問36
頻出度★★★
内部統制を考慮した職務分掌として, 適切なものはどれか。
平成24年度 春期 ITパスポート試験 問36
マネジメント系システム監査 › 内部統制
This question's explanation and your answers so far.
解説
問 36
- ア
正解 The correct answer is ア, that it was established that an applicant cannot perform the approval themselves. Segregation of duties (separation of duties) in internal control is a control activity that divides a series of tasks into several duties so that no single person can carry the work through from start to finish, and assigns each duty to a different person so that they check one another. Its aim is not to rely on the good faith or carefulness of the people involved, but to build a structure in which fraud or mistakes cannot be completed by one person alone. A typical pair that must be separated is application (drafting, execution) and approval (review, authorization). For example, if a purchasing applicant could approve their own application, they could push through fictitious orders, personal purchases, or inflated billing without anyone checking. Option ア clearly forbids this dual role in the rules and requires the applicant and the approver to always be different people, so every application must pass a third party's eyes; the opportunity for fraud is structurally cut off, and errors are also found early. This is exactly segregation of duties working as mutual checks, and it is an appropriate measure in light of internal control. The same idea applies to separating developers from the people who release to the production environment, and cash handling staff from bookkeeping staff.
Incorrectイ
Delegating the authority of a superior who will be absent for a long time to a subordinate is delegation of authority (approval by proxy), not segregation of duties, which splits work into separate duties so that people check one another. It may be necessary as a measure to keep operations from stopping, but by itself it changes nothing about the design of whose duties are separated from whose. On the contrary, if that subordinate is normally the one who submits applications, the delegation creates a state in which they can approve their own applications; the separation of application and approval breaks down, and there is a risk that internal control is actually weakened. If authority is delegated, separate compensating controls are needed, such as making sure the delegate does not overlap with the applicant, limiting the scope and period of the delegation, and having the superior review the approval records afterwards.
Incorrectウ
Handing the early shift's remaining work over to the late shift is a handover that accompanies a change of shift (coordination for business continuity); only the person in charge changes with the time slot, and the content of the duty itself is not divided. Both the early shift and the late shift perform the same duty with the same authority, so no mutual checking relationship arises between them. Handover sheets and checklists that prevent items from being missed are important as operational controls, but that is a separate issue from segregation of duties.
Incorrectエ
Splitting one task among several people is division of labour that shares out the workload (load distribution); it does not separate the work into duties that differ in the nature of their authority and responsibility. As long as everyone performs the same kind of task with the same authority, no relationship arises in which one person approves or verifies another person's processing, so mutual checking does not work. Fraud is not prevented automatically just because more people are involved. What matters in segregation of duties is not the number of people, but the division of roles that assigns the duty that executes and the duty that approves and confirms to different people.
ここがポイント
- Segregation of duties (separation of duties) — one of the control activities of internal control. Instead of letting one person complete a whole series of tasks, the work is split into several duties assigned to different people, so that mutual checking creates a structure in which fraud or mistakes cannot be completed by one person alone. Representative pairs to separate are application and approval, execution and recording, development and production release, and cash handling and bookkeeping.
- Telling it apart from confusingly similar ideas — delegation of authority (approval by proxy) merely moves authority to another person, a handover is coordination for business continuity, and division of labour (sharing the work out) is a distribution of workload; none of them creates a mutual checking relationship, so none of them counts as segregation of duties. Whether something is segregation of duties is judged not by whether the number of people or the person in charge has changed, but by whether the side that checks and the side that is checked are different people.
用語