A clerk can enter supplier invoices and also change supplier bank-account details. Which system-control design most directly reduces the risk that a fraudulent bank-detail change will be used for payment?