Watch this video on YouTube
What compensating control would be suitable when there are segregation of duties concerns between IT support staff and end users?