Access to enter suppliers allows a user the ability to set up a fictitious supplier. In Oracle, you must enter an invoice to make a payment, so this risk is minimized unless incidents of collusion. If so, they could approve an invoice that would be entered by another clerk and then they could generate the payment.