Employee and contractor rotation

Rotate employees and contractors to reduce over-familiarity with systems and limit opportunities for malicious activity.

This control targets internal fraud risks.

Examples

Examples of this control include:

regularly rotating employees in high-risk positions
rotating contract managers so they do not develop a conflict of interest with suppliers.

Leaving employees and contractors in positions for too long can lead to:

less visibility of fraud and corruption risks
employees or contractors taking advantage of positions of trust to act corruptly, commit fraud and avoid exposure
employees and contractors becoming overly familiar with processes and learning how to exploit weaknesses
fraud or corruption going undetected for a long period of time
employees being targeted and coerced to process fraudulent claims or invoices for another person or organisation.

Methods to evaluate the effectiveness of this control include:

confirming the existence of a rotation policy or best practice guidelines for rotating employees through high-risk roles
confirming that high-risk roles are reviewed regularly
reviewing procedures or guidance to make sure it clearly specifies requirements for rotation and contractor engagement
reviewing statistics or reports on employees and contractor positions and durations.

Other capability, prevention, detection and response controls that can enhance this control’s effectiveness:

Types of behaviour this control is designed to mitigate:

Explore a range of controls that can be put in place to reduce the risk of fraud happening in your organisation.