5

I recently came across the concept of mandatory vacation as a management security control. Employees are forced to take at least one week of consecutive vacation to provide the company to audit their work and possibly discover fraudulent behavior by employees.

I am wondering how effective this control really is? Shouldn't there be better controls in place to prevent and/or detect fraudulent behavior in the first place, other than sending the employee out for at least a week? Also, since it's reactive, employees with a malicious intent are aware they will be sent out on mandatory vacation at a certain point in time. Doesn't this allow for them to look for ways to circumvent this control and obfuscate their malicious activity even better?

  • This is a very common practice that has been in place for a long time. Yes, there are ways that the person could prepare for it, but it is better than not putting this control in place at all. – schroeder Dec 2 '15 at 15:32
  • I thought it would not be common at all, which is why I posted this question. I'm in the security business (not too senior yet though) and the people I have spoken to are not really aware of this control. Our discussions often lead to job rotation, but that's another story... I'm really curious about it's effectiveness. How high is its chance to bring fraud to light? Or is it only used when there's already a suspicion about the employee committing fraud, or... I'm not really convinced.. – Stef Heylen Dec 2 '15 at 15:45
  • 1
    It is supposed to be universally applied. It was more common in large organizations that handled sensitive data (and the military). It is not as common now, but still a good idea. It is a measure to detect fraud and collusion, but not considered to be 100% effective. – schroeder Dec 2 '15 at 15:52
  • Would a mandatory vacation be the same thing as a paid or unpaid suspension? I never heard the term "mandatory vacation" but I have heard of suspensions being used for this reason quite often. – Bacon Brad Dec 2 '15 at 16:22
  • 1
    I would expect a suspension to be a reaction to an accusation/event while a mandatory vaction would be something more routine. – Peter Green Dec 2 '15 at 16:29
4

Actually, it is pretty effective. Yes the person can prepare for it but almost always something somewhere is overlooked. Will you catch it while that person is off? Not necessarily, but it causes them to have to think further ahead about malicious intent. That makes things more complicated and forces greater possibility of making a mistake.

We actually caught someone at a previous company who was stealing the company's phone lines and using them for his personal hobbies with this. He set up his own 800 number back in the day along with a number of other things. The VP caught it when something went wrong and he wasn't around to fix the problem himself.

The better approach I've seen is that instead of requiring 1 week, require 2. This has multiple benefits. 1. The person is away from work for 2 weeks and that forces the person to actually relax meaning that he or she will come back more rested. 2. Being gone 1 week, normally things can wait for that person's return. Being gone for 2 almost always ensures someone has to take a hold of your responsibilities. This leads to both oversight into what someone is doing and it forces cross training. It's a win/win.

  • Sometimes the simple knowledge that someone will check things while they are out keeps people from realizing their malicious intent. – DarkLighting Dec 2 '15 at 16:35
  • Banks require two or more employees from the same branch to go on vacation simultaneously. It disrupts any collusion, as well. Also, FDIC policy on mandatory vacations. – Andrew Philips Dec 2 '15 at 17:05
  • In your final paragraph, 1 vs 2 weeks seems pretty arbitrary to me, and is likely industry dependent. In fast paced industries you can change the word week to day and the statement may still be valid. – TTT Dec 2 '15 at 17:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.