Evidence of strong access controls ensuring that authorized individuals have access only to the functions related to their responsibilities.