IT Service Management and Systems Audit
In internal control over purchasing, which of the following is an appropriate measure in line with segregation of duties?
- AHaving different people enter purchase order data and approve those orders
- BTo make the work more efficient, having the same person handle ordering, receiving inspection and payment
- CSo that staff transfers cause no trouble, giving everyone authority for all processing
Show answer and explanation
Answer: A. Having different people enter purchase order data and approve those orders
Segregation of duties is the principle of dividing responsibilities and authority so that no single person can carry out a transaction alone from initiation through approval, recording and custody of assets. If input and approval are done by different people, errors and fraud cannot be completed by one person's decision and are easier to find through mutual checks. The same principle is applied in information systems, for example by separating the people who develop programs from those who operate the production environment.
- A. Correct. Separating input from approval means one person cannot complete an error or fraud alone.
- B. If one person can handle everything from ordering to payment, it is hard to prevent fraud, such as fictitious orders, and errors.
- C. This grants more authority than necessary, which goes against both segregation of duties and the principle of keeping authority to the necessary minimum.
Continue: 9 more IT Service Management and Systems Audit questions