Which strategy employed by risk management would BEST help to prevent internal fraud?

Annual control certification verifies control effectiveness, which is good practice, but it is a detection and assurance mechanism rather than a direct preventative measure against internal fraud like SoD.

Regular audits are detective controls that identify fraud after it has occurred or detect vulnerabilities, but they do not primarily prevent internal fraud in real-time.

Segregation of duties (SoD) prevents a single individual from performing all steps in a critical process that could lead to fraud or error, such as authorizing, executing, and recording transactions. By distributing responsibilities, it creates a check-and-balance system that makes collusion necessary for fraud.

Reviewing unresolved incidents is part of incident management and helps identify weaknesses, but it is a reactive measure rather than a proactive prevention strategy against internal fraud.