Watch this video on YouTube
What is the best response an auditor can make when management claims that additional controls are unnecessary for an accounts payable system because effective system access controls are in place?