A company that has a mandatory vacation policy has implemented which of the following controls?

Mandatory vacation is a risk management control specifically designed to detect and deter fraud by forcing employees to step away, allowing supervisors or peers to review their activities and identify irregularities such as embezzlement. It is classified as a risk control because its primary objective is to reduce the likelihood and impact of insider threats and fraudulent activities. This control is commonly paired with job rotation in financial and regulated environments.

Privacy controls govern the handling and protection of personal or sensitive data and are not concerned with employee scheduling or rotation.

Technical controls are technology-based safeguards such as firewalls, encryption, or access control lists, not administrative HR scheduling policies.

Physical controls include locks, surveillance cameras, and barriers that protect physical assets, not administrative policies governing employee time off.