6

I recently came across the concept of mandatory vacation as a management security control. Employees are forced to take at least one week of consecutive vacation to provide the company to audit their work and possibly discover fraudulent behavior by employees.

I am wondering how effective this control really is? Shouldn't there be better controls in place to prevent and/or detect fraudulent behavior in the first place, other than sending the employee out for at least a week? Also, since it's reactive, employees with a malicious intent are aware they will be sent out on mandatory vacation at a certain point in time. Doesn't this allow for them to look for ways to circumvent this control and obfuscate their malicious activity even better?

Improve this question
6
  • This is a very common practice that has been in place for a long time. Yes, there are ways that the person could prepare for it, but it is better than not putting this control in place at all.
    – schroeder ♦
    Commented Dec 2, 2015 at 15:32
  • I thought it would not be common at all, which is why I posted this question. I'm in the security business (not too senior yet though) and the people I have spoken to are not really aware of this control. Our discussions often lead to job rotation, but that's another story... I'm really curious about it's effectiveness. How high is its chance to bring fraud to light? Or is it only used when there's already a suspicion about the employee committing fraud, or... I'm not really convinced..
    – Stef Heylen
    Commented Dec 2, 2015 at 15:45
  • 1
    It is supposed to be universally applied. It was more common in large organizations that handled sensitive data (and the military). It is not as common now, but still a good idea. It is a measure to detect fraud and collusion, but not considered to be 100% effective.
    – schroeder ♦
    Commented Dec 2, 2015 at 15:52
  • Would a mandatory vacation be the same thing as a paid or unpaid suspension? I never heard the term "mandatory vacation" but I have heard of suspensions being used for this reason quite often.
    – Bacon Brad
    Commented Dec 2, 2015 at 16:22
  • 1
    I would expect a suspension to be a reaction to an accusation/event while a mandatory vaction would be something more routine.
    – Peter Green
    Commented Dec 2, 2015 at 16:29

1 Answer 1

Reset to default
4

Actually, it is pretty effective. Yes the person can prepare for it but almost always something somewhere is overlooked. Will you catch it while that person is off? Not necessarily, but it causes them to have to think further ahead about malicious intent. That makes things more complicated and forces greater possibility of making a mistake.

We actually caught someone at a previous company who was stealing the company's phone lines and using them for his personal hobbies with this. He set up his own 800 number back in the day along with a number of other things. The VP caught it when something went wrong and he wasn't around to fix the problem himself.

The better approach I've seen is that instead of requiring 1 week, require 2. This has multiple benefits. 1. The person is away from work for 2 weeks and that forces the person to actually relax meaning that he or she will come back more rested. 2. Being gone 1 week, normally things can wait for that person's return. Being gone for 2 almost always ensures someone has to take a hold of your responsibilities. This leads to both oversight into what someone is doing and it forces cross training. It's a win/win.

Improve this answer
3
  • Sometimes the simple knowledge that someone will check things while they are out keeps people from realizing their malicious intent.
    – DarkLighting
    Commented Dec 2, 2015 at 16:35
  • Banks require two or more employees from the same branch to go on vacation simultaneously. It disrupts any collusion, as well. Also, FDIC policy on mandatory vacations.
    – Andrew Philips
    Commented Dec 2, 2015 at 17:05
  • In your final paragraph, 1 vs 2 weeks seems pretty arbitrary to me, and is likely industry dependent. In fast paced industries you can change the word week to day and the statement may still be valid.
    – TTT
    Commented Dec 2, 2015 at 17:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .