A security auditor suspects two employees of having devised a scheme to steal money from the company. While one employee submits purchase orders for personal items, the other employee approves these…

Background checks are pre-employment controls and cannot detect fraudulent activity that begins after an employee has already been hired.

Job rotation periodically moves employees across roles and responsibilities, which causes a different person to scrutinize the purchase order and approval workflow, exposing the fraudulent pattern. It simultaneously serves as a detective control - uncovering the existing scheme - and a preventive control - discouraging future collusion because employees know their work will eventually be reviewed by colleagues.

Least privilege limits access to the minimum needed for a role but does not address collusion where both employees already hold legitimate access rights required for their respective duties.

Employee termination procedures are reactive and only applicable after misconduct has already been confirmed, providing no mechanism to detect or prevent the ongoing scheme.