A quarterly access review finds that a payroll accountant can also edit supplier bank details. The accountant has no assigned vendor-maintenance duties. What is the most appropriate control response?