Which of the following controls primarily detects abuse of privilege but does not prevent it?

Off-boarding is a detective control because it involves a systematic review of all access rights, account activity, and system permissions tied to a departing employee, which can reveal unauthorized or excessive privilege use during their tenure. Because off-boarding occurs after the person is leaving or has already left the organization, any abuse has already taken place and cannot be undone - making it fundamentally unable to prevent the original offense. This post-event timing is what classifies off-boarding as primarily detective rather than preventive.

Separation of duties is a preventive control that divides sensitive tasks among multiple individuals so no single person can complete a fraudulent or abusive action without involving another party.

Least privilege is a preventive control that restricts user access to only the minimum permissions required for their job function, directly limiting the opportunity for privilege abuse before it can occur.

Job rotation moves employees through different roles over time, which can expose ongoing fraud when a new person assumes the position, but it also serves as a deterrent - giving it both detective and preventive characteristics rather than being purely detective.