The internal audit department is investigating a possible breach of security. One of the auditors is sent to interview the following employees:

Employee A. Works in the accounts receivable office and is in charge of entering data into the finance system. Employee B. Works in the accounts payable office and is in charge of approving purchase orders. Employee C. Is the manager of the finance department, supervises Employee A and Employee B, and can perform the functions of both Employee A and Employee B. Which of the following should the auditor suggest be done to avoid future security breaches?

Question

The internal audit department is investigating a possible breach of security. One of the auditors is sent to interview the following employees:

Employee A. Works in the accounts receivable office and is in charge of entering data into the finance system. Employee B. Works in the accounts payable office and is in charge of approving purchase orders. Employee C. Is the manager of the finance department, supervises Employee A and Employee B, and can perform the functions of both Employee A and Employee B. Which of the following should the auditor suggest be done to avoid future security breaches?

Accepted Answer

B. The manager should only be able to review the data and approve purchase orders. Separation of duties requires that no one person can initiate and authorize the same transaction, because this creates an unchecked opportunity for fraud. Restricting the manager to reviewing data and approving purchase orders removes the ability to enter records, ensuring that input and authorization functions remain with different individuals. This breaks the conflict of interest and closes the primary fraud vector identified in the scenario.

Answer

A. All employees should have the same access level to be able to check on each others. Granting all employees identical access eliminates role-based controls entirely, violates the principle of least privilege, and would make unauthorized activity harder to detect or attribute.

Answer

C. Employee A and Employee B should rotate jobs at a set interval and cross-train. Job rotation is a useful detective and corrective control but does not resolve the active separation of duties violation where one person retains concurrent entry and approval rights.

Answer

D. The manager should be able to both enter and approve information. Allowing the manager to both enter and approve information preserves the existing control weakness and increases the risk of undetected insider fraud.

The internal audit department is investigating a possible breach of security. One of the auditors is sent to interview the following employees: Employee A. Works in the accounts receivable office…

Question

Options

How the community answered

Why each option

Topics

Community Discussion