Which of the following should Pete, a security manager, implement to reduce the risk of employees working in collusion to embezzle funds from their company?

A privacy policy governs the handling of personal data and does not address the risk of employees colluding to commit financial fraud.

Least privilege limits what resources an employee can access but does not detect or prevent collusion among employees who already have the necessary legitimate access.

An acceptable use policy defines appropriate use of company resources and does not provide a mechanism to detect or interrupt ongoing collusion between employees.

Mandatory vacations are a detective control specifically designed to uncover fraud and collusion by ensuring that another employee must cover the absent worker's responsibilities. When a second person performs the same duties, discrepancies such as falsified records or embezzlement schemes that rely on a single person's continuous control become visible. This control is widely recommended in financial and high-trust roles to break the continuity required to sustain collusion.