Watch this video on YouTube
Which controls would an IS auditor look for in an environment where duties cannot be appropriately segregated?