Which security practice is NOT recommended for payroll systems?

• A. Implementing Unique User IDs and Role-Based Access
• B. Sharing Passwords Among Team Members
• C. Segregating Duties Across Payroll Tasks
• D. Regularly Updating Access Rights

Answer: (B)

Access control and accountability in payroll systems is being tested here. Sharing passwords among team members is not recommended because it destroys individual accountability and makes actions impossible to trace to a specific person. When passwords are shared, audits, investigations, and authorization checks become unreliable, and the chance of unauthorized changes or data exposure increases. Strong security relies on unique user IDs linked to each user and clear records of who did what.

In contrast, using unique user IDs with role-based access gives each person their own credentials and binds permissions to their role, so actions can be tracked back to the responsible individual. Segregating duties across payroll tasks creates protections against fraud by ensuring that no single person can both process and approve or reconcile payroll without oversight. Regularly updating access rights keeps permissions aligned with current roles and removes outdated or unnecessary access, closing gaps that could be exploited.