What can an organization use to address the risk of a perpetrator inserting a fraudulent payroll transaction along with legitimate transactions directly into the information system?

What can an organization use to address the risk of a perpetrator inserting a fraudulent payroll transaction along with legitimate transactions directly into the information system?

• A. Internal controls to prevent all access to the database
• B. Stronger access controls to the database
• C. Employee background checks
• D. Internal controls to detect unauthorized changes

Answer: (D)

Detecting unauthorized changes is the key defense here. Even if access is restricted, someone with enough rights could insert a fraudulent payroll transaction alongside legitimate ones. Detection controls—such as thorough audit trails, change logs, approved change processes, and independent reconciliations of payroll postings—make it possible to identify, investigate, and reverse any unauthorized entries. These controls provide ongoing monitoring that catches anomalies and holds perpetrators accountable, which is essential when changes are made directly in the system. While stricter access and background checks have value, they don’t guarantee that fraudulent changes won’t occur or go unnoticed. Prevention helps, but the most effective response to this specific risk is internal controls designed to detect unauthorized changes as soon as they happen.

Detecting unauthorized changes is the key defense here. Even if access is restricted, someone with enough rights could insert a fraudulent payroll transaction alongside legitimate ones. Detection controls—such as thorough audit trails, change logs, approved change processes, and independent reconciliations of payroll postings—make it possible to identify, investigate, and reverse any unauthorized entries. These controls provide ongoing monitoring that catches anomalies and holds perpetrators accountable, which is essential when changes are made directly in the system.

While stricter access and background checks have value, they don’t guarantee that fraudulent changes won’t occur or go unnoticed. Prevention helps, but the most effective response to this specific risk is internal controls designed to detect unauthorized changes as soon as they happen.