nerdexam
CompTIA

CAS-001 · Question #422

Every year, the accounts payable employee, Ann, takes a week off work for a vacation. She typically completes her responsibilities remotely during this week. Which of the following policies, when…

The correct answer is A. Job rotation. Job rotation places a different employee in Ann's role periodically, allowing her work to be independently reviewed and making it harder to conceal ongoing improprieties.

Enterprise Security

Question

Every year, the accounts payable employee, Ann, takes a week off work for a vacation. She typically completes her responsibilities remotely during this week. Which of the following policies, when implemented, would allow the company to audit this employee's work and potentially discover improprieties?

Options

  • AJob rotation
  • BMandatory vacations
  • CLeast privilege
  • DSeparation of duties

How the community answered

(29 responses)
  • A
    90% (26)
  • B
    3% (1)
  • D
    7% (2)

Why each option

Job rotation places a different employee in Ann's role periodically, allowing her work to be independently reviewed and making it harder to conceal ongoing improprieties.

AJob rotationCorrect

Job rotation requires employees to periodically switch roles, so another person takes over Ann's accounts payable duties and can audit her prior work. Because Ann cannot remotely cover up discrepancies when someone else is actively performing the role and examining the records, any fraudulent activity is more likely to surface during the transition.

BMandatory vacations

Mandatory vacation alone does not achieve the goal here because Ann is explicitly described as working remotely during her vacation, meaning she retains control over the work and can conceal any improprieties.

CLeast privilege

Least privilege restricts the permissions an employee has but does not create an independent review mechanism to audit work that was performed within those permissions.

DSeparation of duties

Separation of duties splits a single transaction across multiple people to prevent any one person from completing fraud undetected, but it does not provide a mechanism to audit past completed work.

Concept tested: Job rotation as a fraud detection control

Source: https://csrc.nist.gov/glossary/term/job_rotation

Topics

#job rotation#insider threat#fraud detection#access control policy

Community Discussion

No community discussion yet for this question.

Full CAS-001 Practice