Question

We discussed general controls, such as passwords and user-IDs and how the access control matrix defines what an individual user can/cannot do for any individual task. Listed below are tasks that are performed in the EXPENDITURE CYCLE. ASSUME THERE ARE FOUR EMPLOYEES IN THE EXPENDITURE CYCLE. Together, these employees perform the tasks below.

REQUIRED Management has asked you to separate the tasks between the FOUR persons so as to maintain separation of duties. You are to decide which tasks can be performed by the same person WITHOUT violating separation of duties. For each task, indicate if it can be performed by person A, B, C or D. Make sure the tasks assigned to any person do not violate separation of duties.

TASK                                                                                        PERSON

Generate Purchase Orders

Record receipts of material

Approve new vendors

Generate Purchase Requisitions

Approve invoices for payment

Post invoices to the general ledger

Count material received

Solicit bids from vendors

Answer 1

Task	Person
Generate Purchase Orders	A
Record receipts of material	B
Approve new vendors	D
Generate Purchase Requisitions	A
Approve invoices for payment	D
Post invoices to the general ledger	B
Count material received	C
Solicit bids from vendors	A , C

• Powers are delegated to each person and held responsible and accountable.
• The task should be assigned to each and every person so that there is no confusion for management.
• No person receipts and record the material at the same time.