During a Risk and Control Self-Assessment workshop, a business unit manager identifies a risk of unauthorized trading by junior staff. She rates the inherent risk as 'High' (likelihood: 3/5, impact: 4/5) and notes existing controls (daily trade reconciliation, mandatory vacation policy, dual authorization for trades > $1M). She then rates the residual risk as 'Low' (likelihood: 1/5, impact: 2/5). The largest concern with this assessment is most likely: