which of the following it controls would a company appropriately use to mitigate the risk of unauthorized access to its payroll data?