ITPEC FE Morning October 2018 Question 59

Audit Finding (Separation of Duties) — An operator creating and approving their own daily operation plan violates segregation of duties.

In a system operations audit, a finding is a situation where internal controls are missing or violated. The key principle here is separation of duties — the person who creates a plan should not be the same person who approves it.

• •a) Correct. The operator decides a daily operation plan and approves it himself. This is a control weakness — creation and approval must be handled by different people to prevent unauthorized or unchecked actions.

Why not the others:
- b) Recording exception handling during operations is proper documentation practice.
- c) The operations manager reviewing operator logs is a standard supervisory control.
- d) Storing operation records with a specified retention period is proper records management.

Key rule: When one person both creates and approves the same item, it violates separation of duties — a common audit finding.

AI-generated — may contain errors