d. If double verification implemented: would you still wish to monitor the risk of combined access of master data and payroll processing?
• We might downgrade the risk from High to Medium but would still want to monitor combined access for the situations that the verification function is not properly executed