ITPEC IP October 2024 Question 64

Preventing the same person from performing both purchasing and payment is an appropriate segregation-of-duties control. Separating authorization, custody, recording, and payment makes it harder for one person to create and conceal an unauthorized purchase. It also increases the likelihood that mistakes or fraud are detected through independent checking.

Answer (c)

Why not others:
- (a) clear job descriptions support accountability, so preventing their creation weakens control
- (b) handover documentation supports continuity and traceability, so suppressing it is inappropriate
- (d) separating system development from system operation is itself a useful control; preventing that separation concentrates conflicting duties

Key rule: Internal control assigns clear responsibilities and separates incompatible duties so one individual cannot complete and hide an improper transaction alone.

AI-generated — may contain errors