While the cost of control is certainly something to consider, there are times (many, many times) when more risk should be taken because of the potential for increased reward.
For 5 years, the software company Workiva has partnered with a LinkedIn group, SOX and Internal Controls Professionals Group to survey companies about their SOX compliance program.
Job rotations and vacations continue to be effective internal controls. A September 30, 2020 article in the Scotsman newspaper (the Article) was a recent reminder of this fact. The article explains that embezzlements, which had gone on for more than eight years, began to unravel and were ultimately discovered after the embezzler’s manager announced plans to rotate staff to give them broader experiences.