A process owner approves access while the same person can create users and conceal audit records. What principle should guide remediation?

1. Separate incompatible duties or establish effective compensating oversight
2. Remove all audit collection to reduce administrative work
3. Move all tasks to another single person without oversight
4. Require a longer account username