An IS auditor notes that due to the small size of the organization, human resources staff can create new employees in the payroll system as well as process payroll. Which of the following is the BEST recommendation to address this situation?

A. Outsource the processing of payroll to a third party.
B. Implement a periodic user access review over the payroll system.
C. Implement periodic reviews of employees in the payroll system.
D. Hire additional staff so that access for the two functions can be segregated.