Which of the following is a red flag for insider computer fraud?

• A. Access logs are reviewed regularly
• B. Production programs run at unusual hours
• C. End users are not allowed to access production data
• D. Exception reports are not reviewed and resolved

Answer: (D)

Lack of monitoring and follow-through on exceptions is a major red flag in insider fraud detection. Exception reports highlight deviations from normal policies or expected behavior. If these reports are not reviewed and not resolved, those deviations can accumulate without anyone noticing, making it easy for someone inside to conceal unauthorized activity or transactions. The absence of corrective action signals weak governance and increased opportunity for fraud.

Regularly reviewing access logs shows active monitoring, which is a positive control. Production programs running at unusual hours can have legitimate reasons like batch processing or maintenance windows, so it isn’t by itself definitive of fraud. End users not being allowed to access production data is a security best practice and reduces risk, not a warning sign.