I recently came across the concept of mandatory vacation as a management security control. Employees are forced to take at least one week of consecutive vacation to provide the company to audit their work and possibly discover fraudulent behavior by employees.
I am wondering how effective this control really is? Shouldn't there be better controls in place to prevent and/or detect fraudulent behavior in the first place, other than sending the employee out for at least a week? Also, since it's reactive, employees with a malicious intent are aware they will be sent out on mandatory vacation at a certain point in time. Doesn't this allow for them to look for ways to circumvent this control and obfuscate their malicious activity even better?