ITPEC IP April 2019 Question 63

Purchasing and payment are not processed by the same person — segregation of incompatible duties is a basic internal-control measure.

If one person can both place an order and pay for it, that person can create a fictitious or inflated purchase and pay it without anyone else noticing. Splitting the steps between different people means each transaction passes through a second pair of hands, so errors and fraud are more likely to be detected. Each of the other options leaves out something that supports control.

Answer (c)

Why not others:

• •(a) — a job description stating the scope of work and roles makes responsibility clear; not creating one weakens control
• •(b) — a handover document keeps work consistent and traceable when staff change; not creating one weakens control
• •(d) — keeping development staff apart from production (operation) staff is itself a segregation-of-duties control; not separating them removes it

Key rule: Internal control separates incompatible duties (authorize, execute, record, pay) and makes responsibilities explicit, so no single person can both commit and conceal an improper act.

System Audit · AI-written, may contain errors