easyMultiple Select
CISA Practice Question: Which TWO of the following are HR controls that…
Which TWO of the following are HR controls that help mitigate the risk of insider fraud in IT? (Select TWO.)
⚠ Common exam trap
CISA often tests the difference between general HR practices (recognition, reviews, flexible hours) and specific fraud-deterrent controls (job rotation, mandatory vacation), so candidates who pick feel-good HR activities miss the control objective.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Job rotation
Job rotation (D) is a recognized HR control that mitigates insider fraud because moving employees among different duties prevents any single person from maintaining long-term, unchallenged control over a sensitive process, and it increases the chance that irregularities or fraudulent activity are detected by a fresh set of eyes. Mandatory vacation (E) is also a standard fraud-deterrence control: requiring employees to take continuous time away forces their duties to be performed by someone else, exposing schemes such as lapping, ghost vendors, or unauthorized transactions that depend on the perpetrator being continuously present to conceal them. By contrast, flexible work hours (A) can actually reduce oversight and segregation of duties, employee recognition programs (B) address morale and motivation rather than fraud detection or prevention, and annual performance reviews (C) evaluate job performance but do not inherently remove or rotate an employee's access and opportunity to commit and conceal fraud.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Flexible work hours
Why it's wrong here
Flexible hours weaken the mandatory-leave and rotation controls that expose concealed fraud, since another employee never performs the tasks. It is tempting as a retention benefit, but insider fraud mitigation requires enforced absence and separation of duties, not schedule flexibility.
- ✗
Employee recognition programs
Why it's wrong here
Recognition programmes reward performance and retention; they do not impose segregation of duties, mandatory leave or independent reconciliation that deter insider fraud. They are tempting as morale controls, but fraud mitigation needs detective and preventive HR controls such as rotation and background checks.
- ✗
Annual performance reviews
Why it's wrong here
Annual performance reviews assess output and development; they do not enforce segregation of duties, mandatory leave or transaction reconciliation that surface insider fraud. Reviews are tempting as oversight, but the required HR controls are rotation, mandatory leave and background screening.
- ✓
Job rotation
Why this is correct
Job rotation moves staff through different roles, so no single employee retains long-term control over one process, limiting opportunity for concealed insider fraud. This satisfies the stem's requirement for an HR control mitigating insider fraud risk in IT.
- ✓
Mandatory vacation
Why this is correct
Can reveal fraudulent activities during absence.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.