I have been in peer groups of small and medium sized businesses. Many of these smaller organizations have only one person in the role of Controller or Comptroll

I have been in peer groups of small and medium sized businesses. Many of these smaller organizations have only one person in the role of Controller or Comptroller and are vulnerable to embezzling. One interesting policy I have seen implemented is that this person gets extra vacation time in addition to what a normal employee gets, but never at time of their choosing. The CEO or COO just comes in one day and says, "Congratulations! Take the next X days off." The organization is forced to plan ahead for the Controller being unavailable and the Controller cannot hide much.