I've kinda thought about this in the context of relatively complex technical jobs. One side of my family tree worked a bunch in the consumer banking (non-investment) industry, and I remember hearing story after story of someone being caught after their mandatory leave.

But at a job where the ideal is automation, rather than manual verification and analysis, I wonder what additional obstacles must be placed in a potential attacker's way? Rotating keys based on employee schedules? I'm sure there are many well-studied ways to do this, but it's interesting to armchair analyze.