Job rotation is best used to detect fraud by assigning employees to different roles.

When an employee is moved from one role to another, the individual subsequently

assigned to the former role, or the rotated employee in their new capacity, may uncover

irregularities or fraudulent activities. This practice is a detective control, as the change

in personnel and responsibilities provides an opportunity for fresh review and discovery

of concealed actions. Approved sources, such as university audit guidelines and NIST

publications, identify job rotation (or "rotation of duties") as a detective control that can

help uncover fraud.

· A. Least privilege: This is a preventive control that limits users' access to only the

information and resources necessary for their jobs. It aims to prevent unauthorized

actions, not primarily detect existing fraud through role changes. (NIST SP 800-53

Rev. 5, AC-6).

· B. Mandatory vacation: This detective control requires employees to take time off,

during which others perform their duties, potentially uncovering fraud. However,

"assigning employees to different roles" more precisely describes job rotation, where

an employee is formally moved to a new role, rather than their existing role being

temporarily covered. (NIST SP 800-100, p. 11-10).

· C. Separation of duties: This is primarily a preventive control that divides critical

tasks among different individuals to reduce the risk of any single person perpetrating

and concealing fraud. While it can aid detection, its core purpose is prevention by

design. (University of Illinois Audits; NIST SP 800-53 Rev. 5, PS-9).

1. University of Illinois, Office of University Audits. (n.d.). Internal Controls -

Best Practices. Retrieved from

https://www.audits.uillinois.edu/internal_controls_best_practices

o Specific Location: Under "Examples of Detective Controls," it lists "Rotation of

Duties." Under "Examples of Preventive Controls," it lists "Separation of Duties." This

source clearly distinguishes their primary purposes.

2. National Institute of Standards and Technology (NIST). (2007). NIST Special

Publication 800-100: Information Security Handbook: A Guide for Managers.

Retrieved from https://csrc.nist.gov/publications/detail/sp/800-100/final

o Specific Location: Chapter 11: "Personnel Security," page 11-10, states, "Periodic

job rotation and mandatory vacations also may aid in timely detection of inappropriate

actions."

3. National Institute of Standards and Technology (NIST). (2016). NIST Interagency

Report 7621 Revision 1: Small Business Information Security: The

Fundamentals.

Retrieved from https://csrc.nist.gov/publications/detail/nistir/7621/rev-1/final

o Specific Location: Section 3.3.4 "Controls for protecting information," page 27,

mentions, "Implement separation of duties and/or job rotation to ensure that no single

individual has excessive control over sensitive information or processes, and to detect

and deter fraudulent activities."

4. National Institute of Standards and Technology (NIST). (2020). NIST Special

Publication 800-53 Revision 5: Security and Privacy Controls for Information

Systems

and Organizations. Retrieved from https://csrc.nist.gov/publications/detail/sp/80053/rev-5/final

o Specific Location: Control AC-6 "Least Privilege" and PS-9 "Separation of Duties."

These descriptions emphasize their role in restricting capabilities and preventing

conflicts of interest, indicative of preventive measures.