While carrying out an access management controls audit, the internal audit team identified that role-based access has been implemented correctly based on least access privilege; however, in case of 3 users from the accounts payable department, even the least access privilege translates to too much authorization. What is the most suitable recommendation that the audit department should make