Skip to content

ACCA Strategic Professional · Strategic Business Leader · IT systems security and control

Karvale Logistics lets warehouse supervisors approve purchase orders and also create new suppliers in its ERP system. An internal review finds that one supervisor could create a fictitious supplier and approve payments to it. Which access control principle has most clearly been breached, and what does it imply?

Segregation of duties has been breached. One supervisor can both create suppliers and approve payments, which makes fraud possible. Access rights should be redesigned so incompatible functions sit with different people, giving an independent check on each transaction.

  1. ASegregation of duties; incompatible functions should be assigned to different users so one person cannot both create and approveCorrect
  2. BNon-repudiation; every transaction must carry a digital signature before it is posted
  3. CData minimisation; the system should hold fewer supplier records
  4. DBusiness continuity; the system needs a backup site to recover supplier data

Explanation

Allowing one user to create suppliers and approve payments combines incompatible duties, enabling fraud. Segregation of duties in access rights prevents this. Non-repudiation and backups do not address the conflict in permissions.

Did you get it right without looking?

One question tells you little. A timed set on IT systems security and control shows your real accuracy, how long you take and where you lose marks.

Practise IT systems security and controlFree diagnostic mock

More IT systems security and control questions