What I am hinting at is that physical and logical access controls must work as designed and only such employees who ‘need to know’ the intricacies of the application software/programmes must have access to them.