A manager suspects that an IT employee with elevated database access may be knowingly modifying financial transactions for the benefit of a competitor. Which of the following practices should the…

Separation of duties is an administrative control that prevents a single individual from having enough privileges to complete a critical task end-to-end, thereby mitigating the risk of fraud or error. By distributing responsibilities among multiple individuals, this practice would make it impossible for one IT employee to unilaterally modify financial transactions without collusion or detection, thus helping to validate the concern by revealing if the necessary checks are absent or being bypassed.

Mandatory vacations are a detective control that allows another employee to perform duties during an absence, potentially uncovering fraud, but they do not actively validate a current suspicion or prevent the activity in question.

Background checks are conducted prior to employment to assess trustworthiness and do not help validate a current suspicion of misconduct by an existing employee.

Security awareness training educates employees on security policies and best practices but does not implement a technical or procedural control to validate a suspicion of deliberate malicious activity.