A mandatory vacation policy requires staff in sensitive finance roles to take a continuous block of leave each year, with no system access, while someone else does their job. It exposes fraud because most schemes need daily upkeep. When the person who maintains one is away, the cover person meets the evidence directly.
Why does a mandatory vacation policy expose fraud?
A mandatory vacation policy exposes fraud because concealment is work. Someone hiding a theft has to intercept certain mail, adjust certain entries, explain certain reconciling items and answer certain calls, every week. Remove that person for long enough and the hiding stops, so the problem surfaces in front of whoever is covering.
Consider a few illustrative schemes and what happens when the person behind them leaves for two weeks:
- Lapping receipts. Each customer's payment covers the one stolen before it. Without the employee shuffling payments, a customer's account goes past due and the customer calls to complain that they paid.
- A fake vendor. Invoices for the vendor stop arriving, or the cover person cannot find the purchase orders behind them.
- A plugged reconciliation. The cover person preparing the month's reconciliation finds an old deposit in transit that has never cleared.
- Intercepted bank mail. A statement or a bank notice arrives at the office and is opened by someone else for once.
The policy works as a deterrent too. An employee who knows they must hand over the desk every year has a reason not to start a scheme that would not survive the handover.
How long should a mandatory vacation be?
A mandatory vacation should be long enough for pending transactions to clear and for one full cycle of the duties to pass through someone else's hands. For bank employees in sensitive roles, Federal Reserve guidance sets a minimum of two consecutive weeks. A smaller business can choose one or two weeks, depending on their payment and close cycles.
The Federal Reserve's supervisory letter SR 96-37 on required absences from sensitive positions explains the reasoning: most frauds and embezzlements require the continual presence of the wrongdoer. It asks banking organizations to keep employees in sensitive positions away from their duties, physically and through electronic access, for at least two consecutive weeks, and says the absence should be long enough for pending transactions to clear.
That guidance is written for banks, but the logic carries over. When choosing a length, think about the cycles the role touches:
- A role that runs a weekly payment run needs at least one run handled by someone else.
- A role that prepares month-end reconciliations is best covered across a month end.
- A role that handles customer receipts needs enough time for a delayed customer payment to show up as past due.
Split days do not achieve this. Two separate Fridays off leave every weekly task in the same hands.
Who covers cash duties during a mandatory vacation
Cash duties during a mandatory vacation should be covered by someone who does not normally work closely with the absent employee and who has their own access to the systems. The absent employee keeps no login, no token and no say over the work while they are gone. Otherwise the absence exists on the calendar only.
Before the leave starts, do three things:
- Give the cover person their own credentials for the accounting system and online banking, with the access they need and no more.
- Suspend or disable the absent employee's logins, including remote access and banking tokens.
- Route the mail, the bank's alerts and the main finance email box to the cover person.
A complete list of the accounts in play makes the handover safer. Some schemes rely on an account the rest of the business has forgotten exists; keeping a bank account inventory shows how to list every account, signer and online user and confirm the list with each bank.
In a business with one bookkeeper, the cover person may be the owner or an outside accountant for those two weeks. That is still worth doing. The owner learns how the books really work, which also makes later reviews faster.
What should the cover person review during the mandatory leave?
The cover person should do the normal work and, alongside it, look at the places where concealment would show: unopened bank mail, customer complaints, aged reconciling items, unfamiliar vendors and any balance the absent person was the only one to understand. The owner should do a statement review of their own during the same weeks.
A checklist for the absence
The list below is an example for a small finance team. Add the duties your role covers.
- Open all bank and vendor mail, including anything marked personal to the absent employee that is plainly business mail.
- Answer customer calls about payments and check each complaint against the receivables ledger.
- Run the vendor list and look for vendors with no purchase orders, no address or a bank account that changed recently.
- Prepare the bank reconciliation if a month end falls in the window, and trace every old reconciling item to the statement where it should have cleared.
- Look at any clearing or holding account that only the absent employee normally reconciles, such as a processor reserve; payment processor reserve accounting shows how a reserve should tie to the bank each month.
- Compare payroll to the approved headcount.
- Write down anything unclear and ask about it when the employee returns, not while they are away.
The owner's part is a fresh look at the statement during the absence. A short routine for that is in the 15-minute owner review of bank statements.
When the statements for the period are ready, PreciseBankFlow can check that each one foots and list possible duplicates and missing items, which gives the cover person a short list of lines to question instead of a full statement to read.
When a mandatory vacation policy fails: remote logins and friendly cover
A mandatory vacation policy fails when the absent employee can still reach the work, or when the cover person will not look closely. Remote logins left active, a phone that still receives the banking codes, and a close colleague who agrees to "just keep things ticking over" all let a scheme carry on through the leave.
Watch for these in practice:
- Access left on. Logins and tokens are not suspended, and the system logs show activity under the absent employee's name.
- Work saved for return. The cover person is asked to leave the reconciliation, the vendor mail or a particular customer for the employee to handle later.
- The same cover every year. One trusted colleague always covers, and nobody else ever sees the role.
- Resistance to the leave. An employee who refuses time off for years, or takes it only in single days, is the person the policy is meant for.
None of these proves wrongdoing. Plenty of people dislike handing over their desk. The response is the same either way: suspend the access, rotate the cover, and make the leave a condition of the role rather than a favor.