問33
頻出度★★★
内部統制の観点から, 担当者間で相互けん制を働かせることで, 業務における不正や誤りが発生するリスクを減らすために, 担当者の役割を決めることを何というか。
平成27年度 春期 ITパスポート試験 問33
マネジメント系システム監査 › 内部統制
This question's explanation and your answers so far.
解説
問 33
Incorrectア
Delegation of authority means that a superior hands over their own judgment and decision-making authority to subordinates in order to speed up decisions and increase autonomy at the front line. Its essence is passing authority downward, not splitting roles so that people monitor each other; in fact, if authority becomes concentrated in the person it was delegated to, the risk of fraud can even increase. It is not a term whose purpose is mutual checking.
- イ
正解 The correct answer is イ (Separation of duties). Separation of duties is an internal control mechanism in which a single business process is split into roles such as requesting, approving, executing, recording, and reconciling, and each role is assigned to a different person so that they keep one another in check. For example, if the person who places an order is separated from the person who inspects the goods, and the person who handles cash is separated from the person who keeps the books, no single person can complete a fraud alone, and one person's mistake can be noticed by whoever handles the next step. This matches exactly what the question describes: deciding the roles of the people in charge so that they keep each other in check and the risk of fraud or errors is reduced. Separation of duties belongs to the control activities element of internal control and is a representative control measure.
Incorrectウ
Monitoring is indeed one of the basic elements of internal control, but it refers to continuously observing and evaluating whether the controls that have been put in place are working as intended, through day-to-day operations or internal audits, and correcting any deficiencies. In other words, it checks the effectiveness of controls after the fact, rather than dividing roles among people in advance so that they keep each other in check. It is not an appropriate name for the mechanism the question asks about.
Incorrectエ
Risk diversification is a risk response technique in which investments, suppliers, sites, system configurations, and the like are split among several options so that losses do not become concentrated. What it addresses is asset-related or business-related risk; it is not a term for an internal control mechanism that checks fraud and errors by dividing roles among the people in charge. It only resembles the answer in the sense of dividing something, while the object it applies to is entirely different.
ここがポイント
- Separation of duties (segregation of duties) = a control activity that splits one business process into steps such as requesting, approving, executing, and recording, assigns them to different people, and makes them keep each other in check. The aim is to prevent any one person from completing a fraud alone.
- Among the basic elements of internal control (control environment, risk assessment and response, control activities, information and communication, monitoring, and response to IT), separation of duties belongs to control activities while after-the-fact observation belongs to monitoring; keep the two roles clearly distinguished.
用語