Question

A financial services firm discovers that a single accounts-payable clerk can create a new vendor, approve invoices for that vendor, and release payment—all without any second person's involvement. An internal auditor flags this as a significant fraud risk. Which personnel security principle should the security manager recommend implementing to most directly address the identified risk?

Accepted Answer

Separation of duties, splitting vendor creation, invoice approval, and payment release among different individuals

Answer

Mandatory vacation, requiring the clerk to take at least one continuous week off each year

Answer

Job rotation, periodically moving the clerk to a different department

Answer

Least privilege, limiting the clerk's system access to only accounts-payable functions