An employee who both orders and receives merchandise is violating which of the following principles?

The principle of separation of responsibility, also known as segregation or separation of duties, is a fundamental internal control designed to prevent fraud and error. This principle dictates that no single individual should have control over all phases of a transaction. In this scenario, allowing one employee to both order (authorize a transaction) and receive (take custody of the asset) merchandise eliminates an essential check and balance. This consolidation of functions creates an opportunity for that employee to commit and conceal fraudulent acts, such as ordering goods for personal use or accepting incorrect or substandard shipments.

A. Audit control: This is a broad category of controls. The violation of separation of duties is a specific failure within the overall system of audit controls, but "separation of responsibility" is the precise principle being violated.

C. Unity of command: This management principle states that an employee should report to only one supervisor, which is unrelated to the combination of transactional duties described.

D. Delegation of duty: This refers to the act of assigning tasks to others. The problem is not the delegation itself, but the improper combination of duties assigned to a single person.

1. ASIS International. (2021). Protection of Assets (POA)

Business Principles. Section 2.4.3

Internal Controls. This section details that a key element of internal controls is the separation of duties

specifically citing the need to separate authorization

custody of assets

and record-keeping to reduce opportunities for fraud. The scenario is a classic example of violating this principle.

2. Fischer

R. J.

Halibozek

E.

& Walters

D. C. (2019). Introduction to Security (10th ed.). Butterworth-Heinemann. In Chapter 15

"White-Collar Crime

" the text explains that procedural controls like separation of duties are critical for preventing asset misappropriation. It emphasizes that functions such as purchasing

receiving

and payment should be handled by different individuals.

3. Moeller

R. R. (2013). COSO Internal Control - Integrated Framework: Turning Principles into Positive Action. John Wiley & Sons. The COSO framework

a standard referenced in business and security management

identifies segregation of duties as a key control activity (Principle 10). It explicitly warns against combining custodial

authorization

and record-keeping responsibilities.