ITPEC FE Morning October 2018 Question 59

The operator draws up the daily operation plan and approves it himself — nobody independent checks the plan, which is a lack of segregation of duties and must be reported.

An audit finding is a status in which internal control is missing or inadequate. Approval exists so that a second person checks the plan before it is carried out; when the author approves his own plan, the check is empty, and errors or unauthorised jobs can pass unnoticed. The auditor reports it and recommends that someone else, such as the person responsible for operations, approve the plan.

Answer (a)

Why not others:

• •(b) — recording the exceptions that occur during operation is proper practice and leaves the trail an auditor needs
• •(c) — the person responsible checking the operator's records is a working supervisory control
• •(d) — keeping operation records for a specified retention period is appropriate records management

Key rule: Whoever prepares a plan or does the work must not be the one who approves or checks it; self-approval is a classic audit finding.

System Audit · AI-written, may contain errors