If the head of the IT department and the CFO have complete access to all aspects of the IT system and the ability to input, change and delete transactions, is this a weakness in ICFR? If so, how important is it? Would this situation have any impact on the audit procedures of the financial statement audit? Given the positions these individuals hold, how might their authority and activities be changed to enhance the control environment while still permitting them to do their jobs?