| The combination of these accesses could allow a transaction to be entered and then adjusted off in one or more balance sheets or income statement accounts, which wouldn't be allowable with access to just one of these activities. We developed this rule with a risk of High because there could be cases where mitigating controls are in place to review the coding of the transaction or AR adjustment where having the other capabilities would allow a user to circumvent the control in place. |