This question's explanation and your answers so far.
IPA “組織における内部不正防止ガイドライン (第4版)” にも記載されている, 内部不正防止の取組として適切なものだけを全て挙げたものはどれか。 a システム管理者を決めるときには, 高い規範意識をもつ者を一人だけ任命し, 全ての権限をその管理者に集中させる。 b 重大な不正を犯した内部不正者に対しては組織としての処罰を検討するとともに, 再発防止の措置を実施する。 c 内部不正対策は経営者の責任であり, 経営者は基本となる方針を組織内外に示す “基本方針” を策定し, 役職員に周知徹底する。
“a, b.” b is appropriate, but a concentrates all authority in a single administrator, which violates separation of duties and is inappropriate. This option includes the inappropriate a and lacks the appropriate c, so it is wrong.
“a, b, c.” b and c are appropriate, but a becomes a breeding ground for misconduct due to the concentration of authority and is inappropriate. This option includes a, so it is wrong.
“a, c.” c is appropriate, but a violates separation of duties due to the concentration of authority and is inappropriate. In addition, it lacks the appropriate b, so it is wrong on two counts.
正解 The correct answer is エ, which lists “b, c.” b considers disciplinary action against an insider who has committed serious misconduct while also implementing measures to prevent recurrence; it is effective for both deterrence and improvement, so it is appropriate. c positions measures against insider misconduct as management’s responsibility, with management formulating a “basic policy” and thoroughly disseminating it to officers and employees; this is exactly the management-led, top-down structure that the guidelines call for, so it is appropriate. On the other hand, a appoints only a single system administrator and concentrates all authority in that person; even if that person has a high sense of discipline, concentrating authority in one individual becomes a breeding ground for misconduct and a single point of failure, and violates the principle of separation of duties (distribution of authority and mutual checks), so it is inappropriate. Therefore only b and c are appropriate, and エ is correct.