person who develops a system from the person who holds the authority to release to the production environment. Once the person who does the work, the person who approves it, and the person who records it are separated in this way, no single person can carry a fraud through to the end, and each person's work naturally acts as a check on the others, so fraud and mistakes can be prevented before they happen or found early. Building this mechanism of mutual checks is the aim of segregation of duties.
Incorrectイ
Internal audit is an activity in which an internal audit department, independent of the departments that carry out the work, checks after the fact whether internal control has been established and is being operated as defined, and reports to management with proposals for improvement. It is a mechanism on the side that verifies the effectiveness of controls already in place, not the act of defining roles and authority in the first place. The two stand in an order: internal audit checks whether segregation of duties is being observed.
Incorrectウ
Monitoring is one of the basic components of internal control: it is the process of continuously watching and evaluating whether internal control keeps functioning effectively. It includes ongoing monitoring built into daily operations and separate evaluations carried out by internal audit and the like. This too is an activity that watches how controls are being operated, and it is distinguished from the control activity of clearly defining the division of work roles and authority itself.
Incorrectエ
Risk analysis is the step of identifying events that would keep the organization from achieving its objectives and estimating how likely they are to occur and how large their impact would be; it is part of risk assessment (the evaluation of and response to risk). It stops at the stage of working out where and what kind of danger exists, and does not extend to actually separating duties or drawing lines of authority as a countermeasure. Segregation of duties is one of the countermeasures taken in response to the results of risk analysis.
ここがポイント
- Segregation of duties is a control activity that clearly defines the division of roles and the scope of authority for work, separates duties, and makes the people in charge check one another. The basic principle is not to let the same person combine execution, approval, recording, and custody of assets; the aim is to create a state in which no one person can complete a fraud alone.
- Internal control has six basic components: the control environment, the evaluation of and response to risk, control activities, information and communication, monitoring, and response to IT. Segregation of duties belongs to control activities, while monitoring and internal audit are on the side that inspects and watches controls already in place. Keeping this difference in roles in mind lets you tell the choices apart in questions of this kind.
用語